apps/s_server.c:1535: error: BUFFER_OVERRUN_L3
  Offset: [1, 65535] Size: [1, +oo] by call to `next_protos_parse`.
Showing all 18 steps of the trace


apps/s_server.c:1510:18: Call
1508.           }
1509.           if (s_chain_file) {
1510.               if (!load_certs(s_chain_file, &s_chain, FORMAT_PEM, NULL, e,
                         ^
1511.                               "server certificate chain"))
1512.                   goto end;

apps/apps.c:995:12: Call
  993.                  const char *pass, ENGINE *e, const char *desc)
  994.   {
  995.       return load_certs_crls(file, format, pass, e, desc, certs, NULL);
                    ^
  996.   }
  997.   

apps/apps.c:918:11: Call
    916.           return 0;
    917.   
    918.       xis = PEM_X509_INFO_read_bio(bio, NULL,
                     ^
    919.                                    (pem_password_cb *)password_callback,
    920.                                    &cb_data);

crypto/pem/pem_info.c:118:13: Call
      116.           raw = 0;
      117.           ptype = 0;
      118.           i = PEM_read_bio(bp, &name, &header, &data, &len);
                         ^
      119.           if (i == 0) {
      120.               error = ERR_GET_REASON(ERR_peek_last_error());

crypto/pem/pem_lib.c:723:13: Assignment
        721.               }
        722.               memcpy(nameB->data, &(buf[11]), i - 6);
        723.               nameB->data[i - 6] = '\0';
                           ^
        724.               break;
        725.           }

apps/s_server.c:1535:27: Call
1533.       if (next_proto_neg_in) {
1534.           unsigned short len;
1535.           next_proto.data = next_protos_parse(&len, next_proto_neg_in);
                                  ^
1536.           if (next_proto.data == NULL)
1537.               goto end;

apps/apps.c:2217:10: <Offset trace>
2215.   
2216.       out = app_malloc(strlen(in) + 1, "NPN buffer");
2217.       for (i = 0; i <= len; ++i) {
                 ^
2218.           if (i == len || in[i] == ',') {
2219.               if (i - start > 255) {

apps/apps.c:2217:10: Assignment
  2215.   
  2216.       out = app_malloc(strlen(in) + 1, "NPN buffer");
  2217.       for (i = 0; i <= len; ++i) {
                   ^
  2218.           if (i == len || in[i] == ',') {
  2219.               if (i - start > 255) {

apps/apps.c:2206:1: <Length trace>
2204.    *   returns: a malloced buffer or NULL on failure.
2205.    */
2206. > unsigned char *next_protos_parse(unsigned short *outlen, const char *in)
2207.   {
2208.       size_t len;

apps/apps.c:2206:1: Parameter `in->strlen`
  2204.    *   returns: a malloced buffer or NULL on failure.
  2205.    */
  2206. > unsigned char *next_protos_parse(unsigned short *outlen, const char *in)
  2207.   {
  2208.       size_t len;

apps/apps.c:2216:11: Call
  2214.           return NULL;
  2215.   
  2216.       out = app_malloc(strlen(in) + 1, "NPN buffer");
                    ^
  2217.       for (i = 0; i <= len; ++i) {
  2218.           if (i == len || in[i] == ',') {

apps/apps.c:976:1: Parameter `sz`
    974.   }
    975.   
    976. > void* app_malloc(int sz, const char *what)
    977.   {
    978.       void *vp = OPENSSL_malloc(sz);

apps/apps.c:978:16: Call
    976.   void* app_malloc(int sz, const char *what)
    977.   {
    978.       void *vp = OPENSSL_malloc(sz);
                          ^
    979.   
    980.       if (vp == NULL) {

crypto/mem.c:125:9: Assignment
      123.   
      124.       if (num <= 0)
      125.           return NULL;
                     ^
      126.   
      127.       allow_customize = 0;

apps/apps.c:978:5: Assignment
    976.   void* app_malloc(int sz, const char *what)
    977.   {
    978.       void *vp = OPENSSL_malloc(sz);
               ^
    979.   
    980.       if (vp == NULL) {

apps/apps.c:986:5: Assignment
    984.           exit(1);
    985.       }
    986.       return vp;
               ^
    987.   }
    988.   

apps/apps.c:2216:5: Assignment
  2214.           return NULL;
  2215.   
  2216.       out = app_malloc(strlen(in) + 1, "NPN buffer");
              ^
  2217.       for (i = 0; i <= len; ++i) {
  2218.           if (i == len || in[i] == ',') {

apps/apps.c:2226:13: Array access: Offset: [1, 65535] Size: [1, +oo] by call to `next_protos_parse` 
  2224.               start = i + 1;
  2225.           } else
  2226.               out[i + 1] = in[i];
                      ^
  2227.       }
  2228.   

