test/lhash_test.c:98: error: BUFFER_OVERRUN_L3
  Offset: [16, +oo] Size: [1, +oo] by call to `lh_int_insert`.
Showing all 17 steps of the trace


test/lhash_test.c:87:24: Call
85.       };
86.       const unsigned int n_dels = OSSL_NELEM(dels);
87.       LHASH_OF(int) *h = lh_int_new(&int_hash, &int_cmp);
                             ^
88.       unsigned int i;
89.       int testresult = 0, j, *p;

test/lhash_test.c:34:1: Call
  32.   #endif
  33.   
  34. > DEFINE_LHASH_OF(int);
  35.   
  36.   static int int_tests[] = { 65537, 13, 1, 3, -5, 6, 7, 4, -10, -12, -14, 22, 9,

crypto/lhash/lhash.c:38:5: Assignment
    36.       ret->hash = ((h == NULL) ? (OPENSSL_LH_HASHFUNC)OPENSSL_LH_strhash : h);
    37.       ret->num_nodes = MIN_NODES / 2;
    38.       ret->num_alloc_nodes = MIN_NODES;
              ^
    39.       ret->pmax = MIN_NODES / 2;
    40.       ret->up_load = UP_LOAD;

test/lhash_test.c:98:13: Call
96.       /* insert */
97.       for (i = 0; i < n_int_tests; i++)
98.           if (lh_int_insert(h, int_tests + i) != NULL) {
                   ^
99.               fprintf(stderr, "test lhash int insert %d\n", i);
100.               goto end;

test/lhash_test.c:34:1: Parameter `lh->num_alloc_nodes`
  32.   #endif
  33.   
  34. > DEFINE_LHASH_OF(int);
  35.   
  36.   static int int_tests[] = { 65537, 13, 1, 3, -5, 6, 7, 4, -10, -12, -14, 22, 9,

test/lhash_test.c:34:1: Call
  32.   #endif
  33.   
  34. > DEFINE_LHASH_OF(int);
  35.   
  36.   static int int_tests[] = { 65537, 13, 1, 3, -5, 6, 7, 4, -10, -12, -14, 22, 9,

crypto/lhash/lhash.c:70:1: Parameter `lh->num_alloc_nodes`
    68.   }
    69.   
    70. > void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data)
    71.   {
    72.       unsigned long hash;

crypto/lhash/lhash.c:77:77: Call
    75.   
    76.       lh->error = 0;
    77.       if ((lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)) && !expand(lh))
                                                                                      ^
    78.           return NULL;        /* 'lh->error++' already done in 'expand' */
    79.   

crypto/lhash/lhash.c:187:1: <Offset trace>
185.   }
186.   
187. > static int expand(OPENSSL_LHASH *lh)
188.   {
189.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:187:1: Parameter `lh->num_alloc_nodes`
      185.   }
      186.   
      187. > static int expand(OPENSSL_LHASH *lh)
      188.   {
      189.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:213:9: Assignment
      211.   
      212.       if ((lh->p) >= lh->pmax) {
      213.           j = (int)lh->num_alloc_nodes * 2;
                     ^
      214.           n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));
      215.           if (n == NULL) {

crypto/lhash/lhash.c:187:1: <Length trace>
185.   }
186.   
187. > static int expand(OPENSSL_LHASH *lh)
188.   {
189.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:187:1: Parameter `*lh->b`
      185.   }
      186.   
      187. > static int expand(OPENSSL_LHASH *lh)
      188.   {
      189.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:214:13: Call
      212.       if ((lh->p) >= lh->pmax) {
      213.           j = (int)lh->num_alloc_nodes * 2;
      214.           n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));
                         ^
      215.           if (n == NULL) {
      216.               lh->error++;

crypto/mem.c:207:9: Assignment
        205.       if (num == 0) {
        206.           CRYPTO_free(str, file, line);
        207.           return NULL;
                       ^
        208.       }
        209.   

