crypto/bio/bio_cb.c:90: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] (⇐ [-1, 2147483647] + [0, +oo]) Size: 256 by call to `BIO_snprintf`.
Showing all 14 steps of the trace


crypto/bio/bio_cb.c:66:1: Array declaration
64.   #include <openssl/err.h>
65.   
66. > long BIO_debug_callback(BIO *bio, int cmd, const char *argp,
67.                           int argi, long argl, long ret)
68.   {

crypto/bio/bio_cb.c:81:5: Assignment
79.       len = BIO_snprintf(buf,sizeof buf,"BIO[%p]: ",(void *)bio);
80.   
81.       p = buf + len;
          ^
82.       p_maxlen = sizeof(buf) - len;
83.   

crypto/bio/bio_cb.c:90:13: Call
88.       case BIO_CB_READ:
89.           if (bio->method->type & BIO_TYPE_DESCRIPTOR)
90.               BIO_snprintf(p, p_maxlen, "read(%d,%lu) - %s fd=%d\n",
                  ^
91.                            bio->num, (unsigned long)argi,
92.                            bio->method->name, bio->num);

crypto/bio/b_print.c:794:1: Parameter `*buf`
  792.    * function should be renamed, but to what?)
  793.    */
  794. > int BIO_snprintf(char *buf, size_t n, const char *format, ...)
  795.   {
  796.       va_list args;

crypto/bio/b_print.c:801:11: Call
  799.       va_start(args, format);
  800.   
  801.       ret = BIO_vsnprintf(buf, n, format, args);
                   ^
  802.   
  803.       va_end(args);

crypto/bio/b_print.c:807:1: Parameter `*buf`
    805.   }
    806.   
    807. > int BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)
    808.   {
    809.       size_t retlen;

crypto/bio/b_print.c:812:5: Call
    810.       int truncated;
    811.   
    812.       _dopr(&buf, NULL, &n, &retlen, &truncated, format, args);
               ^
    813.   
    814.       if (truncated)

crypto/bio/b_print.c:168:1: Parameter `*maxlen`
      166.   #define OSSL_MAX(p,q) ((p >= q) ? p : q)
      167.   
      168. > static void
      169.   _dopr(char **sbuffer,
      170.         char **buffer,

crypto/bio/b_print.c:199:17: Call
      197.                   state = DP_S_FLAGS;
      198.               else
      199.                   doapr_outch(sbuffer, buffer, &currlen, maxlen, ch);
                             ^
      200.               ch = *format++;
      201.               break;

crypto/bio/b_print.c:703:1: <Offset trace>
701.   }
702.   
703. > static void
704.   doapr_outch(char **sbuffer,
705.               char **buffer, size_t *currlen, size_t *maxlen, int c)

crypto/bio/b_print.c:703:1: Parameter `*maxlen`
        701.   }
        702.   
        703. > static void
        704.   doapr_outch(char **sbuffer,
        705.               char **buffer, size_t *currlen, size_t *maxlen, int c)

crypto/bio/b_print.c:703:1: <Length trace>
701.   }
702.   
703. > static void
704.   doapr_outch(char **sbuffer,
705.               char **buffer, size_t *currlen, size_t *maxlen, int c)

crypto/bio/b_print.c:703:1: Parameter `**sbuffer`
        701.   }
        702.   
        703. > static void
        704.   doapr_outch(char **sbuffer,
        705.               char **buffer, size_t *currlen, size_t *maxlen, int c)

crypto/bio/b_print.c:740:13: Array access: Offset: [-1, +oo] (⇐ [-1, 2147483647] + [0, +oo]) Size: 256 by call to `BIO_snprintf` 
        738.       if (*currlen < *maxlen) {
        739.           if (*sbuffer)
        740.               (*sbuffer)[(*currlen)++] = (char)c;
                           ^
        741.           else
        742.               (*buffer)[(*currlen)++] = (char)c;

