crypto/pem/pvkfmt.c:767: error: BUFFER_OVERRUN_L3
  Offset: 11 Size: [8, +oo] by call to `do_PVK_body`.
Showing all 16 steps of the trace


crypto/pem/pvkfmt.c:754:10: Call
752.       p = pvk_hdr;
753.   
754.       if (!do_PVK_header(&p, 24, 0, &saltlen, &keylen))
                ^
755.           return 0;
756.       buflen = (int)keylen + saltlen;

crypto/pem/pvkfmt.c:609:1: Parameter `*pkeylen`
  607.   # ifndef OPENSSL_NO_RC4
  608.   
  609. > static int do_PVK_header(const unsigned char **in, unsigned int length,
  610.                            int skip_magic,
  611.                            unsigned int *psaltlen, unsigned int *pkeylen)

crypto/pem/pvkfmt.c:767:11: Call
765.           goto err;
766.       }
767.       ret = do_PVK_body(&p, saltlen, keylen, cb, u);
                 ^
768.   
769.    err:

crypto/pem/pvkfmt.c:666:1: Parameter `keylen`
  664.   }
  665.   
  666. > static EVP_PKEY *do_PVK_body(const unsigned char **in,
  667.                                unsigned int saltlen, unsigned int keylen,
  668.                                pem_password_cb *cb, void *u)

crypto/pem/pvkfmt.c:689:18: Call
  687.               goto err;
  688.           }
  689.           enctmp = OPENSSL_malloc(keylen + 8);
                          ^
  690.           if (enctmp == NULL) {
  691.               PEMerr(PEM_F_DO_PVK_BODY, ERR_R_MALLOC_FAILURE);

crypto/mem.c:125:9: Assignment
    123.   
    124.       if (num <= 0)
    125.           return NULL;
                   ^
    126.   
    127.       allow_customize = 0;

crypto/pem/pvkfmt.c:689:9: Assignment
  687.               goto err;
  688.           }
  689.           enctmp = OPENSSL_malloc(keylen + 8);
                 ^
  690.           if (enctmp == NULL) {
  691.               PEMerr(PEM_F_DO_PVK_BODY, ERR_R_MALLOC_FAILURE);

crypto/pem/pvkfmt.c:706:9: Assignment
  704.           }
  705.           inlen = keylen - 8;
  706.           q = enctmp + 8;
                 ^
  707.           if (!EVP_DecryptInit_ex(&cctx, EVP_rc4(), NULL, keybuf, NULL))
  708.               goto err;

crypto/pem/pvkfmt.c:713:17: Call
  711.           if (!EVP_DecryptFinal_ex(&cctx, q + enctmplen, &enctmplen))
  712.               goto err;
  713.           magic = read_ledword((const unsigned char **)&q);
                         ^
  714.           if (magic != MS_RSA2MAGIC && magic != MS_DSS2MAGIC) {
  715.               q = enctmp + 8;

crypto/pem/pvkfmt.c:77:1: <Length trace>
75.    */
76.   
77. > static unsigned int read_ledword(const unsigned char **in)
78.   {
79.       const unsigned char *p = *in;

crypto/pem/pvkfmt.c:77:1: Parameter `**in`
    75.    */
    76.   
    77. > static unsigned int read_ledword(const unsigned char **in)
    78.   {
    79.       const unsigned char *p = *in;

crypto/pem/pvkfmt.c:79:5: Assignment
    77.   static unsigned int read_ledword(const unsigned char **in)
    78.   {
    79.       const unsigned char *p = *in;
              ^
    80.       unsigned int ret;
    81.       ret = *p++;

crypto/pem/pvkfmt.c:81:12: Assignment
    79.       const unsigned char *p = *in;
    80.       unsigned int ret;
    81.       ret = *p++;
                     ^
    82.       ret |= (*p++ << 8);
    83.       ret |= (*p++ << 16);

crypto/pem/pvkfmt.c:82:14: Assignment
    80.       unsigned int ret;
    81.       ret = *p++;
    82.       ret |= (*p++ << 8);
                       ^
    83.       ret |= (*p++ << 16);
    84.       ret |= (*p++ << 24);

crypto/pem/pvkfmt.c:83:14: Assignment
    81.       ret = *p++;
    82.       ret |= (*p++ << 8);
    83.       ret |= (*p++ << 16);
                       ^
    84.       ret |= (*p++ << 24);
    85.       *in = p;

crypto/pem/pvkfmt.c:84:13: Array access: Offset: 11 Size: [8, +oo] by call to `do_PVK_body` 
    82.       ret |= (*p++ << 8);
    83.       ret |= (*p++ << 16);
    84.       ret |= (*p++ << 24);
                      ^
    85.       *in = p;
    86.       return ret;
