apps/pkeyutl.c:315: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `ASN1_parse_dump`.
Showing all 16 steps of the trace


apps/pkeyutl.c:124:5: Assignment
122.       char *infile = NULL, *outfile = NULL, *sigfile = NULL, *passinarg = NULL;
123.       char hexdump = 0, asn1parse = 0, rev = 0, *prog;
124.       unsigned char *buf_in = NULL, *buf_out = NULL, *sig = NULL;
           ^
125.       OPTION_CHOICE o;
126.       int buf_inlen = 0, siglen = -1, keyform = FORMAT_PEM, peerform =

apps/pkeyutl.c:315:14: Call
313.   
314.       if (asn1parse) {
315.           if (!ASN1_parse_dump(out, buf_out, buf_outlen, 1, -1))
                    ^
316.               ERR_print_errors(bio_err);
317.       } else if (hexdump)

crypto/asn1/asn1_par.c:112:1: Parameter `*pp`
  110.   }
  111.   
  112. > int ASN1_parse_dump(BIO *bp, const unsigned char *pp, long len, int indent,
  113.                       int dump)
  114.   {

crypto/asn1/asn1_par.c:115:13: Call
  113.                       int dump)
  114.   {
  115.       return (asn1_parse2(bp, &pp, len, 0, 0, indent, dump));
                     ^
  116.   }
  117.   

crypto/asn1/asn1_par.c:118:1: Parameter `**pp`
    116.   }
    117.   
    118. > static int asn1_parse2(BIO *bp, const unsigned char **pp, long length,
    119.                          int offset, int depth, int indent, int dump)
    120.   {

crypto/asn1/asn1_par.c:136:5: Assignment
    134.   
    135.       dump_indent = 6;            /* Because we know BIO_dump_indent() */
    136.       p = *pp;
               ^
    137.       tot = p + length;
    138.       op = p - 1;

crypto/asn1/asn1_par.c:141:13: Call
    139.       while ((p < tot) && (op < p)) {
    140.           op = p;
    141.           j = ASN1_get_object(&p, &len, &tag, &xclass, length);
                       ^
    142.           if (j & 0x80) {
    143.               if (BIO_write(bp, "Error in encoding\n", 18) <= 0)

crypto/asn1/asn1_lib.c:92:1: Parameter `**pp`
      90.   }
      91.   
      92. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
      93.                       int *pclass, long omax)
      94.   {

crypto/asn1/asn1_lib.c:97:5: Assignment
      95.       int i, ret;
      96.       long l;
      97.       const unsigned char *p = *pp;
                 ^
      98.       int tag, xclass, inf;
      99.       long max = omax;

crypto/asn1/asn1_lib.c:126:9: Assignment
      124.       } else {
      125.           tag = i;
      126.           p++;
                     ^
      127.           if (--max == 0)
      128.               goto err;

crypto/asn1/asn1_lib.c:132:10: Call
      130.       *ptag = tag;
      131.       *pclass = xclass;
      132.       if (!asn1_get_length(&p, &inf, plength, (int)max))
                      ^
      133.           goto err;
      134.   

crypto/asn1/asn1_lib.c:153:1: <Length trace>
151.   }
152.   
153. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
154.                              int max)
155.   {

crypto/asn1/asn1_lib.c:153:1: Parameter `**pp`
        151.   }
        152.   
        153. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
        154.                              int max)
        155.   {

crypto/asn1/asn1_lib.c:156:5: Assignment
        154.                              int max)
        155.   {
        156.       const unsigned char *p = *pp;
                   ^
        157.       unsigned long ret = 0;
        158.       unsigned int i;

crypto/asn1/asn1_lib.c:169:15: Assignment
        167.           *inf = 0;
        168.           i = *p & 0x7f;
        169.           if (*(p++) & 0x80) {
                             ^
        170.               if (max < (int)i)
        171.                   return 0;

crypto/asn1/asn1_lib.c:173:25: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `ASN1_parse_dump` 
        171.                   return 0;
        172.               /* Skip leading zeroes */
        173.               while (i && *p == 0) {
                                       ^
        174.                   p++;
        175.                   i--;
