ssl/s2_srvr.c:908: error: BUFFER_OVERRUN_L3
  Offset: [5, +oo] Size: [0, +oo] by call to `i2d_X509`.
Showing all 33 steps of the trace


ssl/s2_srvr.c:900:5: Call
898.   		EVP_VerifyUpdate(&ctx,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
899.   
900.   		i=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
           ^
901.   		buf2=(unsigned char *)Malloc((unsigned int)i);
902.   		if (buf2 == NULL)

crypto/asn1/x_x509.c:77:2: Assignment
  75.   int i2d_X509(X509 *a, unsigned char **pp)
  76.   	{
  77.   	M_ASN1_I2D_vars(a);
         ^
  78.   
  79.   	M_ASN1_I2D_len(a->cert_info,	i2d_X509_CINF);

ssl/s2_srvr.c:900:3: Assignment
898.   		EVP_VerifyUpdate(&ctx,ccd,SSL2_MIN_CERT_CHALLENGE_LENGTH);
899.   
900.   		i=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
         ^
901.   		buf2=(unsigned char *)Malloc((unsigned int)i);
902.   		if (buf2 == NULL)

ssl/s2_srvr.c:901:25: Array declaration
899.   
900.   		i=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
901.   		buf2=(unsigned char *)Malloc((unsigned int)i);
                               ^
902.   		if (buf2 == NULL)
903.   			{

ssl/s2_srvr.c:901:3: Assignment
899.   
900.   		i=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,NULL);
901.   		buf2=(unsigned char *)Malloc((unsigned int)i);
         ^
902.   		if (buf2 == NULL)
903.   			{

ssl/s2_srvr.c:907:3: Assignment
905.   			goto msg_end;
906.   			}
907.   		p2=buf2;
         ^
908.   		i=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,&p2);
909.   		EVP_VerifyUpdate(&ctx,buf2,(unsigned int)i);

ssl/s2_srvr.c:908:5: Call
906.   			}
907.   		p2=buf2;
908.   		i=i2d_X509(s->cert->pkeys[SSL_PKEY_RSA_ENC].x509,&p2);
           ^
909.   		EVP_VerifyUpdate(&ctx,buf2,(unsigned int)i);
910.   		Free(buf2);

crypto/asn1/x_x509.c:75:1: Parameter `**pp`
  73.   	}
  74.   
  75. > int i2d_X509(X509 *a, unsigned char **pp)
  76.   	{
  77.   	M_ASN1_I2D_vars(a);

crypto/asn1/x_x509.c:83:2: Assignment
  81.   	M_ASN1_I2D_len(a->signature,	i2d_ASN1_BIT_STRING);
  82.   
  83.   	M_ASN1_I2D_seq_total();
         ^
  84.   
  85.   	M_ASN1_I2D_put(a->cert_info,	i2d_X509_CINF);

crypto/asn1/x_x509.c:83:2: Call
  81.   	M_ASN1_I2D_len(a->signature,	i2d_ASN1_BIT_STRING);
  82.   
  83.   	M_ASN1_I2D_seq_total();
         ^
  84.   
  85.   	M_ASN1_I2D_put(a->cert_info,	i2d_X509_CINF);

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
    178.   /* class 0 is constructed
    179.    * constructed == 2 for indefinitle length constructed */
    180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
    181.   	     int xclass)
    182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
    181.   	     int xclass)
    182.   	{
    183.   	unsigned char *p= *pp;
            ^
    184.   	int i;
    185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
    187.   	i|=(xclass&V_ASN1_PRIVATE);
    188.   	if (tag < 31)
    189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
               ^
    190.   	else
    191.   		{

crypto/asn1/asn1_lib.c:201:5: Assignment
    199.   		}
    200.   	if ((constructed == 2) && (length == 0))
    201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
               ^
    202.   	else
    203.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:204:2: Assignment
    202.   	else
    203.   		asn1_put_length(&p,length);
    204.   	*pp=p;
            ^
    205.   	}
    206.   