unsigned char *next_protos_parse(unsigned short *outlen, const char *in)
{
    size_t len;
    unsigned char *out;
    size_t i, start = 0;
    len = strlen(in);
    if (len >= 65535)
        return NULL;
    out = app_malloc(strlen(in) + 1, "NPN buffer");
    for (i = 0; i <= len; ++i) {
        if (i == len || in[i] == ',') {
            if (i - start > 255) {
                OPENSSL_free(out);
                return NULL;
            }
            out[start] = i - start;
            start = i + 1;
        } else
            out[i + 1] = in[i];
    }
    *outlen = len + 1;
    return out;
}
['int s_server_main(int argc, char *argv[])\n{\n    ENGINE *e = NULL;\n    EVP_PKEY *s_key = NULL, *s_dkey = NULL;\n    SSL_CONF_CTX *cctx = NULL;\n    const SSL_METHOD *meth = TLS_server_method();\n    SSL_EXCERT *exc = NULL;\n    STACK_OF(OPENSSL_STRING) *ssl_args = NULL;\n    STACK_OF(X509) *s_chain = NULL, *s_dchain = NULL;\n    STACK_OF(X509_CRL) *crls = NULL;\n    X509 *s_cert = NULL, *s_dcert = NULL;\n    X509_VERIFY_PARAM *vpm = NULL;\n    char *CApath = NULL, *CAfile = NULL, *chCApath = NULL, *chCAfile = NULL;\n#ifndef OPENSSL_NO_DH\n    char *dhfile = NULL;\n#endif\n    char *dpassarg = NULL, *dpass = NULL, *inrand = NULL;\n    char *passarg = NULL, *pass = NULL, *vfyCApath = NULL, *vfyCAfile = NULL;\n    char *crl_file = NULL, *prog;\n#ifndef OPENSSL_NO_PSK\n    char *p;\n#endif\n    const char *unix_path = NULL;\n#ifndef NO_SYS_UN_H\n    int unlink_unix_path = 0;\n#endif\n    int (*server_cb) (char *hostname, int s, int stype,\n                      unsigned char *context);\n    int vpmtouched = 0, build_chain = 0, no_cache = 0, ext_cache = 0;\n#ifndef OPENSSL_NO_DH\n    int no_dhe = 0;\n#endif\n    int nocert = 0, ret = 1;\n    int noCApath = 0, noCAfile = 0;\n    int s_cert_format = FORMAT_PEM, s_key_format = FORMAT_PEM;\n    int s_dcert_format = FORMAT_PEM, s_dkey_format = FORMAT_PEM;\n    int rev = 0, naccept = -1, sdebug = 0, socket_type = SOCK_STREAM;\n    int state = 0, crl_format = FORMAT_PEM, crl_download = 0;\n    unsigned short port = PORT;\n    unsigned char *context = NULL;\n    OPTION_CHOICE o;\n    EVP_PKEY *s_key2 = NULL;\n    X509 *s_cert2 = NULL;\n    tlsextctx tlsextcbp = { NULL, NULL, SSL_TLSEXT_ERR_ALERT_WARNING };\n    const char *ssl_config = NULL;\n#ifndef OPENSSL_NO_NEXTPROTONEG\n    const char *next_proto_neg_in = NULL;\n    tlsextnextprotoctx next_proto = { NULL, 0 };\n#endif\n    const char *alpn_in = NULL;\n    tlsextalpnctx alpn_ctx = { NULL, 0 };\n#ifndef OPENSSL_NO_PSK\n    static char *psk_identity_hint = NULL;\n#endif\n#ifndef OPENSSL_NO_SRP\n    char *srpuserseed = NULL;\n    char *srp_verifier_file = NULL;\n#endif\n    local_argc = argc;\n    local_argv = argv;\n    s_server_init();\n    cctx = SSL_CONF_CTX_new();\n    vpm = X509_VERIFY_PARAM_new();\n    if (cctx == NULL || vpm == NULL)\n        goto end;\n    SSL_CONF_CTX_set_flags(cctx, SSL_CONF_FLAG_SERVER | SSL_CONF_FLAG_CMDLINE);\n    prog = opt_init(argc, argv, s_server_options);\n    while ((o = opt_next()) != OPT_EOF) {\n        switch (o) {\n        case OPT_EOF:\n        case OPT_ERR:\n opthelp:\n            BIO_printf(bio_err, "%s: Use -help for summary.\\n", prog);\n            goto end;\n        case OPT_HELP:\n            opt_help(s_server_options);\n            ret = 0;\n            goto end;\n        case OPT_PORT:\n            if (!extract_port(opt_arg(), &port))\n                goto end;\n            break;\n        case OPT_UNIX:\n#ifdef NO_SYS_UN_H\n            BIO_printf(bio_err, "unix domain sockets unsupported\\n");\n            goto end;\n#else\n            unix_path = opt_arg();\n#endif\n            break;\n        case OPT_UNLINK:\n#ifdef NO_SYS_UN_H\n            BIO_printf(bio_err, "unix domain sockets unsupported\\n");\n            goto end;\n#else\n            unlink_unix_path = 1;\n#endif\n            break;\n        case OPT_NACCEPT:\n            naccept = atol(opt_arg());\n            break;\n        case OPT_VERIFY:\n            s_server_verify = SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE;\n            verify_depth = atoi(opt_arg());\n            if (!s_quiet)\n                BIO_printf(bio_err, "verify depth is %d\\n", verify_depth);\n            break;\n        case OPT_UPPER_V_VERIFY:\n            s_server_verify =\n                SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT |\n                SSL_VERIFY_CLIENT_ONCE;\n            verify_depth = atoi(opt_arg());\n            if (!s_quiet)\n                BIO_printf(bio_err,\n                           "verify depth is %d, must return a certificate\\n",\n                           verify_depth);\n            break;\n        case OPT_CONTEXT:\n            context = (unsigned char *)opt_arg();\n            break;\n        case OPT_CERT:\n            s_cert_file = opt_arg();\n            break;\n        case OPT_CRL:\n            crl_file = opt_arg();\n            break;\n        case OPT_CRL_DOWNLOAD:\n            crl_download = 1;\n            break;\n        case OPT_SERVERINFO:\n            s_serverinfo_file = opt_arg();\n            break;\n        case OPT_CERTFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &s_cert_format))\n                goto opthelp;\n            break;\n        case OPT_KEY:\n            s_key_file = opt_arg();\n            break;\n        case OPT_KEYFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_ANY, &s_key_format))\n                goto opthelp;\n            break;\n        case OPT_PASS:\n            passarg = opt_arg();\n            break;\n        case OPT_CERT_CHAIN:\n            s_chain_file = opt_arg();\n            break;\n        case OPT_DHPARAM:\n#ifndef OPENSSL_NO_DH\n            dhfile = opt_arg();\n#endif\n            break;\n        case OPT_DCERTFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &s_dcert_format))\n                goto opthelp;\n            break;\n        case OPT_DCERT:\n            s_dcert_file = opt_arg();\n            break;\n        case OPT_DKEYFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &s_dkey_format))\n                goto opthelp;\n            break;\n        case OPT_DPASS:\n            dpassarg = opt_arg();\n            break;\n        case OPT_DKEY:\n            s_dkey_file = opt_arg();\n            break;\n        case OPT_DCERT_CHAIN:\n            s_dchain_file = opt_arg();\n            break;\n        case OPT_NOCERT:\n            nocert = 1;\n            