static void
doapr_outch(char **sbuffer,
            char **buffer, size_t *currlen, size_t *maxlen, int c)
{
    assert(*sbuffer != NULL || buffer != NULL);
    if (buffer) {
        while (*currlen >= *maxlen) {
            if (*buffer == NULL) {
                if (*maxlen == 0)
                    *maxlen = 1024;
                *buffer = OPENSSL_malloc(*maxlen);
                if(!*buffer) {
                    return;
                }
                if (*currlen > 0) {
                    assert(*sbuffer != NULL);
                    memcpy(*buffer, *sbuffer, *currlen);
                }
                *sbuffer = NULL;
            } else {
                *maxlen += 1024;
                *buffer = OPENSSL_realloc(*buffer, *maxlen);
                if(!*buffer) {
                    return;
                }
            }
        }
        assert(*sbuffer != NULL || *buffer != NULL);
    }
    if (*currlen < *maxlen) {
        if (*sbuffer)
            (*sbuffer)[(*currlen)++] = (char)c;
        else
            (*buffer)[(*currlen)++] = (char)c;
    }
    return;
}
['long BIO_debug_callback(BIO *bio, int cmd, const char *argp,\n                        int argi, long argl, long ret)\n{\n    BIO *b;\n    char buf[256];\n    char *p;\n    long r = 1;\n    int len;\n    size_t p_maxlen;\n    if (BIO_CB_RETURN & cmd)\n        r = ret;\n    len = BIO_snprintf(buf,sizeof buf,"BIO[%p]: ",(void *)bio);\n    p = buf + len;\n    p_maxlen = sizeof(buf) - len;\n    switch (cmd) {\n    case BIO_CB_FREE:\n        BIO_snprintf(p, p_maxlen, "Free - %s\\n", bio->method->name);\n        break;\n    case BIO_CB_READ:\n        if (bio->method->type & BIO_TYPE_DESCRIPTOR)\n            BIO_snprintf(p, p_maxlen, "read(%d,%lu) - %s fd=%d\\n",\n                         bio->num, (unsigned long)argi,\n                         bio->method->name, bio->num);\n        else\n            BIO_snprintf(p, p_maxlen, "read(%d,%lu) - %s\\n",\n                         bio->num, (unsigned long)argi, bio->method->name);\n        break;\n    case BIO_CB_WRITE:\n        if (bio->method->type & BIO_TYPE_DESCRIPTOR)\n            BIO_snprintf(p, p_maxlen, "write(%d,%lu) - %s fd=%d\\n",\n                         bio->num, (unsigned long)argi,\n                         bio->method->name, bio->num);\n        else\n            BIO_snprintf(p, p_maxlen, "write(%d,%lu) - %s\\n",\n                         bio->num, (unsigned long)argi, bio->method->name);\n        break;\n    case BIO_CB_PUTS:\n        BIO_snprintf(p, p_maxlen, "puts() - %s\\n", bio->method->name);\n        break;\n    case BIO_CB_GETS:\n        BIO_snprintf(p, p_maxlen, "gets(%lu) - %s\\n", (unsigned long)argi,\n                     bio->method->name);\n        break;\n    case BIO_CB_CTRL:\n        BIO_snprintf(p, p_maxlen, "ctrl(%lu) - %s\\n", (unsigned long)argi,\n                     bio->method->name);\n        break;\n    case BIO_CB_RETURN | BIO_CB_READ:\n        BIO_snprintf(p, p_maxlen, "read return %ld\\n", ret);\n        break;\n    case BIO_CB_RETURN | BIO_CB_WRITE:\n        BIO_snprintf(p, p_maxlen, "write return %ld\\n", ret);\n        break;\n    case BIO_CB_RETURN | BIO_CB_GETS:\n        BIO_snprintf(p, p_maxlen, "gets return %ld\\n", ret);\n        break;\n    case BIO_CB_RETURN | BIO_CB_PUTS:\n        BIO_snprintf(p, p_maxlen, "puts return %ld\\n", ret);\n        break;\n    case BIO_CB_RETURN | BIO_CB_CTRL:\n        BIO_snprintf(p, p_maxlen, "ctrl return %ld\\n", ret);\n        break;\n    default:\n        BIO_snprintf(p, p_maxlen, "bio callback - unknown type (%d)\\n", cmd);\n        break;\n    }\n    b = (BIO *)bio->cb_arg;\n    if (b != NULL)\n        BIO_write(b, buf, strlen(buf));\n#if !defined(OPENSSL_NO_STDIO)\n    else\n        fputs(buf, stderr);\n#endif\n    return (r);\n}', 'int BIO_snprintf(char *buf, size_t n, const char *format, ...)