crypto/conf/conf_def.c:297: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, 2147483644] by call to `clear_comments`.
Showing all 11 steps of the trace


crypto/conf/conf_def.c:246:14: Call
244.       again = 0;
245.       for (;;) {
246.           if (!BUF_MEM_grow(buff, bufnum + CONFBUFSIZE)) {
                    ^
247.               CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_BUF_LIB);
248.               goto err;

crypto/buffer/buffer.c:122:1: Parameter `*str->data`
  120.   }
  121.   
  122. > size_t BUF_MEM_grow(BUF_MEM *str, size_t len)
  123.   {
  124.       char *ret;

crypto/conf/conf_def.c:295:9: Assignment
293.               continue;
294.           bufnum = 0;
295.           buf = buff->data;
               ^
296.   
297.           clear_comments(conf, buf);

crypto/conf/conf_def.c:297:9: Call
295.           buf = buff->data;
296.   
297.           clear_comments(conf, buf);
               ^
298.           s = eat_ws(conf, buf);
299.           if (IS_EOF(conf, *s))

crypto/conf/conf_def.c:413:1: Parameter `*p`
  411.   }
  412.   
  413. > static void clear_comments(CONF *conf, char *p)
  414.   {
  415.       for (;;) {

crypto/conf/conf_def.c:436:17: Call
  434.           }
  435.           if (IS_QUOTE(conf, *p)) {
  436.               p = scan_quote(conf, p);
                         ^
  437.               continue;
  438.           }

crypto/conf/conf_def.c:617:1: <Length trace>
615.   }
616.   
617. > static char *scan_quote(CONF *conf, char *p)
618.   {
619.       int q = *p;

crypto/conf/conf_def.c:617:1: Parameter `*p`
    615.   }
    616.   
    617. > static char *scan_quote(CONF *conf, char *p)
    618.   {
    619.       int q = *p;

crypto/conf/conf_def.c:621:5: Assignment
    619.       int q = *p;
    620.   
    621.       p++;
               ^
    622.       while (!(IS_EOF(conf, *p)) && (*p != q)) {
    623.           if (IS_ESC(conf, *p)) {

crypto/conf/conf_def.c:624:13: Assignment
    622.       while (!(IS_EOF(conf, *p)) && (*p != q)) {
    623.           if (IS_ESC(conf, *p)) {
    624.               p++;
                       ^
    625.               if (IS_EOF(conf, *p))
    626.                   return (p);

crypto/conf/conf_def.c:625:17: Array access: Offset: [2, +oo] Size: [1, 2147483644] by call to `clear_comments` 
    623.           if (IS_ESC(conf, *p)) {
    624.               p++;
    625.               if (IS_EOF(conf, *p))
                           ^
    626.                   return (p);
    627.           }