break;\n        case OPT_CAPATH:\n            CApath = opt_arg();\n            break;\n        case OPT_NOCAPATH:\n            noCApath = 1;\n            break;\n        case OPT_CHAINCAPATH:\n            chCApath = opt_arg();\n            break;\n        case OPT_VERIFYCAPATH:\n            vfyCApath = opt_arg();\n            break;\n        case OPT_NO_CACHE:\n            no_cache = 1;\n            break;\n        case OPT_EXT_CACHE:\n            ext_cache = 1;\n            break;\n        case OPT_CRLFORM:\n            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &crl_format))\n                goto opthelp;\n            break;\n        case OPT_S_CASES:\n            if (ssl_args == NULL)\n                ssl_args = sk_OPENSSL_STRING_new_null();\n            if (ssl_args == NULL\n                || !sk_OPENSSL_STRING_push(ssl_args, opt_flag())\n                || !sk_OPENSSL_STRING_push(ssl_args, opt_arg())) {\n                BIO_printf(bio_err, "%s: Memory allocation failure\\n", prog);\n                goto end;\n            }\n            break;\n        case OPT_V_CASES:\n            if (!opt_verify(o, vpm))\n                goto end;\n            vpmtouched++;\n            break;\n        case OPT_X_CASES:\n            if (!args_excert(o, &exc))\n                goto end;\n            break;\n        case OPT_VERIFY_RET_ERROR:\n            verify_return_error = 1;\n            break;\n        case OPT_VERIFY_QUIET:\n            verify_quiet = 1;\n            break;\n        case OPT_BUILD_CHAIN:\n            build_chain = 1;\n            break;\n        case OPT_CAFILE:\n            CAfile = opt_arg();\n            break;\n        case OPT_NOCAFILE:\n            noCAfile = 1;\n            break;\n        case OPT_CHAINCAFILE:\n            chCAfile = opt_arg();\n            break;\n        case OPT_VERIFYCAFILE:\n            vfyCAfile = opt_arg();\n            break;\n        case OPT_NBIO:\n            s_nbio = 1;\n            break;\n        case OPT_NBIO_TEST:\n            s_nbio = s_nbio_test = 1;\n            break;\n        case OPT_IGN_EOF:\n            s_ign_eof = 1;\n            break;\n        case OPT_NO_IGN_EOF:\n            s_ign_eof = 0;\n            break;\n        case OPT_DEBUG:\n            s_debug = 1;\n            break;\n        case OPT_TLSEXTDEBUG:\n            s_tlsextdebug = 1;\n            break;\n        case OPT_STATUS:\n            s_tlsextstatus = 1;\n            break;\n        case OPT_STATUS_VERBOSE:\n            s_tlsextstatus = tlscstatp.verbose = 1;\n            break;\n        case OPT_STATUS_TIMEOUT:\n            s_tlsextstatus = 1;\n            tlscstatp.timeout = atoi(opt_arg());\n            break;\n        case OPT_STATUS_URL:\n            s_tlsextstatus = 1;\n            if (!OCSP_parse_url(opt_arg(),\n                                &tlscstatp.host,\n                                &tlscstatp.port,\n                                &tlscstatp.path, &tlscstatp.use_ssl)) {\n                BIO_printf(bio_err, "Error parsing URL\\n");\n                goto end;\n            }\n            break;\n        case OPT_MSG:\n            s_msg = 1;\n            break;\n        case OPT_MSGFILE:\n            bio_s_msg = BIO_new_file(opt_arg(), "w");\n            break;\n        case OPT_TRACE:\n#ifndef OPENSSL_NO_SSL_TRACE\n            s_msg = 2;\n#else\n            break;\n#endif\n        case OPT_SECURITY_DEBUG:\n            sdebug = 1;\n            break;\n        case OPT_SECURITY_DEBUG_VERBOSE:\n            sdebug = 2;\n            break;\n        case OPT_STATE:\n            state = 1;\n            break;\n        case OPT_CRLF:\n            s_crlf = 1;\n            break;\n        case OPT_QUIET:\n            s_quiet = 1;\n            break;\n        case OPT_BRIEF:\n            s_quiet = s_brief = verify_quiet = 1;\n            break;\n        case OPT_NO_DHE:\n#ifndef OPENSSL_NO_DH\n            no_dhe = 1;\n#endif\n            break;\n        case OPT_NO_RESUME_EPHEMERAL:\n            no_resume_ephemeral = 1;\n            break;\n        case OPT_PSK_HINT:\n#ifndef OPENSSL_NO_PSK\n            psk_identity_hint = opt_arg();\n#endif\n            break;\n        case OPT_PSK:\n#ifndef OPENSSL_NO_PSK\n            for (p = psk_key = opt_arg(); *p; p++) {\n                if (isxdigit(*p))\n                    continue;\n                BIO_printf(bio_err, "Not a hex number \'%s\'\\n", *argv);\n                goto end;\n            }\n#endif\n            break;\n        case OPT_SRPVFILE:\n#ifndef OPENSSL_NO_SRP\n            srp_verifier_file = opt_arg();\n            meth = TLSv1_server_method();\n#endif\n            break;\n        case OPT_SRPUSERSEED:\n#ifndef OPENSSL_NO_SRP\n            srpuserseed = opt_arg();\n            meth = TLSv1_server_method();\n#endif\n            break;\n        case OPT_REV:\n            rev = 1;\n            break;\n        case OPT_WWW:\n            www = 1;\n            break;\n        case OPT_UPPER_WWW:\n            www = 2;\n            break;\n        case OPT_HTTP:\n            www = 3;\n            break;\n        case OPT_SSL_CONFIG:\n            ssl_config = opt_arg();\n            break;\n        case OPT_SSL3:\n#ifndef OPENSSL_NO_SSL3\n            meth = SSLv3_server_method();\n#endif\n            break;\n        case OPT_TLS1_2:\n#ifndef OPENSSL_NO_TLS1_2\n            meth = TLSv1_2_server_method();\n#endif\n            break;\n        case OPT_TLS1_1:\n#ifndef OPENSSL_NO_TLS1_1\n            meth = TLSv1_1_server_method();\n#endif\n            break;\n        case OPT_TLS1:\n#ifndef OPENSSL_NO_TLS1\n            meth = TLSv1_server_method();\n#endif\n            break;\n        case OPT_DTLS:\n#ifndef OPENSSL_NO_DTLS\n            meth = DTLS_server_method();\n            socket_type = SOCK_DGRAM;\n#endif\n            break;\n        case OPT_DTLS1:\n#ifndef OPENSSL_NO_DTLS1\n            meth = DTLSv1_server_method();\n            socket_type = SOCK_DGRAM;\n#endif\n            break;\n        case OPT_DTLS1_2:\n#ifndef OPENSSL_NO_DTLS1_2\n            meth = DTLSv1_2_server_method();\n            socket_type = SOCK_DGRAM;\n#endif\n            break;\n        case OPT_TIMEOUT:\n#ifndef OPENSSL_NO_DTLS\n            enable_timeouts = 1;\n#endif\n            break;\n        case OPT_MTU:\n#ifndef OPENSSL_NO_DTLS\n            socket_mtu = atol(opt_arg());\n#endif\n            break;\n        case OPT_CHAIN:\n#ifndef OPENSSL_NO_DTLS\n            cert_chain = 1;\n#endif\n            break;\n        case OPT_LISTEN:\n#ifndef OPENSSL_NO_DTLS\n            dtlslisten = 1;\n#endif\n            break;\n        case OPT_ID_PREFIX:\n            session_id_prefix = opt_arg();\n            break;\n        case OPT_ENGINE:\n            e = setup_engine(opt_arg(), 1);\n            break;\n        case OPT_RAND:\n            inrand = opt_arg();\n            break;\n        case OPT_SERVERNAME:\n            tlsextcbp.servername = opt_arg();\n            break;\n        case OPT_SERVERNAME_FATAL:\n            tlsextcbp.extension_error = SSL_TLSEXT_ERR_ALERT_FATAL;\n            break;\n        case OPT_CERT2:\n            s_cert_file2 = opt_arg();\n            break;\n        case OPT_KEY2:\n            s_key_file2 = opt_arg();\n            break;\n        case OPT_NEXTPROTONEG:\n# ifndef OPENSSL_NO_NEXTPROTONEG\n            next_proto_neg_in = opt_arg();\n#endif\n            break;\n        case OPT_ALPN:\n            alpn_in = opt_arg();\n            break;\n#if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)\n        case OPT_JPAKE:\n            jpake_secret = opt_arg();\n            break;\n#else\n        case OPT_JPAKE:\n            goto opthelp;\n#endif\n        case OPT_SRTP_PROFILES:\n            srtp_profiles = opt_arg();\n            break;\n        case OPT_KEYMATEXPORT:\n            keymatexportlabel = opt_arg();\n            break;\n        case OPT_KEYMATEXPORTLEN:\n            keymatexportlen = atoi(opt_arg());\n            break;\n        case OPT_ASYNC:\n            async = 1;\n            break;\n        }\n    }\n    argc = opt_num_rest();\n    argv = opt_rest();\n#ifndef OPENSSL_NO_DTLS\n    if (www && socket_type == SOCK_DGRAM) {\n        BIO_printf(bio_err, "Can\'t use -HTTP, -www or -WWW with DTLS\\n");\n        goto end;\n    }\n    if (dtlslisten && socket_type != SOCK_DGRAM) {\n        BIO_printf(bio_err, "Can only use -listen with DTLS\\n");\n        goto end;\n    }\n#endif\n    if (unix_path && (socket_type != SOCK_STREAM)) {\n        BIO_printf(bio_err,\n                   "Can\'t use unix sockets and datagrams together\\n");\n        goto end;\n    }\n#if !defined(OPENSSL_NO_JPAKE) && !defined(OPENSSL_NO_PSK)\n    if (jpake_secret) {\n        if (psk_key) {\n            BIO_printf(bio_err, "Can\'t use JPAKE and PSK together\\n");\n            goto end;\n        }\n        psk_identity = "JPAKE";\n    }\n#endif\n    if (!app_passwd(passarg, dpassarg, &pass, &dpass)) {\n        BIO_printf(bio_err, "Error getting password\\n");\n        goto end;\n    }\n    if (s_key_file == NULL)\n        s_key_file = s_cert_file;\n    if (s_key_file2 == NULL)\n        s_key_file2 = s_cert_file2;\n    if (!load_excert(&exc))\n        goto end;\n    if (nocert == 0) {\n        s_key = load_key(s_key_file, s_key_format, 0, pass, e,\n                         "server certificate private key file");\n        if (!s_key) {\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        s_cert = load_cert(s_cert_file, s_cert_format,\n                           NULL, e, "server certificate file");\n        if (!s_cert) {\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        if (s_chain_file) {\n            if (!load_certs(s_chain_file, &s_chain, FORMAT_PEM, NULL, e,\n                            "server certificate chain"))\n                goto end;\n        }\n        if (tlsextcbp.servername) {\n            s_key2 = load_key(s_key_file2, s_key_format, 0, pass, e,\n                              "second server certificate private key file");\n            if (!s_key2) {\n                ERR_print_errors(bio_err);\n                goto end;\n            }\n            s_cert2 = load_cert(s_cert_file2, s_cert_format,\n                                NULL, e, "second server certificate file");\n            if (!s_cert2) {\n                ERR_print_errors(bio_err);\n                goto end;\n            }\n        }\n    }\n#if !defined(OPENSSL_NO_NEXTPROTONEG)\n    if (next_proto_neg_in) {\n        unsigned short len;\n        next_proto.data = next_protos_parse(&len, next_proto_neg_in);\n        if (next_proto.data == NULL)\n            goto end;\n        next_proto.len = len;\n    } else {\n        next_proto.data = NULL;\n    }\n#endif\n    alpn_ctx.data = NULL;\n    if (alpn_in) {\n        unsigned short len;\n        alpn_ctx.data = next_protos_parse(&len, alpn_in);\n        if (alpn_ctx.data == NULL)\n            goto end;\n        alpn_ctx.len = len;\n    }\n    if (crl_file) {\n        X509_CRL *crl;\n        crl = load_crl(crl_file, crl_format);\n        if (!crl) {\n            BIO_puts(bio_err, "Error loading CRL\\n");\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        crls = sk_X509_CRL_new_null();\n        if (!crls || !sk_X509_CRL_push(crls, crl)) {\n            BIO_puts(bio_err, "Error adding CRL\\n");\n            ERR_print_errors(bio_err);\n            X509_CRL_free(crl);\n            goto end;\n        }\n    }\n    if (s_dcert_file) {\n        if (s_dkey_file == NULL)\n            s_dkey_file = s_dcert_file;\n        s_dkey = load_key(s_dkey_file, s_dkey_format,\n                          0, dpass, e, "second certificate private key file");\n        if (!s_dkey) {\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        s_dcert = load_cert(s_dcert_file, s_dcert_format,\n                            NULL, e, "second server certificate file");\n        if (!s_dcert) {\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        if (s_dchain_file) {\n            if (!load_certs(s_dchain_file, &s_dchain, FORMAT_PEM, NULL, e,\n                            "second server certificate chain"))\n                goto end;\n        }\n    }\n    if (!app_RAND_load_file(NULL, 1) && inrand == NULL\n        && !RAND_status()) {\n        BIO_printf(bio_err,\n                   "warning, not much extra random data, consider using the -rand option\\n");\n    }\n    if (inrand != NULL)\n        BIO_printf(bio_err, "%ld semi-random bytes loaded\\n",\n                   app_RAND_load_files(inrand));\n    if (bio_s_out == NULL) {\n        if (s_quiet && !s_debug) {\n            bio_s_out = BIO_new(BIO_s_null());\n            if (s_msg && !bio_s_msg)\n                bio_s_msg = dup_bio_out(FORMAT_TEXT);\n        } else {\n            if (bio_s_out == NULL)\n                bio_s_out = dup_bio_out(FORMAT_TEXT);\n        }\n    }\n#if !defined(OPENSSL_NO_RSA) || !defined(OPENSSL_NO_DSA) || !defined(OPENSSL_NO_EC)\n    