crypto/conf/conf_def.c:527: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [0, 65536]):unsigned64 by call to `BUF_MEM_grow_clean`.
Showing all 8 steps of the trace


crypto/conf/conf_def.c:407:1: Parameter `*from`
405.   }
406.   
407. > static int str_copy(CONF *conf, char *section, char **pto, char *from)
408.   {
409.       int q, r, rr = 0, to = 0, len = 0;

crypto/conf/conf_def.c:522:13: Assignment
520.                   goto err;
521.               }
522.               newsize = strlen(p) + buf->length - (e - from);
                   ^
523.               if (newsize > MAX_CONF_VALUE_LENGTH) {
524.                   CONFerr(CONF_F_STR_COPY, CONF_R_VARIABLE_EXPANSION_TOO_LONG);

crypto/conf/conf_def.c:527:18: Call
525.                   goto err;
526.               }
527.               if (!BUF_MEM_grow_clean(buf, newsize)) {
                        ^
528.                   CONFerr(CONF_F_STR_COPY, ERR_R_MALLOC_FAILURE);
529.                   goto err;

crypto/buffer/buffer.c:109:1: <LHS trace>
107.   }
108.   
109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
110.   {
111.       char *ret;

crypto/buffer/buffer.c:109:1: Parameter `len`
  107.   }
  108.   
  109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
  110.   {
  111.       char *ret;

crypto/buffer/buffer.c:109:1: <RHS trace>
107.   }
108.   
109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
110.   {
111.       char *ret;

crypto/buffer/buffer.c:109:1: Parameter `len`
  107.   }
  108.   
  109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
  110.   {
  111.       char *ret;

crypto/buffer/buffer.c:116:13: Binary operation: ([0, +oo] - [0, 65536]):unsigned64 by call to `BUF_MEM_grow_clean` 
  114.       if (str->length >= len) {
  115.           if (str->data != NULL)
  116.               memset(&str->data[len], 0, str->length - len);
                     ^
  117.           str->length = len;
  118.           return (len);

size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
{
    char *ret;
    size_t n;
    if (str->length >= len) {
        if (str->data != NULL)
            memset(&str->data[len], 0, str->length - len);
        str->length = len;
        return (len);
    }
    if (str->max >= len) {
        memset(&str->data[str->length], 0, len - str->length);
        str->length = len;
        return (len);
    }
    if (len > LIMIT_BEFORE_EXPANSION) {
        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);
        return 0;
    }
    n = (len + 3) / 3 * 4;
    if ((str->flags & BUF_MEM_FLAG_SECURE))
        ret = sec_alloc_realloc(str, n);
    else
        ret = OPENSSL_clear_realloc(str->data, str->max, n);
    if (ret == NULL) {
        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);
        len = 0;
    } else {
        str->data = ret;
        str->max = n;
        memset(&str->data[str->length], 0, len - str->length);
        str->length = len;
    }
    return (len);
}
["static int str_copy(CONF *conf, char *section, char **pto, char *from)\n{\n    int q, r, rr = 0, to = 0, len = 0;\n    char *s, *e, *rp, *p, *rrp, *np, *cp, v;\n    BUF_MEM *buf;\n    if ((buf = BUF_MEM_new()) == NULL)\n        return (0);\n    len = strlen(from) + 1;\n    if (!BUF_MEM_grow(buf, len))\n        goto err;\n    for (;;) {\n        if (IS_QUOTE(conf, *from)) {\n            q = *from;\n            from++;\n            while (!IS_EOF(conf, *from) && (*from != q)) {\n                if (IS_ESC(conf, *from)) {\n                    from++;\n                    if (IS_EOF(conf, *from))\n                        break;\n                }\n                buf->data[to++] = *(from++);\n            }\n            if (*from == q)\n                from++;\n        } else if (IS_DQUOTE(conf, *from)) {\n            q = *from;\n            from++;\n            while (!IS_EOF(conf, *from)) {\n                if (*from == q) {\n                    if (*(from + 1) == q) {\n                        from++;\n                    } else {\n                        break;\n                    }\n                }\n                buf->data[to++] = *(from++);\n            }\n            if (*from == q)\n                from++;\n        } else if (IS_ESC(conf, *from)) {\n            from++;\n            v = *(from++);\n            if (IS_EOF(conf, v))\n                break;\n            else if (v == 'r')\n                v = '\\r';\n            else if (v == 'n')\n                v = '\\n';\n            else if (v == 'b')\n                v = '\\b';\n            else if (v == 't')\n                v = '\\t';\n            buf->data[to++] = v;\n        } else if (IS_EOF(conf, *from))\n            break;\n        else if (*from == '$') {\n            size_t newsize;\n            rrp = NULL;\n            s = &(from[1]);\n            if (*s == '{')\n                q = '}';\n            else if (*s == '(')\n                q = ')';\n            else\n                q = 0;\n            if (q)\n                s++;\n            cp = section;\n            e = np = s;\n            while (IS_ALPHA_NUMERIC(conf, *e))\n                e++;\n            if ((e[0] == ':') && (e[1] == ':')) {\n                cp = np;\n                rrp = e;\n                rr = *e;\n                *rrp = '\\0';\n                e += 2;\n                np = e;\n                while (IS_ALPHA_NUMERIC(conf, *e))\n                    e++;\n            }\n            r = *e;\n            *e = '\\0';\n            rp = e;\n            if (q) {\n                if (r != q) {\n                    CONFerr(CONF_F_STR_COPY, CONF_R_NO_CLOSE_BRACE);\n                    goto err;\n                }\n                e++;\n            }\n            p = _CONF_get_string(conf, cp, np);\n            if (rrp != NULL)\n                *rrp = rr;\n            *rp = r;\n            if (p == NULL) {\n                CONFerr(CONF_F_STR_COPY, CONF_R_VARIABLE_HAS_NO_VALUE);\n                goto err;\n            }\n            newsize = strlen(p) + buf->length - (e - from);\n            if (newsize > MAX_CONF_VALUE_LENGTH) {\n                CONFerr(CONF_F_STR_COPY, CONF_R_VARIABLE_EXPANSION_TOO_LONG);\n                goto err;\n            }\n            if (!BUF_MEM_grow_clean(buf, newsize)) {\n                CONFerr(CONF_F_STR_COPY, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            while (*p)\n                buf->data[to++] = *(p++);\n            len -= e - from;\n            from = e;\n            *rp = r;\n        } else\n            buf->data[to++] = *(from++);\n    }\n    buf->data[to] = '\\0';\n    OPENSSL_free(*pto);\n    *pto = buf->data;\n    OPENSSL_free(buf);\n    return (1);\n err:\n    BUF_MEM_free(buf);\n    return (0);\n}", 'size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)\n{\n    char *ret;\n    size_t n;\n    if (str->length >= len) {\n        if (str->data != NULL)\n            memset(&str->data[len], 0, str->length - len);\n        str->length = len;\n        return (len);\n    }\n    if (str->max >= len) {\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n        return (len);\n    }\n    if (len > LIMIT_BEFORE_EXPANSION) {\n        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    n = (len + 3) / 3 * 4;\n    if ((str->flags & BUF_MEM_FLAG_SECURE))\n        ret = sec_alloc_realloc(str, n);\n    else\n        ret = OPENSSL_clear_realloc(str->data, str->max, n);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);\n        len = 0;\n    } else {\n        str->data = ret;\n        str->max = n;\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n    }\n    return (len);\n}']