crypto/core_namemap.c:21: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `OPENSSL_LH_delete`.
Showing all 10 steps of the trace


crypto/core_namemap.c:21:1: Parameter `lh->pmax`
19.   } NAMEMAP_ENTRY;
20.   
21. > DEFINE_LHASH_OF(NAMEMAP_ENTRY);
22.   DEFINE_STACK_OF(NAMEMAP_ENTRY)
23.   

crypto/core_namemap.c:21:1: Call
19.   } NAMEMAP_ENTRY;
20.   
21. > DEFINE_LHASH_OF(NAMEMAP_ENTRY);
22.   DEFINE_STACK_OF(NAMEMAP_ENTRY)
23.   

crypto/lhash/lhash.c:137:1: Parameter `lh->pmax`
  135.   }
  136.   
  137. > void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
  138.   {
  139.       unsigned long hash;

crypto/lhash/lhash.c:160:9: Call
  158.       if ((lh->num_nodes > MIN_NODES) &&
  159.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
  160.           contract(lh);
                 ^
  161.   
  162.       return ret;

crypto/lhash/lhash.c:269:1: <Offset trace>
267.   }
268.   
269. > static void contract(OPENSSL_LHASH *lh)
270.   {
271.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:269:1: Parameter `lh->p`
    267.   }
    268.   
    269. > static void contract(OPENSSL_LHASH *lh)
    270.   {
    271.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:289:9: Assignment
    287.           lh->b = n;
    288.       } else
    289.           lh->p--;
                   ^
    290.   
    291.       lh->num_nodes--;

crypto/lhash/lhash.c:269:1: <Length trace>
267.   }
268.   
269. > static void contract(OPENSSL_LHASH *lh)
270.   {
271.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:269:1: Parameter `*lh->b`
    267.   }
    268.   
    269. > static void contract(OPENSSL_LHASH *lh)
    270.   {
    271.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:294:10: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `OPENSSL_LH_delete` 
    292.       lh->num_contracts++;
    293.   
    294.       n1 = lh->b[(int)lh->p];
                    ^
    295.       if (n1 == NULL)
    296.           lh->b[(int)lh->p] = np;

static void contract(OPENSSL_LHASH *lh)
{
    OPENSSL_LH_NODE **n, *n1, *np;
    np = lh->b[lh->p + lh->pmax - 1];
    lh->b[lh->p + lh->pmax - 1] = NULL;
    if (lh->p == 0) {
        n = OPENSSL_realloc(lh->b,
                            (unsigned int)(sizeof(OPENSSL_LH_NODE *) * lh->pmax));
        if (n == NULL) {
            lh->error++;
            return;
        }
        lh->num_contract_reallocs++;
        lh->num_alloc_nodes /= 2;
        lh->pmax /= 2;
        lh->p = lh->pmax - 1;
        lh->b = n;
    } else
        lh->p--;
    lh->num_nodes--;
    lh->num_contracts++;
    n1 = lh->b[(int)lh->p];
    if (n1 == NULL)
        lh->b[(int)lh->p] = np;
    else {
        while (n1->next != NULL)
            n1 = n1->next;
        n1->next = np;
    }
}
['DEFINE_LHASH_OF(NAMEMAP_ENTRY)', 'void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    OPENSSL_LH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        lh->num_no_delete++;\n        return NULL;\n    } else {\n        nn = *rn;\n        *rn = nn->next;\n        ret = nn->data;\n        OPENSSL_free(nn);\n        lh->num_delete++;\n    }\n    lh->num_items--;\n    if ((lh->num_nodes > MIN_NODES) &&\n        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))\n        contract(lh);\n    return ret;\n}', 'static void contract(OPENSSL_LHASH *lh)\n{\n    OPENSSL_LH_NODE **n, *n1, *np;\n    np = lh->b[lh->p + lh->pmax - 1];\n    lh->b[lh->p + lh->pmax - 1] = NULL;\n    if (lh->p == 0) {\n        n = OPENSSL_realloc(lh->b,\n                            (unsigned int)(sizeof(OPENSSL_LH_NODE *) * lh->pmax));\n        if (n == NULL) {\n            lh->error++;\n            return;\n        }\n        lh->num_contract_reallocs++;\n        lh->num_alloc_nodes /= 2;\n        lh->pmax /= 2;\n        lh->p = lh->pmax - 1;\n        lh->b = n;\n    } else\n        lh->p--;\n    lh->num_nodes--;\n    lh->num_contracts++;\n    n1 = lh->b[(int)lh->p];\n    if (n1 == NULL)\n        lh->b[(int)lh->p] = np;\n    else {\n        while (n1->next != NULL)\n            n1 = n1->next;\n        n1->next = np;\n    }\n}']