apps/engine.c:78: error: BUFFER_OVERRUN_S2
  Offset: [1+max(1, `(*buf)->strlen`), `(*buf)->strlen` + 1] Size: [1, 256⋅`s->strlen` + 256⋅`(*buf)->strlen` + 66048].
Showing all 6 steps of the trace


apps/engine.c:49:1: <Length trace>
47.   };
48.   
49. > static int append_buf(char **buf, int *size, const char *s)
50.   {
51.       const int expand = 256;

apps/engine.c:49:1: Parameter `**buf`
47.   };
48.   
49. > static int append_buf(char **buf, int *size, const char *s)
50.   {
51.       const int expand = 256;

apps/engine.c:53:5: Assignment
51.       const int expand = 256;
52.       int len = strlen(s) + 1;
53.       char *p = *buf;
          ^
54.   
55.       if (p == NULL) {

apps/engine.c:76:13: Assignment
74.   
75.           if (blen > 0) {
76.               p += blen;
                  ^
77.               *p++ = ',';
78.               *p++ = ' ';

apps/engine.c:77:14: Assignment
75.           if (blen > 0) {
76.               p += blen;
77.               *p++ = ',';
                   ^
78.               *p++ = ' ';
79.           }

apps/engine.c:78:13: Array access: Offset: [1+max(1, (*buf)->strlen), (*buf)->strlen + 1] Size: [1, 256⋅s->strlen + 256⋅(*buf)->strlen + 66048]
76.               p += blen;
77.               *p++ = ',';
78.               *p++ = ' ';
                  ^
79.           }
80.       }

static int append_buf(char **buf, int *size, const char *s)
{
    const int expand = 256;
    int len = strlen(s) + 1;
    char *p = *buf;
    if (p == NULL) {
        *size = ((len + expand - 1) / expand) * expand;
        p = *buf = app_malloc(*size, "engine buffer");
    } else {
        const int blen = strlen(p);
        if (blen > 0)
            len += 2 + blen;
        if (len > *size) {
            *size = ((len + expand - 1) / expand) * expand;
            p = OPENSSL_realloc(p, *size);
            if (p == NULL) {
                OPENSSL_free(*buf);
                *buf = NULL;
                return 0;
            }
            *buf = p;
        }
        if (blen > 0) {
            p += blen;
            *p++ = ',';
            *p++ = ' ';
        }
    }
    strcpy(p, s);
    return 1;
}
['static int append_buf(char **buf, int *size, const char *s)\n{\n    const int expand = 256;\n    int len = strlen(s) + 1;\n    char *p = *buf;\n    if (p == NULL) {\n        *size = ((len + expand - 1) / expand) * expand;\n        p = *buf = app_malloc(*size, "engine buffer");\n    } else {\n        const int blen = strlen(p);\n        if (blen > 0)\n            len += 2 + blen;\n        if (len > *size) {\n            *size = ((len + expand - 1) / expand) * expand;\n            p = OPENSSL_realloc(p, *size);\n            if (p == NULL) {\n                OPENSSL_free(*buf);\n                *buf = NULL;\n                return 0;\n            }\n            *buf = p;\n        }\n        if (blen > 0) {\n            p += blen;\n            *p++ = \',\';\n            *p++ = \' \';\n        }\n    }\n    strcpy(p, s);\n    return 1;\n}']