crypto/bio/bss_conn.c:476: error: BUFFER_OVERRUN_L2
  Offset added: [0, 2147483646] Size: 104 by call to `BUF_strdup`.
Showing all 12 steps of the trace


crypto/bio/bss_conn.c:402:1: Array declaration
400.   }
401.   
402. > static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
403.   {
404.       BIO *dbio;

crypto/bio/bss_conn.c:476:36: Call
474.                   BIO_snprintf(buf, sizeof buf, "%d", *(int *)ptr);
475.                   OPENSSL_free(data->param_port);
476.                   data->param_port = BUF_strdup(buf);
                                          ^
477.                   data->port = *(int *)ptr;
478.               }

crypto/buffer/buf_str.c:73:1: Parameter `*str`
  71.   }
  72.   
  73. > char *BUF_strdup(const char *str)
  74.   {
  75.       if (str == NULL)

crypto/buffer/buf_str.c:77:12: Call
  75.       if (str == NULL)
  76.           return NULL;
  77.       return BUF_strndup(str, strlen(str));
                   ^
  78.   }
  79.   

crypto/buffer/buf_str.c:87:11: <Offset trace>
85.           return NULL;
86.   
87.       siz = BUF_strnlen(str, siz);
                ^
88.   
89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:87:11: Call
    85.           return NULL;
    86.   
    87.       siz = BUF_strnlen(str, siz);
                    ^
    88.   
    89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:64:1: Parameter `*str`
      62.   #include <openssl/buffer.h>
      63.   
      64. > size_t BUF_strnlen(const char *str, size_t maxlen)
      65.   {
      66.       const char *p;

crypto/buffer/buf_str.c:70:5: Assignment
      68.       for (p = str; maxlen-- != 0 && *p != '\0'; ++p) ;
      69.   
      70.       return p - str;
                ^
      71.   }
      72.   

crypto/buffer/buf_str.c:87:5: Assignment
    85.           return NULL;
    86.   
    87.       siz = BUF_strnlen(str, siz);
              ^
    88.   
    89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:80:1: <Length trace>
78.   }
79.   
80. > char *BUF_strndup(const char *str, size_t siz)
81.   {
82.       char *ret;

crypto/buffer/buf_str.c:80:1: Parameter `*str`
    78.   }
    79.   
    80. > char *BUF_strndup(const char *str, size_t siz)
    81.   {
    82.       char *ret;

crypto/buffer/buf_str.c:98:5: Array access: Offset added: [0, 2147483646] Size: 104 by call to `BUF_strdup` 
    96.       }
    97.   
    98.       memcpy(ret, str, siz);
               ^
    99.       ret[siz] = '\0';
    100.   