crypto/asn1/x_x509.c:85:2: Call
  83.   	M_ASN1_I2D_seq_total();
  84.   
  85.   	M_ASN1_I2D_put(a->cert_info,	i2d_X509_CINF);
         ^
  86.   	M_ASN1_I2D_put(a->sig_alg,	i2d_X509_ALGOR);
  87.   	M_ASN1_I2D_put(a->signature,	i2d_ASN1_BIT_STRING);

crypto/asn1/x_cinf.c:63:1: Parameter `**pp`
    61.   #include <openssl/asn1_mac.h>
    62.   
    63. > int i2d_X509_CINF(X509_CINF *a, unsigned char **pp)
    64.   	{
    65.   	int v1=0,v2=0;

crypto/asn1/x_cinf.c:81:2: Assignment
    79.   					     V_ASN1_SEQUENCE,v2);
    80.   
    81.   	M_ASN1_I2D_seq_total();
           ^
    82.   
    83.   	M_ASN1_I2D_put_EXP_opt(a->version,i2d_ASN1_INTEGER,0,v1);

crypto/asn1/x_cinf.c:81:2: Call
    79.   					     V_ASN1_SEQUENCE,v2);
    80.   
    81.   	M_ASN1_I2D_seq_total();
           ^
    82.   
    83.   	M_ASN1_I2D_put_EXP_opt(a->version,i2d_ASN1_INTEGER,0,v1);

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
      178.   /* class 0 is constructed
      179.    * constructed == 2 for indefinitle length constructed */
      180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
      181.   	     int xclass)
      182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
      181.   	     int xclass)
      182.   	{
      183.   	unsigned char *p= *pp;
              ^
      184.   	int i;
      185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
      187.   	i|=(xclass&V_ASN1_PRIVATE);
      188.   	if (tag < 31)
      189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
                 ^
      190.   	else
      191.   		{

crypto/asn1/asn1_lib.c:201:5: Assignment
      199.   		}
      200.   	if ((constructed == 2) && (length == 0))
      201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
                 ^
      202.   	else
      203.   		asn1_put_length(&p,length);

crypto/asn1/asn1_lib.c:204:2: Assignment
      202.   	else
      203.   		asn1_put_length(&p,length);
      204.   	*pp=p;
              ^
      205.   	}
      206.   

crypto/asn1/x_cinf.c:83:2: Call
    81.   	M_ASN1_I2D_seq_total();
    82.   
    83.   	M_ASN1_I2D_put_EXP_opt(a->version,i2d_ASN1_INTEGER,0,v1);
           ^
    84.   	M_ASN1_I2D_put(a->serialNumber,		i2d_ASN1_INTEGER);
    85.   	M_ASN1_I2D_put(a->signature,		i2d_X509_ALGOR);

crypto/asn1/asn1_lib.c:180:1: Parameter `**pp`
      178.   /* class 0 is constructed
      179.    * constructed == 2 for indefinitle length constructed */
      180. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
      181.   	     int xclass)
      182.   	{

crypto/asn1/asn1_lib.c:183:2: Assignment
      181.   	     int xclass)
      182.   	{
      183.   	unsigned char *p= *pp;
              ^
      184.   	int i;
      185.   

crypto/asn1/asn1_lib.c:189:5: Assignment
      187.   	i|=(xclass&V_ASN1_PRIVATE);
      188.   	if (tag < 31)
      189.   		*(p++)=i|(tag&V_ASN1_PRIMITIVE_TAG);
                 ^
      190.   	else
      191.   		{

crypto/asn1/asn1_lib.c:203:3: Call
      201.   		*(p++)=0x80; /* der_put_length would output 0 instead */
      202.   	else
      203.   		asn1_put_length(&p,length);
               ^
      204.   	*pp=p;
      205.   	}

crypto/asn1/asn1_lib.c:207:1: <Length trace>
205.   	}
206.   
207. > static void asn1_put_length(unsigned char **pp, int length)
208.   	{
209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:207:1: Parameter `**pp`
        205.   	}
        206.   
        207. > static void asn1_put_length(unsigned char **pp, int length)
        208.   	{
        209.   	unsigned char *p= *pp;

crypto/asn1/asn1_lib.c:209:2: Assignment
        207.   static void asn1_put_length(unsigned char **pp, int length)
        208.   	{
        209.   	unsigned char *p= *pp;
                ^
        210.   	int i,l;
        211.   	if (length <= 127)

crypto/asn1/asn1_lib.c:212:3: Array access: Offset: [5, +oo] Size: [0, +oo] by call to `i2d_X509` 
        210.   	int i,l;
        211.   	if (length <= 127)
        212.   		*(p++)=(unsigned char)length;
                 ^
        213.   	else
        214.   		{
