crypto/rsa/rsa_ossl.c:693: error: BUFFER_OVERRUN_L3
  Offset: [1, 2] Size: [1, +oo] by call to `RSA_padding_check_PKCS1_type_1`.
Showing all 12 steps of the trace


crypto/rsa/rsa_ossl.c:650:11: Call
648.       f = BN_CTX_get(ctx);
649.       ret = BN_CTX_get(ctx);
650.       num = BN_num_bytes(rsa->n);
                 ^
651.       buf = OPENSSL_malloc(num);
652.       if (f == NULL || ret == NULL || buf == NULL) {

crypto/bn/bn_lib.c:220:9: Assignment
  218.   
  219.       if (BN_is_zero(a))
  220.           return 0;
                 ^
  221.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));
  222.   }

crypto/rsa/rsa_ossl.c:650:5: Assignment
648.       f = BN_CTX_get(ctx);
649.       ret = BN_CTX_get(ctx);
650.       num = BN_num_bytes(rsa->n);
           ^
651.       buf = OPENSSL_malloc(num);
652.       if (f == NULL || ret == NULL || buf == NULL) {

crypto/rsa/rsa_ossl.c:651:11: Call
649.       ret = BN_CTX_get(ctx);
650.       num = BN_num_bytes(rsa->n);
651.       buf = OPENSSL_malloc(num);
                 ^
652.       if (f == NULL || ret == NULL || buf == NULL) {
653.           RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, ERR_R_MALLOC_FAILURE);

crypto/mem.c:124:9: Assignment
  122.   
  123.       if (num <= 0)
  124.           return NULL;
                 ^
  125.   
  126.       allow_customize = 0;

crypto/rsa/rsa_ossl.c:651:5: Assignment
649.       ret = BN_CTX_get(ctx);
650.       num = BN_num_bytes(rsa->n);
651.       buf = OPENSSL_malloc(num);
           ^
652.       if (f == NULL || ret == NULL || buf == NULL) {
653.           RSAerr(RSA_F_RSA_OSSL_PUBLIC_DECRYPT, ERR_R_MALLOC_FAILURE);

crypto/rsa/rsa_ossl.c:693:13: Call
691.       switch (padding) {
692.       case RSA_PKCS1_PADDING:
693.           r = RSA_padding_check_PKCS1_type_1(to, num, buf, i, num);
                   ^
694.           break;
695.       case RSA_X931_PADDING:

crypto/rsa/rsa_pk1.c:92:1: <Length trace>
90.   }
91.   
92. > int RSA_padding_check_PKCS1_type_1(unsigned char *to, int tlen,
93.                                      const unsigned char *from, int flen,
94.                                      int num)

crypto/rsa/rsa_pk1.c:92:1: Parameter `*from`
  90.   }
  91.   
  92. > int RSA_padding_check_PKCS1_type_1(unsigned char *to, int tlen,
  93.                                      const unsigned char *from, int flen,
  94.                                      int num)

crypto/rsa/rsa_pk1.c:99:5: Assignment
  97.       const unsigned char *p;
  98.   
  99.       p = from;
             ^
  100.   
  101.       /*

crypto/rsa/rsa_pk1.c:121:35: Assignment
  119.       }
  120.   
  121.       if ((num != (flen + 1)) || (*(p++) != 0x01)) {
                                           ^
  122.           RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_1,
  123.                  RSA_R_BLOCK_TYPE_IS_NOT_01);

crypto/rsa/rsa_pk1.c:131:17: Array access: Offset: [1, 2] Size: [1, +oo] by call to `RSA_padding_check_PKCS1_type_1` 
  129.       for (i = 0; i < j; i++) {
  130.           if (*p != 0xff) {       /* should decrypt to 0xff */
  131.               if (*p == 0) {
                         ^
  132.                   p++;
  133.                   break;