crypto/lhash/lhash.c:214:9: Assignment
      212.       if ((lh->p) >= lh->pmax) {
      213.           j = (int)lh->num_alloc_nodes * 2;
      214.           n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));
                     ^
      215.           if (n == NULL) {
      216.               lh->error++;

crypto/lhash/lhash.c:222:13: Array access: Offset: [16, +oo] Size: [1, +oo] by call to `lh_int_insert` 
      220.           }
      221.           for (i = (int)lh->num_alloc_nodes; i < j; i++) /* 26/02/92 eay */
      222.               n[i] = NULL;        /* 02/03/92 eay */
                         ^
      223.           lh->pmax = lh->num_alloc_nodes;
      224.           lh->num_alloc_nodes = j;

static int expand(OPENSSL_LHASH *lh)
{
    OPENSSL_LH_NODE **n, **n1, **n2, *np;
    unsigned int p, i, j;
    unsigned long hash, nni;
    lh->num_nodes++;
    lh->num_expands++;
    p = (int)lh->p++;
    n1 = &(lh->b[p]);
    n2 = &(lh->b[p + (int)lh->pmax]);
    *n2 = NULL;
    nni = lh->num_alloc_nodes;
    for (np = *n1; np != NULL;) {
        hash = np->hash;
        if ((hash % nni) != p) {
            *n1 = (*n1)->next;
            np->next = *n2;
            *n2 = np;
        } else
            n1 = &((*n1)->next);
        np = *n1;
    }
    if ((lh->p) >= lh->pmax) {
        j = (int)lh->num_alloc_nodes * 2;
        n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));
        if (n == NULL) {
            lh->error++;
            lh->num_nodes--;
            lh->p = 0;
            return 0;
        }
        for (i = (int)lh->num_alloc_nodes; i < j; i++)
            n[i] = NULL;
        lh->pmax = lh->num_alloc_nodes;
        lh->num_alloc_nodes = j;
        lh->num_expand_reallocs++;
        lh->p = 0;
        lh->b = n;
    }
    return 1;
}
['static int test_int_lhash(void)\n{\n    static struct {\n        int data;\n        int null;\n    } dels[] = {\n        { 65537,    0 },\n        { 173,      0 },\n        { 999,      1 },\n        { 37,       0 },\n        { 1,        0 },\n        { 34,       1 }\n    };\n    const unsigned int n_dels = OSSL_NELEM(dels);\n    LHASH_OF(int) *h = lh_int_new(&int_hash, &int_cmp);\n    unsigned int i;\n    int testresult = 0, j, *p;\n    if (h == NULL) {\n        fprintf(stderr, "test lhash int allocation\\n");\n        goto end;\n    }\n    for (i = 0; i < n_int_tests; i++)\n        if (lh_int_insert(h, int_tests + i) != NULL) {\n            fprintf(stderr, "test lhash int insert %d\\n", i);\n            goto end;\n        }\n    if (lh_int_num_items(h) != n_int_tests) {\n            fprintf(stderr, "test lhash int num items\\n");\n            goto end;\n    }\n    for (i = 0; i < n_int_tests; i++)\n        if (*lh_int_retrieve(h, int_tests + i) != int_tests[i]) {\n            fprintf(stderr, "test lhash int retrieve value %d\\n", i);\n            goto end;\n        }\n    for (i = 0; i < n_int_tests; i++)\n        if (lh_int_retrieve(h, int_tests + i) != int_tests + i) {\n            fprintf(stderr, "test lhash int retrieve address %d\\n", i);\n            goto end;\n        }\n    j = 1;\n    if (lh_int_retrieve(h, &j) != int_tests + 2) {\n        fprintf(stderr, "test lhash int retrieve other\\n");\n        goto end;\n    }\n    j = 13;\n    if ((p = lh_int_insert(h, &j)) == NULL) {\n        fprintf(stderr, "test lhash int replacement insert\\n");\n        goto end;\n    }\n    if (p != int_tests + 1) {\n        fprintf(stderr, "test lhash int replacement pointer\\n");\n        goto end;\n    }\n    if (lh_int_retrieve(h, int_tests + 1) != &j) {\n        fprintf(stderr, "test lhash int replacement variable\\n");\n        goto end;\n    }\n    memset(int_found, 0, sizeof(int_found));\n    lh_int_doall(h, &int_doall);\n    for (i = 0; i < n_int_tests; i++)\n        if (int_found[i] != 1) {\n            fprintf(stderr, "test lhash int doall %d\\n", i);\n            goto end;\n        }\n    memset(int_found, 0, sizeof(int_found));\n    lh_int_doall_short(h, int_doall_arg, int_found);\n    for (i = 0; i < n_int_tests; i++)\n        if (int_found[i] != 1) {\n            fprintf(stderr, "test lhash int doall arg %d\\n", i);\n            goto end;\n        }\n    for (i = 0; i < n_dels; i++) {\n        const int b = lh_int_delete(h, &dels[i].data) == NULL;\n        if ((b ^ dels[i].null) != 0) {\n            fprintf(stderr, "test lhash int delete %d\\n", i);\n            goto end;\n        }\n    }\n    if (lh_int_error(h) != 0) {\n        fprintf(stderr, "test lhash int error\\n");\n        goto end;\n    }\n    testresult = 1;\nend:\n    lh_int_free(h);\n    return testresult;\n}', 'DEFINE_LHASH_OF(int)', 'OPENSSL_LHASH *OPENSSL_LH_new(OPENSSL_LH_HASHFUNC h, OPENSSL_LH_COMPFUNC c)\n{\n    OPENSSL_LHASH *ret;\n    if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL)\n        goto err0;\n    if ((ret->b = OPENSSL_zalloc(sizeof(*ret->b) * MIN_NODES)) == NULL)\n        goto err1;\n    ret->comp = ((c == NULL) ? (OPENSSL_LH_COMPFUNC)strcmp : c);\n    ret->hash = ((h == NULL) ? (OPENSSL_LH_HASHFUNC)OPENSSL_LH_strhash : h);\n    ret->num_nodes = MIN_NODES / 2;\n    ret->num_alloc_nodes = MIN_NODES;\n    ret->pmax = MIN_NODES / 2;\n    ret->up_load = UP_LOAD;\n    ret->down_load = DOWN_LOAD;\n    return (ret);\n err1:\n    OPENSSL_free(ret);\n err0:\n    return (NULL);\n}', 'void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data)\n{\n    unsigned long hash;\n    OPENSSL_LH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    if ((lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)) && !expand(lh))\n        return NULL;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        if ((nn = OPENSSL_malloc(sizeof(*nn))) == NULL) {\n            lh->error++;\n            return (NULL);\n        }\n        nn->data = data;\n        nn->next = NULL;\n        nn->hash = hash;\n        *rn = nn;\n        ret = NULL;\n        lh->num_insert++;\n        lh->num_items++;\n    } else {\n        ret = (*rn)->data;\n        (*rn)->data = data;\n        lh->num_replace++;\n    }\n    return (ret);\n}', 'static int expand(OPENSSL_LHASH *lh)\n{\n    OPENSSL_LH_NODE **n, **n1, **n2, *np;\n    unsigned int p, i, j;\n    unsigned long hash, nni;\n    lh->num_nodes++;\n    lh->num_expands++;\n    p = (int)lh->p++;\n    n1 = &(lh->b[p]);\n    n2 = &(lh->b[p + (int)lh->pmax]);\n    *n2 = NULL;\n    nni = lh->num_alloc_nodes;\n    for (np = *n1; np != NULL;) {\n        hash = np->hash;\n        if ((hash % nni) != p) {\n            *n1 = (*n1)->next;\n            np->next = *n2;\n            *n2 = np;\n        } else\n            n1 = &((*n1)->next);\n        np = *n1;\n    }\n    if ((lh->p) >= lh->pmax) {\n        j = (int)lh->num_alloc_nodes * 2;\n        n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));\n        if (n == NULL) {\n            lh->error++;\n            lh->num_nodes--;\n            lh->p = 0;\n            return 0;\n        }\n        for (i = (int)lh->num_alloc_nodes; i < j; i++)\n            n[i] = NULL;\n        lh->pmax = lh->num_alloc_nodes;\n        lh->num_alloc_nodes = j;\n        lh->num_expand_reallocs++;\n        lh->p = 0;\n        lh->b = n;\n    }\n    return 1;\n}', 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)\n        return realloc_impl(str, num, file, line);\n    FAILTEST();\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str, file, line);\n        return NULL;\n    }\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    osslargused(file); osslargused(line);\n#endif\n    return realloc(str, num);\n}']