if (nocert)\n#endif\n    {\n        s_cert_file = NULL;\n        s_key_file = NULL;\n        s_dcert_file = NULL;\n        s_dkey_file = NULL;\n        s_cert_file2 = NULL;\n        s_key_file2 = NULL;\n    }\n    ctx = SSL_CTX_new(meth);\n    if (sdebug)\n        ssl_ctx_security_debug(ctx, sdebug);\n    if (ctx == NULL) {\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n    if (ssl_config) {\n        if (SSL_CTX_config(ctx, ssl_config) == 0) {\n            BIO_printf(bio_err, "Error using configuration \\"%s\\"\\n",\n                       ssl_config);\n        ERR_print_errors(bio_err);\n        goto end;\n        }\n    }\n    if (session_id_prefix) {\n        if (strlen(session_id_prefix) >= 32)\n            BIO_printf(bio_err,\n                       "warning: id_prefix is too long, only one new session will be possible\\n");\n        if (!SSL_CTX_set_generate_session_id(ctx, generate_session_id)) {\n            BIO_printf(bio_err, "error setting \'id_prefix\'\\n");\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        BIO_printf(bio_err, "id_prefix \'%s\' set.\\n", session_id_prefix);\n    }\n    SSL_CTX_set_quiet_shutdown(ctx, 1);\n    if (exc)\n        ssl_ctx_set_excert(ctx, exc);\n    if (state)\n        SSL_CTX_set_info_callback(ctx, apps_ssl_info_callback);\n    if (no_cache)\n        SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);\n    else if (ext_cache)\n        init_session_cache_ctx(ctx);\n    else\n        SSL_CTX_sess_set_cache_size(ctx, 128);\n    if (async) {\n        SSL_CTX_set_mode(ctx, SSL_MODE_ASYNC);\n        ASYNC_init(1, 0, 0);\n    }\n#ifndef OPENSSL_NO_SRTP\n    if (srtp_profiles != NULL) {\n        if (SSL_CTX_set_tlsext_use_srtp(ctx, srtp_profiles) != 0) {\n            BIO_printf(bio_err, "Error setting SRTP profile\\n");\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n    }\n#endif\n    if (!ctx_set_verify_locations(ctx, CAfile, CApath, noCAfile, noCApath)) {\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n    if (vpmtouched && !SSL_CTX_set1_param(ctx, vpm)) {\n        BIO_printf(bio_err, "Error setting verify params\\n");\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n    ssl_ctx_add_crls(ctx, crls, 0);\n    if (!config_ctx(cctx, ssl_args, ctx, jpake_secret == NULL))\n        goto end;\n    if (!ssl_load_stores(ctx, vfyCApath, vfyCAfile, chCApath, chCAfile,\n                         crls, crl_download)) {\n        BIO_printf(bio_err, "Error loading store locations\\n");\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n    if (s_cert2) {\n        ctx2 = SSL_CTX_new(meth);\n        if (ctx2 == NULL) {\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n    }\n    if (ctx2) {\n        BIO_printf(bio_s_out, "Setting secondary ctx parameters\\n");\n        if (sdebug)\n            ssl_ctx_security_debug(ctx, sdebug);\n        if (session_id_prefix) {\n            if (strlen(session_id_prefix) >= 32)\n                BIO_printf(bio_err,\n                           "warning: id_prefix is too long, only one new session will be possible\\n");\n            if (!SSL_CTX_set_generate_session_id(ctx2, generate_session_id)) {\n                BIO_printf(bio_err, "error setting \'id_prefix\'\\n");\n                ERR_print_errors(bio_err);\n                goto end;\n            }\n            BIO_printf(bio_err, "id_prefix \'%s\' set.\\n", session_id_prefix);\n        }\n        SSL_CTX_set_quiet_shutdown(ctx2, 1);\n        if (exc)\n            ssl_ctx_set_excert(ctx2, exc);\n        if (state)\n            SSL_CTX_set_info_callback(ctx2, apps_ssl_info_callback);\n        if (no_cache)\n            SSL_CTX_set_session_cache_mode(ctx2, SSL_SESS_CACHE_OFF);\n        else if (ext_cache)\n            init_session_cache_ctx(ctx2);\n        else\n            SSL_CTX_sess_set_cache_size(ctx2, 128);\n        if (async)\n            SSL_CTX_set_mode(ctx2, SSL_MODE_ASYNC);\n        if ((!SSL_CTX_load_verify_locations(ctx2, CAfile, CApath)) ||\n            (!SSL_CTX_set_default_verify_paths(ctx2))) {\n            ERR_print_errors(bio_err);\n        }\n        if (vpmtouched && !SSL_CTX_set1_param(ctx2, vpm)) {\n            BIO_printf(bio_err, "Error setting verify params\\n");\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        ssl_ctx_add_crls(ctx2, crls, 0);\n        if (!config_ctx(cctx, ssl_args, ctx2, jpake_secret == NULL))\n            goto end;\n    }\n#ifndef OPENSSL_NO_NEXTPROTONEG\n    if (next_proto.data)\n        SSL_CTX_set_next_protos_advertised_cb(ctx, next_proto_cb,\n                                              &next_proto);\n#endif\n    if (alpn_ctx.data)\n        SSL_CTX_set_alpn_select_cb(ctx, alpn_cb, &alpn_ctx);\n#ifndef OPENSSL_NO_DH\n    if (!no_dhe) {\n        DH *dh = NULL;\n        if (dhfile)\n            dh = load_dh_param(dhfile);\n        else if (s_cert_file)\n            dh = load_dh_param(s_cert_file);\n        if (dh != NULL) {\n            BIO_printf(bio_s_out, "Setting temp DH parameters\\n");\n        } else {\n            BIO_printf(bio_s_out, "Using default temp DH parameters\\n");\n        }\n        (void)BIO_flush(bio_s_out);\n        if (dh == NULL)\n            SSL_CTX_set_dh_auto(ctx, 1);\n        else if (!SSL_CTX_set_tmp_dh(ctx, dh)) {\n            BIO_puts(bio_err, "Error setting temp DH parameters\\n");\n            ERR_print_errors(bio_err);\n            DH_free(dh);\n            goto end;\n        }\n        if (ctx2) {\n            if (!dhfile) {\n                DH *dh2 = load_dh_param(s_cert_file2);\n                if (dh2 != NULL) {\n                    BIO_printf(bio_s_out, "Setting temp DH parameters\\n");\n                    (void)BIO_flush(bio_s_out);\n                    DH_free(dh);\n                    dh = dh2;\n                }\n            }\n            if (dh == NULL)\n                SSL_CTX_set_dh_auto(ctx2, 1);\n            else if (!SSL_CTX_set_tmp_dh(ctx2, dh)) {\n                BIO_puts(bio_err, "Error setting temp DH parameters\\n");\n                ERR_print_errors(bio_err);\n                DH_free(dh);\n                goto end;\n            }\n        }\n        DH_free(dh);\n    }\n#endif\n    if (!set_cert_key_stuff(ctx, s_cert, s_key, s_chain, build_chain))\n        goto end;\n    if (s_serverinfo_file != NULL\n        && !SSL_CTX_use_serverinfo_file(ctx, s_serverinfo_file)) {\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n    if (ctx2 && !set_cert_key_stuff(ctx2, s_cert2, s_key2, NULL, build_chain))\n        goto end;\n    if (s_dcert != NULL) {\n        if (!set_cert_key_stuff(ctx, s_dcert, s_dkey, s_dchain, build_chain))\n            goto end;\n    }\n    if (no_resume_ephemeral) {\n        SSL_CTX_set_not_resumable_session_callback(ctx,\n                                                   not_resumable_sess_cb);\n        if (ctx2)\n            SSL_CTX_set_not_resumable_session_callback(ctx2,\n                                                       not_resumable_sess_cb);\n    }\n#ifndef OPENSSL_NO_PSK\n# ifdef OPENSSL_NO_JPAKE\n    if (psk_key != NULL)\n# else\n    if (psk_key != NULL || jpake_secret)\n# endif\n    {\n        if (s_debug)\n            BIO_printf(bio_s_out,\n                       "PSK key given or JPAKE in use, setting server callback\\n");\n        SSL_CTX_set_psk_server_callback(ctx, psk_server_cb);\n    }\n    if (!SSL_CTX_use_psk_identity_hint(ctx, psk_identity_hint)) {\n        BIO_printf(bio_err, "error setting PSK identity hint to context\\n");\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n#endif\n    SSL_CTX_set_verify(ctx, s_server_verify, verify_callback);\n    if (!SSL_CTX_set_session_id_context(ctx,\n                (void *)&s_server_session_id_context,\n                sizeof s_server_session_id_context)) {\n        BIO_printf(bio_err, "error setting session id context\\n");\n        ERR_print_errors(bio_err);\n        goto end;\n    }\n    SSL_CTX_set_cookie_generate_cb(ctx, generate_cookie_callback);\n    SSL_CTX_set_cookie_verify_cb(ctx, verify_cookie_callback);\n    if (ctx2) {\n        SSL_CTX_set_verify(ctx2, s_server_verify, verify_callback);\n        if (!SSL_CTX_set_session_id_context(ctx2,\n                    (void *)&s_server_session_id_context,\n                    sizeof s_server_session_id_context)) {\n            BIO_printf(bio_err, "error setting session id context\\n");\n            ERR_print_errors(bio_err);\n            goto end;\n        }\n        tlsextcbp.biodebug = bio_s_out;\n        SSL_CTX_set_tlsext_servername_callback(ctx2, ssl_servername_cb);\n        SSL_CTX_set_tlsext_servername_arg(ctx2, &tlsextcbp);\n        SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb);\n        SSL_CTX_set_tlsext_servername_arg(ctx, &tlsextcbp);\n    }\n#ifndef OPENSSL_NO_SRP\n    if (srp_verifier_file != NULL) {\n        srp_callback_parm.vb = SRP_VBASE_new(srpuserseed);\n        srp_callback_parm.user = NULL;\n        srp_callback_parm.login = NULL;\n        if ((ret =\n             SRP_VBASE_init(srp_callback_parm.vb,\n                            srp_verifier_file)) != SRP_NO_ERROR) {\n            BIO_printf(bio_err,\n                       "Cannot initialize SRP verifier file \\"%s\\":ret=%d\\n",\n                       srp_verifier_file, ret);\n            goto end;\n        }\n        SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, verify_callback);\n        SSL_CTX_set_srp_cb_arg(ctx, &srp_callback_parm);\n        SSL_CTX_set_srp_username_callback(ctx, ssl_srp_server_param_cb);\n    } else\n#endif\n    if (CAfile != NULL) {\n        SSL_CTX_set_client_CA_list(ctx, SSL_load_client_CA_file(CAfile));\n        if (ctx2)\n            SSL_CTX_set_client_CA_list(ctx2, SSL_load_client_CA_file(CAfile));\n    }\n    if (s_tlsextstatus) {\n        SSL_CTX_set_tlsext_status_cb(ctx, cert_status_cb);\n        SSL_CTX_set_tlsext_status_arg(ctx, &tlscstatp);\n        if (ctx2) {\n            SSL_CTX_set_tlsext_status_cb(ctx2, cert_status_cb);\n            SSL_CTX_set_tlsext_status_arg(ctx2, &tlscstatp);\n        }\n    }\n    BIO_printf(bio_s_out, "ACCEPT\\n");\n    (void)BIO_flush(bio_s_out);\n    if (rev)\n        server_cb = rev_body;\n    else if (www)\n        server_cb = www_body;\n    else\n        server_cb = sv_body;\n#ifndef NO_SYS_UN_H\n    if (unix_path) {\n        if (unlink_unix_path)\n            unlink(unix_path);\n        do_server_unix(unix_path, &accept_socket, server_cb, context,\n                       naccept);\n    } else\n#endif\n        do_server(port, socket_type, &accept_socket, server_cb, context,\n                  naccept);\n    print_stats(bio_s_out, ctx);\n    ret = 0;\n end:\n    SSL_CTX_free(ctx);\n    X509_free(s_cert);\n    sk_X509_CRL_pop_free(crls, X509_CRL_free);\n    X509_free(s_dcert);\n    EVP_PKEY_free(s_key);\n    EVP_PKEY_free(s_dkey);\n    sk_X509_pop_free(s_chain, X509_free);\n    sk_X509_pop_free(s_dchain, X509_free);\n    OPENSSL_free(pass);\n    OPENSSL_free(dpass);\n    X509_VERIFY_PARAM_free(vpm);\n    free_sessions();\n    OPENSSL_free(tlscstatp.host);\n    OPENSSL_free(tlscstatp.port);\n    OPENSSL_free(tlscstatp.path);\n    SSL_CTX_free(ctx2);\n    X509_free(s_cert2);\n    EVP_PKEY_free(s_key2);\n    BIO_free(serverinfo_in);\n#ifndef OPENSSL_NO_NEXTPROTONEG\n    OPENSSL_free(next_proto.data);\n#endif\n    OPENSSL_free(alpn_ctx.data);\n    ssl_excert_free(exc);\n    sk_OPENSSL_STRING_free(ssl_args);\n    SSL_CONF_CTX_free(cctx);\n    BIO_free(bio_s_out);\n    bio_s_out = NULL;\n    BIO_free(bio_s_msg);\n    bio_s_msg = NULL;\n    if (async) {\n        ASYNC_cleanup(1);\n    }\n    return (ret);\n}', 'int load_certs(const char *file, STACK_OF(X509) **certs, int format,\n               const char *pass, ENGINE *e, const char *desc)\n{\n    return load_certs_crls(file, format, pass, e, desc, certs, NULL);\n}', 'static int load_certs_crls(const char *file, int format,\n                           const char *pass, ENGINE *e, const char *desc,\n                           STACK_OF(X509) **pcerts,\n                           STACK_OF(X509_CRL) **pcrls)\n{\n    int i;\n    BIO *bio;\n    STACK_OF(X509_INFO) *xis = NULL;\n    X509_INFO *xi;\n    PW_CB_DATA cb_data;\n    int rv = 0;\n    cb_data.password = pass;\n    cb_data.prompt_info = file;\n    if (format != FORMAT_PEM) {\n        BIO_printf(bio_err, "bad input format specified for %s\\n", desc);\n        return 0;\n    }\n    bio = bio_open_default(file, \'r\', FORMAT_PEM);\n    if (bio == NULL)\n        return 0;\n    xis = PEM_X509_INFO_read_bio(bio, NULL,\n                                 (pem_password_cb *)password_callback,\n                                 &cb_data);\n    BIO_free(bio);\n    if (pcerts && *pcerts == NULL) {\n        *pcerts = sk_X509_new_null();\n        if (!*pcerts)\n            goto end;\n    }\n    if (pcrls && *pcrls == NULL) {\n        *pcrls = sk_X509_CRL_new_null();\n        if (!