crypto/dso/dso_dlfcn.c:238: error: BUFFER_OVERRUN_S2
  Offset: [`filespec1->strlen` + 1, `filespec1->strlen` + `filespec2->strlen` + 1] (⇐ [1, `filespec2->strlen` + 1] + `filespec1->strlen`) Size: [1, `filespec1->strlen` + `filespec2->strlen` + 2].
Showing all 6 steps of the trace


crypto/dso/dso_dlfcn.c:185:1: <Offset trace>
183.   }
184.   
185. > static char *dlfcn_merger(DSO *dso, const char *filespec1,
186.                             const char *filespec2)
187.   {

crypto/dso/dso_dlfcn.c:185:1: Parameter `filespec1->strlen`
183.   }
184.   
185. > static char *dlfcn_merger(DSO *dso, const char *filespec1,
186.                             const char *filespec2)
187.   {

crypto/dso/dso_dlfcn.c:185:1: <Length trace>
183.   }
184.   
185. > static char *dlfcn_merger(DSO *dso, const char *filespec1,
186.                             const char *filespec2)
187.   {

crypto/dso/dso_dlfcn.c:185:1: Parameter `filespec2->strlen`
183.   }
184.   
185. > static char *dlfcn_merger(DSO *dso, const char *filespec1,
186.                             const char *filespec2)
187.   {

crypto/dso/dso_dlfcn.c:224:9: Assignment
222.           int spec2len, len;
223.   
224.           spec2len = strlen(filespec2);
               ^
225.           len = spec2len + strlen(filespec1);
226.   

crypto/dso/dso_dlfcn.c:238:9: Array access: Offset: [filespec1->strlen + 1, filespec1->strlen + filespec2->strlen + 1] (⇐ [1, filespec2->strlen + 1] + filespec1->strlen) Size: [1, filespec1->strlen + filespec2->strlen + 2]
236.           strcpy(merged, filespec2);
237.           merged[spec2len] = '/';
238.           strcpy(&merged[spec2len + 1], filespec1);
               ^
239.       }
240.       return merged;

static char *dlfcn_merger(DSO *dso, const char *filespec1,
                          const char *filespec2)
{
    char *merged;
    if (!filespec1 && !filespec2) {
        DSOerr(DSO_F_DLFCN_MERGER, ERR_R_PASSED_NULL_PARAMETER);
        return NULL;
    }
    if (!filespec2 || (filespec1 != NULL && filespec1[0] == '/')) {
        merged = OPENSSL_strdup(filespec1);
        if (merged == NULL) {
            DSOerr(DSO_F_DLFCN_MERGER, ERR_R_MALLOC_FAILURE);
            return NULL;
        }
    }
    else if (!filespec1) {
        merged = OPENSSL_strdup(filespec2);
        if (merged == NULL) {
            DSOerr(DSO_F_DLFCN_MERGER, ERR_R_MALLOC_FAILURE);
            return NULL;
        }
    } else {
        int spec2len, len;
        spec2len = strlen(filespec2);
        len = spec2len + strlen(filespec1);
        if (spec2len && filespec2[spec2len - 1] == '/') {
            spec2len--;
            len--;
        }
        merged = OPENSSL_malloc(len + 2);
        if (merged == NULL) {
            DSOerr(DSO_F_DLFCN_MERGER, ERR_R_MALLOC_FAILURE);
            return NULL;
        }
        strcpy(merged, filespec2);
        merged[spec2len] = '/';
        strcpy(&merged[spec2len + 1], filespec1);
    }
    return merged;
}
["static char *dlfcn_merger(DSO *dso, const char *filespec1,\n                          const char *filespec2)\n{\n    char *merged;\n    if (!filespec1 && !filespec2) {\n        DSOerr(DSO_F_DLFCN_MERGER, ERR_R_PASSED_NULL_PARAMETER);\n        return NULL;\n    }\n    if (!filespec2 || (filespec1 != NULL && filespec1[0] == '/')) {\n        merged = OPENSSL_strdup(filespec1);\n        if (merged == NULL) {\n            DSOerr(DSO_F_DLFCN_MERGER, ERR_R_MALLOC_FAILURE);\n            return NULL;\n        }\n    }\n    else if (!filespec1) {\n        merged = OPENSSL_strdup(filespec2);\n        if (merged == NULL) {\n            DSOerr(DSO_F_DLFCN_MERGER, ERR_R_MALLOC_FAILURE);\n            return NULL;\n        }\n    } else {\n        int spec2len, len;\n        spec2len = strlen(filespec2);\n        len = spec2len + strlen(filespec1);\n        if (spec2len && filespec2[spec2len - 1] == '/') {\n            spec2len--;\n            len--;\n        }\n        merged = OPENSSL_malloc(len + 2);\n        if (merged == NULL) {\n            DSOerr(DSO_F_DLFCN_MERGER, ERR_R_MALLOC_FAILURE);\n            return NULL;\n        }\n        strcpy(merged, filespec2);\n        merged[spec2len] = '/';\n        strcpy(&merged[spec2len + 1], filespec1);\n    }\n    return merged;\n}"]