crypto/pem/pvkfmt.c:767: error: BUFFER_OVERRUN_L3
  Offset added: [10, +oo] (⇐ [9, +oo] + [1, +oo]) Size: [8, +oo] by call to `do_PVK_body`.
Showing all 13 steps of the trace


crypto/pem/pvkfmt.c:754:10: Call
752.       p = pvk_hdr;
753.   
754.       if (!do_PVK_header(&p, 24, 0, &saltlen, &keylen))
                ^
755.           return 0;
756.       buflen = (int)keylen + saltlen;

crypto/pem/pvkfmt.c:609:1: Parameter `*pkeylen`
  607.   # ifndef OPENSSL_NO_RC4
  608.   
  609. > static int do_PVK_header(const unsigned char **in, unsigned int length,
  610.                            int skip_magic,
  611.                            unsigned int *psaltlen, unsigned int *pkeylen)

crypto/pem/pvkfmt.c:767:11: Call
765.           goto err;
766.       }
767.       ret = do_PVK_body(&p, saltlen, keylen, cb, u);
                 ^
768.   
769.    err:

crypto/pem/pvkfmt.c:666:1: Parameter `keylen`
  664.   }
  665.   
  666. > static EVP_PKEY *do_PVK_body(const unsigned char **in,
  667.                                unsigned int saltlen, unsigned int keylen,
  668.                                pem_password_cb *cb, void *u)

crypto/pem/pvkfmt.c:705:9: Assignment
  703.               goto err;
  704.           }
  705.           inlen = keylen - 8;
                 ^
  706.           q = enctmp + 8;
  707.           if (!EVP_DecryptInit_ex(&cctx, EVP_rc4(), NULL, keybuf, NULL))

crypto/pem/pvkfmt.c:709:14: Call
  707.           if (!EVP_DecryptInit_ex(&cctx, EVP_rc4(), NULL, keybuf, NULL))
  708.               goto err;
  709.           if (!EVP_DecryptUpdate(&cctx, q, &enctmplen, p, inlen))
                      ^
  710.               goto err;
  711.           if (!EVP_DecryptFinal_ex(&cctx, q + enctmplen, &enctmplen))

crypto/evp/evp_enc.c:401:1: Parameter `inl`
    399.   }
    400.   
    401. > int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
    402.                         const unsigned char *in, int inl)
    403.   {

crypto/evp/evp_enc.c:423:16: Call
    421.   
    422.       if (ctx->flags & EVP_CIPH_NO_PADDING)
    423.           return EVP_EncryptUpdate(ctx, out, outl, in, inl);
                          ^
    424.   
    425.       b = ctx->cipher->block_size;

crypto/evp/evp_enc.c:289:1: <Offset trace>
287.   }
288.   
289. > int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
290.                         const unsigned char *in, int inl)
291.   {

crypto/evp/evp_enc.c:289:1: Parameter `inl`
      287.   }
      288.   
      289. > int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
      290.                         const unsigned char *in, int inl)
      291.   {

crypto/evp/evp_enc.c:289:1: <Length trace>
287.   }
288.   
289. > int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
290.                         const unsigned char *in, int inl)
291.   {

crypto/evp/evp_enc.c:289:1: Parameter `*in`
      287.   }
      288.   
      289. > int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
      290.                         const unsigned char *in, int inl)
      291.   {

crypto/evp/evp_enc.c:322:13: Array access: Offset added: [10, +oo] (⇐ [9, +oo] + [1, +oo]) Size: [8, +oo] by call to `do_PVK_body` 
      320.       if (i != 0) {
      321.           if (i + inl < bl) {
      322.               memcpy(&(ctx->buf[i]), in, inl);
                         ^
      323.               ctx->buf_len += inl;
      324.               *outl = 0;
