test/packettest.c:296: error: BUFFER_OVERRUN_L2
  Offset added: [0, 2147483646] Size: 640 by call to `PACKET_strndup`.
Showing all 14 steps of the trace


test/packettest.c:285:1: Array declaration
283.   }
284.   
285. > static int test_PACKET_strndup()
286.   {
287.       char buf[10], buf2[10];

test/packettest.c:295:17: Call
293.       buf2[5] = '\0';
294.   
295.       if (       !PACKET_buf_init(&pkt, (unsigned char*)buf, 10)
                       ^
296.               || !PACKET_strndup(&pkt, &data)
297.               ||  strlen(data) != 10

ssl/packet_locl.h:109:1: Parameter `*pkt->curr`
  107.    * is being used.
  108.    */
  109. > static inline int PACKET_buf_init(PACKET *pkt, unsigned char *buf, size_t len)
  110.   {
  111.       /* Sanity check for negative values. */

test/packettest.c:296:17: Call
294.   
295.       if (       !PACKET_buf_init(&pkt, (unsigned char*)buf, 10)
296.               || !PACKET_strndup(&pkt, &data)
                       ^
297.               ||  strlen(data) != 10
298.               ||  strncmp(data, buf, 10)

ssl/packet_locl.h:418:8: Parameter `*pkt->curr`
  416.    * with a given PACKET).
  417.    */
  418.   __owur static inline int PACKET_strndup(const PACKET *pkt, char **data)
                ^
  419.   {
  420.       OPENSSL_free(*data);

ssl/packet_locl.h:423:13: Call
  421.   
  422.       /* This will succeed on an empty packet, unless pkt->curr == NULL. */
  423.       *data = BUF_strndup((const char*)pkt->curr, PACKET_remaining(pkt));
                     ^
  424.       return (*data != NULL);
  425.   }

crypto/buffer/buf_str.c:87:11: <Offset trace>
85.           return NULL;
86.   
87.       siz = BUF_strnlen(str, siz);
                ^
88.   
89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:87:11: Call
    85.           return NULL;
    86.   
    87.       siz = BUF_strnlen(str, siz);
                    ^
    88.   
    89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:64:1: Parameter `*str`
      62.   #include <openssl/buffer.h>
      63.   
      64. > size_t BUF_strnlen(const char *str, size_t maxlen)
      65.   {
      66.       const char *p;

crypto/buffer/buf_str.c:70:5: Assignment
      68.       for (p = str; maxlen-- != 0 && *p != '\0'; ++p) ;
      69.   
      70.       return p - str;
                ^
      71.   }
      72.   

crypto/buffer/buf_str.c:87:5: Assignment
    85.           return NULL;
    86.   
    87.       siz = BUF_strnlen(str, siz);
              ^
    88.   
    89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:80:1: <Length trace>
78.   }
79.   
80. > char *BUF_strndup(const char *str, size_t siz)
81.   {
82.       char *ret;

crypto/buffer/buf_str.c:80:1: Parameter `*str`
    78.   }
    79.   
    80. > char *BUF_strndup(const char *str, size_t siz)
    81.   {
    82.       char *ret;

crypto/buffer/buf_str.c:98:5: Array access: Offset added: [0, 2147483646] Size: 640 by call to `PACKET_strndup` 
    96.       }
    97.   
    98.       memcpy(ret, str, siz);
               ^
    99.       ret[siz] = '\0';
    100.   

char *BUF_strndup(const char *str, size_t siz)
{
    char *ret;
    if (str == NULL)
        return NULL;
    siz = BUF_strnlen(str, siz);
    if (siz >= INT_MAX)
        return NULL;
    ret = OPENSSL_malloc(siz + 1);
    if (ret == NULL) {
        BUFerr(BUF_F_BUF_STRNDUP, ERR_R_MALLOC_FAILURE);
        return NULL;
    }
    memcpy(ret, str, siz);
    ret[siz] = '\0';
    return (ret);
}
['static int test_PACKET_strndup()\n{\n    char buf[10], buf2[10];\n    char *data = NULL;\n    PACKET pkt;\n    memset(buf, \'x\', 10);\n    memset(buf2, \'y\', 10);\n    buf2[5] = \'\\0\';\n    if (       !PACKET_buf_init(&pkt, (unsigned char*)buf, 10)\n            || !PACKET_strndup(&pkt, &data)\n            ||  strlen(data) != 10\n            ||  strncmp(data, buf, 10)\n            || !PACKET_buf_init(&pkt, (unsigned char*)buf2, 10)\n            || !PACKET_strndup(&pkt, &data)\n            ||  strlen(data) != 5\n            ||  strcmp(data, buf2)) {\n        fprintf(stderr, "test_PACKET_strndup failed\\n");\n        OPENSSL_free(data);\n        return 0;\n    }\n    OPENSSL_free(data);\n    return 1;\n}', "char *BUF_strndup(const char *str, size_t siz)\n{\n    char *ret;\n    if (str == NULL)\n        return NULL;\n    siz = BUF_strnlen(str, siz);\n    if (siz >= INT_MAX)\n        return NULL;\n    ret = OPENSSL_malloc(siz + 1);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_STRNDUP, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    memcpy(ret, str, siz);\n    ret[siz] = '\\0';\n    return (ret);\n}", "size_t BUF_strnlen(const char *str, size_t maxlen)\n{\n    const char *p;\n    for (p = str; maxlen-- != 0 && *p != '\\0'; ++p) ;\n    return p - str;\n}"]