static char *scan_quote(CONF *conf, char *p)
{
    int q = *p;
    p++;
    while (!(IS_EOF(conf, *p)) && (*p != q)) {
        if (IS_ESC(conf, *p)) {
            p++;
            if (IS_EOF(conf, *p))
                return (p);
        }
        p++;
    }
    if (*p == q)
        p++;
    return (p);
}
['static int def_load_bio(CONF *conf, BIO *in, long *line)\n{\n#define CONFBUFSIZE     512\n    int bufnum = 0, i, ii;\n    BUF_MEM *buff = NULL;\n    char *s, *p, *end;\n    int again;\n    long eline = 0;\n    char btmp[DECIMAL_SIZE(eline) + 1];\n    CONF_VALUE *v = NULL, *tv;\n    CONF_VALUE *sv = NULL;\n    char *section = NULL, *buf;\n    char *start, *psection, *pname;\n    void *h = (void *)(conf->data);\n    if ((buff = BUF_MEM_new()) == NULL) {\n        CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_BUF_LIB);\n        goto err;\n    }\n    section = OPENSSL_strdup("default");\n    if (section == NULL) {\n        CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    if (_CONF_new_data(conf) == 0) {\n        CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    sv = _CONF_new_section(conf, section);\n    if (sv == NULL) {\n        CONFerr(CONF_F_DEF_LOAD_BIO, CONF_R_UNABLE_TO_CREATE_NEW_SECTION);\n        goto err;\n    }\n    bufnum = 0;\n    again = 0;\n    for (;;) {\n        if (!BUF_MEM_grow(buff, bufnum + CONFBUFSIZE)) {\n            CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_BUF_LIB);\n            goto err;\n        }\n        p = &(buff->data[bufnum]);\n        *p = \'\\0\';\n        BIO_gets(in, p, CONFBUFSIZE - 1);\n        p[CONFBUFSIZE - 1] = \'\\0\';\n        ii = i = strlen(p);\n        if (i == 0 && !again)\n            break;\n        again = 0;\n        while (i > 0) {\n            if ((p[i - 1] != \'\\r\') && (p[i - 1] != \'\\n\'))\n                break;\n            else\n                i--;\n        }\n        if (ii && i == ii)\n            again = 1;\n        else {\n            p[i] = \'\\0\';\n            eline++;\n        }\n        bufnum += i;\n        v = NULL;\n        if (bufnum >= 1) {\n            p = &(buff->data[bufnum - 1]);\n            if (IS_ESC(conf, p[0]) && ((bufnum <= 1) || !IS_ESC(conf, p[-1]))) {\n                bufnum--;\n                again = 1;\n            }\n        }\n        if (again)\n            continue;\n        bufnum = 0;\n        buf = buff->data;\n        clear_comments(conf, buf);\n        s = eat_ws(conf, buf);\n        if (IS_EOF(conf, *s))\n            continue;\n        if (*s == \'[\') {\n            char *ss;\n            s++;\n            start = eat_ws(conf, s);\n            ss = start;\n again:\n            end = eat_alpha_numeric(conf, ss);\n            p = eat_ws(conf, end);\n            if (*p != \']\') {\n                if (*p != \'\\0\' && ss != p) {\n                    ss = p;\n                    goto again;\n                }\n                CONFerr(CONF_F_DEF_LOAD_BIO,\n                        CONF_R_MISSING_CLOSE_SQUARE_BRACKET);\n                goto err;\n            }\n            *end = \'\\0\';\n            if (!str_copy(conf, NULL, &section, start))\n                goto err;\n            if ((sv = _CONF_get_section(conf, section)) == NULL)\n                sv = _CONF_new_section(conf, section);\n            if (sv == NULL) {\n                CONFerr(CONF_F_DEF_LOAD_BIO,\n                        CONF_R_UNABLE_TO_CREATE_NEW_SECTION);\n                goto err;\n            }\n            continue;\n        } else {\n            pname = s;\n            psection = NULL;\n            end = eat_alpha_numeric(conf, s);\n            if ((end[0] == \':\') && (end[1] == \':\')) {\n                *end = \'\\0\';\n                end += 2;\n                psection = pname;\n                pname = end;\n                end = eat_alpha_numeric(conf, end);\n            }\n            p = eat_ws(conf, end);\n            if (*p != \'=\') {\n                CONFerr(CONF_F_DEF_LOAD_BIO, CONF_R_MISSING_EQUAL_SIGN);\n                goto err;\n            }\n            *end = \'\\0\';\n            p++;\n            start = eat_ws(conf, p);\n            while (!IS_EOF(conf, *p))\n                p++;\n            p--;\n            while ((p != start) && (IS_WS(conf, *p)))\n                p--;\n            p++;\n            *p = \'\\0\';\n            if ((v = OPENSSL_malloc(sizeof(*v))) == NULL) {\n                CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            if (psection == NULL)\n                psection = section;\n            v->name = OPENSSL_malloc(strlen(pname) + 1);\n            v->value = NULL;\n            if (v->name == NULL) {\n                CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            OPENSSL_strlcpy(v->name, pname, strlen(pname) + 1);\n            if (!str_copy(conf, psection, &(v->value), start))\n                goto err;\n            if (strcmp(psection, section) != 0) {\n                if ((tv = _CONF_get_section(conf, psection))\n                    == NULL)\n                    tv = _CONF_new_section(conf, psection);\n                if (tv == NULL) {\n                    CONFerr(CONF_F_DEF_LOAD_BIO,\n                            CONF_R_UNABLE_TO_CREATE_NEW_SECTION);\n                    goto err;\n                }\n            } else\n                tv = sv;\n            if (_CONF_add_string(conf, tv, v) == 0) {\n                CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            v = NULL;\n        }\n    }\n    BUF_MEM_free(buff);\n    OPENSSL_free(section);\n    return (1);\n err:\n    BUF_MEM_free(buff);\n    OPENSSL_free(section);\n    if (line != NULL)\n        *line = eline;\n    BIO_snprintf(btmp, sizeof btmp, "%ld", eline);\n    ERR_add_error_data(2, "line ", btmp);\n    if (h != conf->data) {\n        CONF_free(conf->data);\n        conf->data = NULL;\n    }\n    if (v != NULL) {\n        OPENSSL_free(v->name);\n        OPENSSL_free(v->value);\n        OPENSSL_free(v);\n    }\n    return (0);\n}', 'size_t BUF_MEM_grow(BUF_MEM *str, size_t len)\n{\n    char *ret;\n    size_t n;\n    if (str->length >= len) {\n        str->length = len;\n        return (len);\n    }\n    if (str->max >= len) {\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n        return (len);\n    }\n    if (len > LIMIT_BEFORE_EXPANSION) {\n        BUFerr(BUF_F_BUF_MEM_GROW, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    n = (len + 3) / 3 * 4;\n    if ((str->flags & BUF_MEM_FLAG_SECURE))\n        ret = sec_alloc_realloc(str, n);\n    else\n        ret = OPENSSL_realloc(str->data, n);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_MEM_GROW, ERR_R_MALLOC_FAILURE);\n        len = 0;\n    } else {\n        str->data = ret;\n        str->max = n;\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n    }\n    return (len);\n}', "static void clear_comments(CONF *conf, char *p)\n{\n    for (;;) {\n        if (IS_FCOMMENT(conf, *p)) {\n            *p = '\\0';\n            return;\n        }\n        if (!IS_WS(conf, *p)) {\n            break;\n        }\n        p++;\n    }\n    for (;;) {\n        if (IS_COMMENT(conf, *p)) {\n            *p = '\\0';\n            return;\n        }\n        if (IS_DQUOTE(conf, *p)) {\n            p = scan_dquote(conf, p);\n            continue;\n        }\n        if (IS_QUOTE(conf, *p)) {\n            p = scan_quote(conf, p);\n            continue;\n        }\n        if (IS_ESC(conf, *p)) {\n            p = scan_esc(conf, p);\n            continue;\n        }\n        if (IS_EOF(conf, *p))\n            return;\n        else\n            p++;\n    }\n}", 'static char *scan_quote(CONF *conf, char *p)\n{\n    int q = *p;\n    p++;\n    while (!(IS_EOF(conf, *p)) && (*p != q)) {\n        if (IS_ESC(conf, *p)) {\n            p++;\n            if (IS_EOF(conf, *p))\n                return (p);\n        }\n        p++;\n    }\n    if (*p == q)\n        p++;\n    return (p);\n}']