\n{\n    va_list args;\n    int ret;\n    va_start(args, format);\n    ret = BIO_vsnprintf(buf, n, format, args);\n    va_end(args);\n    return (ret);\n}', 'int BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)\n{\n    size_t retlen;\n    int truncated;\n    _dopr(&buf, NULL, &n, &retlen, &truncated, format, args);\n    if (truncated)\n        return -1;\n    else\n        return (retlen <= INT_MAX) ? (int)retlen : -1;\n}', "static void\n_dopr(char **sbuffer,\n      char **buffer,\n      size_t *maxlen,\n      size_t *retlen, int *truncated, const char *format, va_list args)\n{\n    char ch;\n    LLONG value;\n    LDOUBLE fvalue;\n    char *strvalue;\n    int min;\n    int max;\n    int state;\n    int flags;\n    int cflags;\n    size_t currlen;\n    state = DP_S_DEFAULT;\n    flags = currlen = cflags = min = 0;\n    max = -1;\n    ch = *format++;\n    while (state != DP_S_DONE) {\n        if (ch == '\\0' || (buffer == NULL && currlen >= *maxlen))\n            state = DP_S_DONE;\n        switch (state) {\n        case DP_S_DEFAULT:\n            if (ch == '%')\n                state = DP_S_FLAGS;\n            else\n                doapr_outch(sbuffer, buffer, &currlen, maxlen, ch);\n            ch = *format++;\n            break;\n        case DP_S_FLAGS:\n            switch (ch) {\n            case '-':\n                flags |= DP_F_MINUS;\n                ch = *format++;\n                break;\n            case '+':\n                flags |= DP_F_PLUS;\n                ch = *format++;\n                break;\n            case ' ':\n                flags |= DP_F_SPACE;\n                ch = *format++;\n                break;\n            case '#':\n                flags |= DP_F_NUM;\n                ch = *format++;\n                break;\n            case '0':\n                flags |= DP_F_ZERO;\n                ch = *format++;\n                break;\n            default:\n                state = DP_S_MIN;\n                break;\n            }\n            break;\n        case DP_S_MIN:\n            if (isdigit((unsigned char)ch)) {\n                min = 10 * min + char_to_int(ch);\n                ch = *format++;\n            } else if (ch == '*') {\n                min = va_arg(args, int);\n                ch = *format++;\n                state = DP_S_DOT;\n            } else\n                state = DP_S_DOT;\n            break;\n        case DP_S_DOT:\n            if (ch == '.') {\n                state = DP_S_MAX;\n                ch = *format++;\n            } else\n                state = DP_S_MOD;\n            break;\n        case DP_S_MAX:\n            if (isdigit((unsigned char)ch)) {\n                if (max < 0)\n                    max = 0;\n                max = 10 * max + char_to_int(ch);\n                ch = *format++;\n            } else if (ch == '*') {\n                max = va_arg(args, int);\n                ch = *format++;\n                state = DP_S_MOD;\n            } else\n                state = DP_S_MOD;\n            break;\n        case DP_S_MOD:\n            switch (ch) {\n            case 'h':\n                cflags = DP_C_SHORT;\n                ch = *format++;\n                break;\n            case 'l':\n                if (*format == 'l') {\n                    cflags = DP_C_LLONG;\n                    format++;\n                } else\n                    cflags = DP_C_LONG;\n                ch = *format++;\n                break;\n            case 'q':\n                cflags = DP_C_LLONG;\n                ch = *format++;\n                break;\n            case 'L':\n                cflags = DP_C_LDOUBLE;\n                ch = *format++;\n                break;\n            default:\n                break;\n            }\n            state = DP_S_CONV;\n            break;\n        case DP_S_CONV:\n            switch (ch) {\n            case 'd':\n            case 'i':\n                switch (cflags) {\n                case DP_C_SHORT:\n                    value = (short int)va_arg(args, int);\n                    break;\n                case DP_C_LONG:\n                    value = va_arg(args, long int);\n                    break;\n                case DP_C_LLONG:\n                    value = va_arg(args, LLONG);\n                    break;\n                default:\n                    value = va_arg(args, int);\n                    break;\n                }\n                fmtint(sbuffer, buffer, &currlen, maxlen,\n                       value, 10, min, max, flags);\n                break;\n            case 'X':\n                flags |= DP_F_UP;\n            case 'x':\n            case 'o':\n            case 'u':\n                flags |= DP_F_UNSIGNED;\n                switch (cflags) {\n                case DP_C_SHORT:\n                    value = (unsigned short int)va_arg(args, unsigned int);\n                    break;\n                case DP_C_LONG:\n                    value = (LLONG) va_arg(args, unsigned long int);\n                    break;\n                case DP_C_LLONG:\n                    value = va_arg(args, unsigned LLONG);\n                    break;\n                default:\n                    value = (LLONG) va_arg(args, unsigned int);\n                    break;\n                }\n                fmtint(sbuffer, buffer, &currlen, maxlen, value,\n                       ch == 'o' ? 