*pcrls)\n            goto end;\n    }\n    for (i = 0; i < sk_X509_INFO_num(xis); i++) {\n        xi = sk_X509_INFO_value(xis, i);\n        if (xi->x509 && pcerts) {\n            if (!sk_X509_push(*pcerts, xi->x509))\n                goto end;\n            xi->x509 = NULL;\n        }\n        if (xi->crl && pcrls) {\n            if (!sk_X509_CRL_push(*pcrls, xi->crl))\n                goto end;\n            xi->crl = NULL;\n        }\n    }\n    if (pcerts && sk_X509_num(*pcerts) > 0)\n        rv = 1;\n    if (pcrls && sk_X509_CRL_num(*pcrls) > 0)\n        rv = 1;\n end:\n    sk_X509_INFO_pop_free(xis, X509_INFO_free);\n    if (rv == 0) {\n        if (pcerts) {\n            sk_X509_pop_free(*pcerts, X509_free);\n            *pcerts = NULL;\n        }\n        if (pcrls) {\n            sk_X509_CRL_pop_free(*pcrls, X509_CRL_free);\n            *pcrls = NULL;\n        }\n        BIO_printf(bio_err, "unable to load %s\\n",\n                   pcerts ? "certificates" : "CRLs");\n        ERR_print_errors(bio_err);\n    }\n    return rv;\n}', 'STACK_OF(X509_INFO) *PEM_X509_INFO_read_bio(BIO *bp, STACK_OF(X509_INFO) *sk,\n                                            pem_password_cb *cb, void *u)\n{\n    X509_INFO *xi = NULL;\n    char *name = NULL, *header = NULL;\n    void *pp;\n    unsigned char *data = NULL;\n    const unsigned char *p;\n    long len, error = 0;\n    int ok = 0;\n    STACK_OF(X509_INFO) *ret = NULL;\n    unsigned int i, raw, ptype;\n    d2i_of_void *d2i = 0;\n    if (sk == NULL) {\n        if ((ret = sk_X509_INFO_new_null()) == NULL) {\n            PEMerr(PEM_F_PEM_X509_INFO_READ_BIO, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n    } else\n        ret = sk;\n    if ((xi = X509_INFO_new()) == NULL)\n        goto err;\n    for (;;) {\n        raw = 0;\n        ptype = 0;\n        i = PEM_read_bio(bp, &name, &header, &data, &len);\n        if (i == 0) {\n            error = ERR_GET_REASON(ERR_peek_last_error());\n            if (error == PEM_R_NO_START_LINE) {\n                ERR_clear_error();\n                break;\n            }\n            goto err;\n        }\n start:\n        if ((strcmp(name, PEM_STRING_X509) == 0) ||\n            (strcmp(name, PEM_STRING_X509_OLD) == 0)) {\n            d2i = (D2I_OF(void)) d2i_X509;\n            if (xi->x509 != NULL) {\n                if (!sk_X509_INFO_push(ret, xi))\n                    goto err;\n                if ((xi = X509_INFO_new()) == NULL)\n                    goto err;\n                goto start;\n            }\n            pp = &(xi->x509);\n        } else if ((strcmp(name, PEM_STRING_X509_TRUSTED) == 0)) {\n            d2i = (D2I_OF(void)) d2i_X509_AUX;\n            if (xi->x509 != NULL) {\n                if (!sk_X509_INFO_push(ret, xi))\n                    goto err;\n                if ((xi = X509_INFO_new()) == NULL)\n                    goto err;\n                goto start;\n            }\n            pp = &(xi->x509);\n        } else if (strcmp(name, PEM_STRING_X509_CRL) == 0) {\n            d2i = (D2I_OF(void)) d2i_X509_CRL;\n            if (xi->crl != NULL) {\n                if (!sk_X509_INFO_push(ret, xi))\n                    goto err;\n                if ((xi = X509_INFO_new()) == NULL)\n                    goto err;\n                goto start;\n            }\n            pp = &(xi->crl);\n        } else\n#ifndef OPENSSL_NO_RSA\n        if (strcmp(name, PEM_STRING_RSA) == 0) {\n            d2i = (D2I_OF(void)) d2i_RSAPrivateKey;\n            if (xi->x_pkey != NULL) {\n                if (!sk_X509_INFO_push(ret, xi))\n                    goto err;\n                if ((xi = X509_INFO_new()) == NULL)\n                    goto err;\n                goto start;\n            }\n            xi->enc_data = NULL;\n            xi->enc_len = 0;\n            xi->x_pkey = X509_PKEY_new();\n            if (xi->x_pkey == NULL)\n                goto err;\n            ptype = EVP_PKEY_RSA;\n            pp = &xi->x_pkey->dec_pkey;\n            if ((int)strlen(header) > 10)\n                raw = 1;\n        } else\n#endif\n#ifndef OPENSSL_NO_DSA\n        if (strcmp(name, PEM_STRING_DSA) == 0) {\n            d2i = (D2I_OF(void)) d2i_DSAPrivateKey;\n            if (xi->x_pkey != NULL) {\n                if (!sk_X509_INFO_push(ret, xi))\n                    goto err;\n                if ((xi = X509_INFO_new()) == NULL)\n                    goto err;\n                goto start;\n            }\n            xi->enc_data = NULL;\n            xi->enc_len = 0;\n            xi->x_pkey = X509_PKEY_new();\n            if (xi->x_pkey == NULL)\n                goto err;\n            ptype = EVP_PKEY_DSA;\n            pp = &xi->x_pkey->dec_pkey;\n            if ((int)strlen(header) > 10)\n                raw = 1;\n        } else\n#endif\n#ifndef OPENSSL_NO_EC\n        if (strcmp(name, PEM_STRING_ECPRIVATEKEY) == 0) {\n            d2i = (D2I_OF(void)) d2i_ECPrivateKey;\n            if (xi->x_pkey != NULL) {\n                if (!sk_X509_INFO_push(ret, xi))\n                    goto err;\n                if ((xi = X509_INFO_new()) == NULL)\n                    goto err;\n                goto start;\n            }\n            xi->enc_data = NULL;\n            xi->enc_len = 0;\n            xi->x_pkey = X509_PKEY_new();\n            if (xi->x_pkey == NULL)\n                goto err;\n            ptype = EVP_PKEY_EC;\n            pp = &xi->x_pkey->dec_pkey;\n            if ((int)strlen(header) > 10)\n                raw = 1;\n        } else\n#endif\n        {\n            d2i = NULL;\n            pp = NULL;\n        }\n        if (d2i != NULL) {\n            if (!raw) {\n                EVP_CIPHER_INFO cipher;\n                if (!PEM_get_EVP_CIPHER_INFO(header, &cipher))\n                    goto err;\n                if (!PEM_do_header(&cipher, data, &len, cb, u))\n                    goto err;\n                p = data;\n                if (ptype) {\n                    if (!d2i_PrivateKey(ptype, pp, &p, len)) {\n                        PEMerr(PEM_F_PEM_X509_INFO_READ_BIO, ERR_R_ASN1_LIB);\n                        goto err;\n                    }\n                } else if (d2i(pp, &p, len) == NULL) {\n                    PEMerr(PEM_F_PEM_X509_INFO_READ_BIO, ERR_R_ASN1_LIB);\n                    goto err;\n                }\n            } else {\n                if (!PEM_get_EVP_CIPHER_INFO(header, &xi->enc_cipher))\n                    goto err;\n                xi->enc_data = (char *)data;\n                xi->enc_len = (int)len;\n                data = NULL;\n            }\n        } else {\n        }\n        OPENSSL_free(name);\n        name = NULL;\n        OPENSSL_free(header);\n        header = NULL;\n        OPENSSL_free(data);\n        data = NULL;\n    }\n    if ((xi->x509 != NULL) || (xi->crl != NULL) ||\n        (xi->x_pkey != NULL) || (xi->enc_data != NULL)) {\n        if (!sk_X509_INFO_push(ret, xi))\n            goto err;\n        xi = NULL;\n    }\n    ok = 1;\n err:\n    X509_INFO_free(xi);\n    if (!ok) {\n        for (i = 0; ((int)i) < sk_X509_INFO_num(ret); i++) {\n            xi = sk_X509_INFO_value(ret, i);\n            X509_INFO_free(xi);\n        }\n        if (ret != sk)\n            sk_X509_INFO_free(ret);\n        ret = NULL;\n    }\n    OPENSSL_free(name);\n    OPENSSL_free(header);\n    OPENSSL_free(data);\n    return (ret);\n}', 'int PEM_read_bio(BIO *bp, char **name, char **header, unsigned char **data,\n                 long *len)\n{\n    EVP_ENCODE_CTX *ctx = EVP_ENCODE_CTX_new();\n    int end = 0, i, k, bl = 0, hl = 0, nohead = 0;\n    char buf[256];\n    BUF_MEM *nameB;\n    BUF_MEM *headerB;\n    BUF_MEM *dataB, *tmpB;\n    if (ctx == NULL) {\n        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n        return (0);\n    }\n    nameB = BUF_MEM_new();\n    headerB = BUF_MEM_new();\n    dataB = BUF_MEM_new();\n    if ((nameB == NULL) || (headerB == NULL) || (dataB == NULL)) {\n        goto err;\n    }\n    buf[254] = \'\\0\';\n    for (;;) {\n        i = BIO_gets(bp, buf, 254);\n        if (i <= 0) {\n            PEMerr(PEM_F_PEM_READ_BIO, PEM_R_NO_START_LINE);\n            goto err;\n        }\n        while ((i >= 0) && (buf[i] <= \' \'))\n            i--;\n        buf[++i] = \'\\n\';\n        buf[++i] = \'\\0\';\n        if (strncmp(buf, "-----BEGIN ", 11) == 0) {\n            i = strlen(&(buf[11]));\n            if (strncmp(&(buf[11 + i - 6]), "-----\\n", 6) != 0)\n                continue;\n            if (!BUF_MEM_grow(nameB, i + 9)) {\n                PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            memcpy(nameB->data, &(buf[11]), i - 6);\n            nameB->data[i - 6] = \'\\0\';\n            break;\n        }\n    }\n    hl = 0;\n    if (!BUF_MEM_grow(headerB, 256)) {\n        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    headerB->data[0] = \'\\0\';\n    for (;;) {\n        i = BIO_gets(bp, buf, 254);\n        if (i <= 0)\n            break;\n        while ((i >= 0) && (buf[i] <= \' \'))\n            i--;\n        buf[++i] = \'\\n\';\n        buf[++i] = \'\\0\';\n        if (buf[0] == \'\\n\')\n            break;\n        if (!BUF_MEM_grow(headerB, hl + i + 9)) {\n            PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        if (strncmp(buf, "-----END ", 9) == 0) {\n            nohead = 1;\n            break;\n        }\n        memcpy(&(headerB->data[hl]), buf, i);\n        headerB->data[hl + i] = \'\\0\';\n        hl += i;\n    }\n    bl = 0;\n    if (!BUF_MEM_grow(dataB, 1024)) {\n        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    dataB->data[0] = \'\\0\';\n    if (!nohead) {\n        for (;;) {\n            i = BIO_gets(bp, buf, 254);\n            if (i <= 0)\n                break;\n            while ((i >= 0) && (buf[i] <= \' \'))\n                i--;\n            buf[++i] = \'\\n\';\n            buf[++i] = \'\\0\';\n            if (i != 65)\n                end = 1;\n            if (strncmp(buf, "-----END ", 9) == 0)\n                break;\n            if (i > 65)\n                break;\n            if (!BUF_MEM_grow_clean(dataB, i + bl + 9)) {\n                PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            memcpy(&(dataB->data[bl]), buf, i);\n            dataB->data[bl + i] = \'\\0\';\n            bl += i;\n            if (end) {\n                buf[0] = \'\\0\';\n                i = BIO_gets(bp, buf, 254);\n                if (i <= 0)\n                    break;\n                while ((i >= 0) && (buf[i] <= \' \'))\n                    i--;\n                buf[++i] = \'\\n\';\n                buf[++i] = \'\\0\';\n                break;\n            }\n        }\n    } else {\n        tmpB = headerB;\n        headerB = dataB;\n        dataB = tmpB;\n        bl = hl;\n    }\n    i = strlen(nameB->data);\n    if ((strncmp(buf, "-----END ", 9) != 0) ||\n        (strncmp(nameB->data, &(buf[9]), i) != 0) ||\n        (strncmp(&(buf[9 + i]), "-----\\n", 6) != 0)) {\n        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_END_LINE);\n        goto err;\n    }\n    EVP_DecodeInit(ctx);\n    i = EVP_DecodeUpdate(ctx,\n                         (unsigned char *)dataB->data, &bl,\n                         (unsigned char *)dataB->data, bl);\n    if (i < 0) {\n        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_BASE64_DECODE);\n        goto err;\n    }\n    i = EVP_DecodeFinal(ctx, (unsigned char *)&(dataB->data[bl]), &k);\n    if (i < 0) {\n        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_BASE64_DECODE);\n        goto err;\n    }\n    bl += k;\n    if (bl == 0)\n        goto err;\n    *name = nameB->data;\n    *header = headerB->data;\n    *data = (unsigned char *)dataB->data;\n    *len = bl;\n    OPENSSL_free(nameB);\n    OPENSSL_free(headerB);\n    OPENSSL_free(dataB);\n    EVP_ENCODE_CTX_free(ctx);\n    return (1);\n err:\n    BUF_MEM_free(nameB);\n    BUF_MEM_free(headerB);\n    BUF_MEM_free(dataB);\n    EVP_ENCODE_CTX_free(ctx);\n    return (0);\n}', 'unsigned char *next_protos_parse(unsigned short *outlen, const char *in)\n{\n    size_t len;\n    unsigned char *out;\n    size_t i, start = 0;\n    len = strlen(in);\n    if (len >= 65535)\n        return NULL;\n    out = app_malloc(strlen(in) + 1, "NPN buffer");\n    for (i = 0; i <= len; ++i) {\n        if (i == len || in[i] == \',\') {\n            if (i - start > 255) {\n                OPENSSL_free(out);\n                return NULL;\n            }\n            out[start] = i - start;\n            start = i + 1;\n        } else\n            out[i + 1] = in[i];\n    }\n    *outlen = len + 1;\n    return out;\n}', 'void* app_malloc(int sz, const char *what)\n{\n    void *vp = OPENSSL_malloc(sz);\n    if (vp == NULL) {\n        BIO_printf(bio_err, "%s: Could not allocate %d bytes for %s\\n",\n                opt_getprog(), sz, what);\n        ERR_print_errors(bio_err);\n        exit(1);\n    }\n    return vp;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}']