char *BUF_strndup(const char *str, size_t siz)
{
    char *ret;
    if (str == NULL)
        return NULL;
    siz = BUF_strnlen(str, siz);
    if (siz >= INT_MAX)
        return NULL;
    ret = OPENSSL_malloc(siz + 1);
    if (ret == NULL) {
        BUFerr(BUF_F_BUF_STRNDUP, ERR_R_MALLOC_FAILURE);
        return NULL;
    }
    memcpy(ret, str, siz);
    ret[siz] = '\0';
    return (ret);
}
['static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)\n{\n    BIO *dbio;\n    int *ip;\n    const char **pptr = NULL;\n    long ret = 1;\n    BIO_CONNECT *data;\n    data = (BIO_CONNECT *)b->ptr;\n    switch (cmd) {\n    case BIO_CTRL_RESET:\n        ret = 0;\n        data->state = BIO_CONN_S_BEFORE;\n        conn_close_socket(b);\n        b->flags = 0;\n        break;\n    case BIO_C_DO_STATE_MACHINE:\n        if (data->state != BIO_CONN_S_OK)\n            ret = (long)conn_state(b, data);\n        else\n            ret = 1;\n        break;\n    case BIO_C_GET_CONNECT:\n        if (ptr != NULL) {\n            pptr = (const char **)ptr;\n        }\n        if (b->init) {\n            if (pptr != NULL) {\n                ret = 1;\n                if (num == 0) {\n                    *pptr = data->param_hostname;\n                } else if (num == 1) {\n                    *pptr = data->param_port;\n                } else if (num == 2) {\n                    *pptr = (char *)&(data->ip[0]);\n                } else {\n                    ret = 0;\n                }\n            }\n            if (num == 3) {\n                ret = data->port;\n            }\n        } else {\n            if (pptr != NULL)\n                *pptr = "not initialized";\n            ret = 0;\n        }\n        break;\n    case BIO_C_SET_CONNECT:\n        if (ptr != NULL) {\n            b->init = 1;\n            if (num == 0) {\n                OPENSSL_free(data->param_hostname);\n                data->param_hostname = BUF_strdup(ptr);\n            } else if (num == 1) {\n                OPENSSL_free(data->param_port);\n                data->param_port = BUF_strdup(ptr);\n            } else if (num == 2) {\n                char buf[16];\n                unsigned char *p = ptr;\n                BIO_snprintf(buf, sizeof buf, "%d.%d.%d.%d",\n                             p[0], p[1], p[2], p[3]);\n                OPENSSL_free(data->param_hostname);\n                data->param_hostname = BUF_strdup(buf);\n                memcpy(&(data->ip[0]), ptr, 4);\n            } else if (num == 3) {\n                char buf[DECIMAL_SIZE(int) + 1];\n                BIO_snprintf(buf, sizeof buf, "%d", *(int *)ptr);\n                OPENSSL_free(data->param_port);\n                data->param_port = BUF_strdup(buf);\n                data->port = *(int *)ptr;\n            }\n        }\n        break;\n    case BIO_C_SET_NBIO:\n        data->nbio = (int)num;\n        break;\n    case BIO_C_GET_FD:\n        if (b->init) {\n            ip = (int *)ptr;\n            if (ip != NULL)\n                *ip = b->num;\n            ret = b->num;\n        } else\n            ret = -1;\n        break;\n    case BIO_CTRL_GET_CLOSE:\n        ret = b->shutdown;\n        break;\n    case BIO_CTRL_SET_CLOSE:\n        b->shutdown = (int)num;\n        break;\n    case BIO_CTRL_PENDING:\n    case BIO_CTRL_WPENDING:\n        ret = 0;\n        break;\n    case BIO_CTRL_FLUSH:\n        break;\n    case BIO_CTRL_DUP:\n        {\n            dbio = (BIO *)ptr;\n            if (data->param_port)\n                BIO_set_conn_port(dbio, data->param_port);\n            if (data->param_hostname)\n                BIO_set_conn_hostname(dbio, data->param_hostname);\n            BIO_set_nbio(dbio, data->nbio);\n            (void)BIO_set_info_callback(dbio,\n                                        (bio_info_cb *)data->info_callback);\n        }\n        break;\n    case BIO_CTRL_SET_CALLBACK:\n        {\n# if 0\n            BIOerr(BIO_F_CONN_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);\n            ret = -1;\n# else\n            ret = 0;\n# endif\n        }\n        break;\n    case BIO_CTRL_GET_CALLBACK:\n        {\n            int (**fptr) (const BIO *bio, int state, int xret);\n            fptr = (int (**)(const BIO *bio, int state, int xret))ptr;\n            *fptr = data->info_callback;\n        }\n        break;\n    default:\n        ret = 0;\n        break;\n    }\n    return (ret);\n}', 'char *BUF_strdup(const char *str)\n{\n    if (str == NULL)\n        return NULL;\n    return BUF_strndup(str, strlen(str));\n}', "char *BUF_strndup(const char *str, size_t siz)\n{\n    char *ret;\n    if (str == NULL)\n        return NULL;\n    siz = BUF_strnlen(str, siz);\n    if (siz >= INT_MAX)\n        return NULL;\n    ret = OPENSSL_malloc(siz + 1);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_STRNDUP, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    memcpy(ret, str, siz);\n    ret[siz] = '\\0';\n    return (ret);\n}", "size_t BUF_strnlen(const char *str, size_t maxlen)\n{\n    const char *p;\n    for (p = str; maxlen-- != 0 && *p != '\\0'; ++p) ;\n    return p - str;\n}"]