8 : (ch == 'u' ? 10 : 16),\n                       min, max, flags);\n                break;\n            case 'f':\n                if (cflags == DP_C_LDOUBLE)\n                    fvalue = va_arg(args, LDOUBLE);\n                else\n                    fvalue = va_arg(args, double);\n                fmtfp(sbuffer, buffer, &currlen, maxlen,\n                      fvalue, min, max, flags);\n                break;\n            case 'E':\n                flags |= DP_F_UP;\n            case 'e':\n                if (cflags == DP_C_LDOUBLE)\n                    fvalue = va_arg(args, LDOUBLE);\n                else\n                    fvalue = va_arg(args, double);\n                break;\n            case 'G':\n                flags |= DP_F_UP;\n            case 'g':\n                if (cflags == DP_C_LDOUBLE)\n                    fvalue = va_arg(args, LDOUBLE);\n                else\n                    fvalue = va_arg(args, double);\n                break;\n            case 'c':\n                doapr_outch(sbuffer, buffer, &currlen, maxlen,\n                            va_arg(args, int));\n                break;\n            case 's':\n                strvalue = va_arg(args, char *);\n                if (max < 0) {\n                    if (buffer)\n                        max = INT_MAX;\n                    else\n                        max = *maxlen;\n                }\n                fmtstr(sbuffer, buffer, &currlen, maxlen, strvalue,\n                       flags, min, max);\n                break;\n            case 'p':\n                value = (long)va_arg(args, void *);\n                fmtint(sbuffer, buffer, &currlen, maxlen,\n                       value, 16, min, max, flags | DP_F_NUM);\n                break;\n            case 'n':\n                if (cflags == DP_C_SHORT) {\n                    short int *num;\n                    num = va_arg(args, short int *);\n                    *num = currlen;\n                } else if (cflags == DP_C_LONG) {\n                    long int *num;\n                    num = va_arg(args, long int *);\n                    *num = (long int)currlen;\n                } else if (cflags == DP_C_LLONG) {\n                    LLONG *num;\n                    num = va_arg(args, LLONG *);\n                    *num = (LLONG) currlen;\n                } else {\n                    int *num;\n                    num = va_arg(args, int *);\n                    *num = currlen;\n                }\n                break;\n            case '%':\n                doapr_outch(sbuffer, buffer, &currlen, maxlen, ch);\n                break;\n            case 'w':\n                ch = *format++;\n                break;\n            default:\n                break;\n            }\n            ch = *format++;\n            state = DP_S_DEFAULT;\n            flags = cflags = min = 0;\n            max = -1;\n            break;\n        case DP_S_DONE:\n            break;\n        default:\n            break;\n        }\n    }\n    *truncated = (currlen > *maxlen - 1);\n    if (*truncated)\n        currlen = *maxlen - 1;\n    doapr_outch(sbuffer, buffer, &currlen, maxlen, '\\0');\n    *retlen = currlen - 1;\n    return;\n}", 'static void\ndoapr_outch(char **sbuffer,\n            char **buffer, size_t *currlen, size_t *maxlen, int c)\n{\n    assert(*sbuffer != NULL || buffer != NULL);\n    if (buffer) {\n        while (*currlen >= *maxlen) {\n            if (*buffer == NULL) {\n                if (*maxlen == 0)\n                    *maxlen = 1024;\n                *buffer = OPENSSL_malloc(*maxlen);\n                if(!*buffer) {\n                    return;\n                }\n                if (*currlen > 0) {\n                    assert(*sbuffer != NULL);\n                    memcpy(*buffer, *sbuffer, *currlen);\n                }\n                *sbuffer = NULL;\n            } else {\n                *maxlen += 1024;\n                *buffer = OPENSSL_realloc(*buffer, *maxlen);\n                if(!*buffer) {\n                    return;\n                }\n            }\n        }\n        assert(*sbuffer != NULL || *buffer != NULL);\n    }\n    if (*currlen < *maxlen) {\n        if (*sbuffer)\n            (*sbuffer)[(*currlen)++] = (char)c;\n        else\n            (*buffer)[(*currlen)++] = (char)c;\n    }\n    return;\n}']