crypto/err/err.c:397: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `lh_delete`.
Showing all 18 steps of the trace


crypto/err/err.c:395:12: Call
393.   
394.       CRYPTO_w_lock(CRYPTO_LOCK_ERR);
395.       hash = int_thread_get(0, 0);
                  ^
396.       if (hash) {
397.           p = lh_ERR_STATE_delete(hash, d);

crypto/err/err.c:325:27: Call
  323.           CRYPTO_w_lock(CRYPTO_LOCK_ERR);
  324.       if (!int_thread_hash && create) {
  325.           int_thread_hash = lh_ERR_STATE_new();
                                   ^
  326.       }
  327.       if (int_thread_hash != NULL) {

crypto/lhash/lhash.c:119:19: Call
    117.       if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL)
    118.           goto err0;
    119.       if ((ret->b = OPENSSL_zalloc(sizeof(*ret->b) * MIN_NODES)) == NULL)
                             ^
    120.           goto err1;
    121.       ret->comp = ((c == NULL) ? (LHASH_COMP_FN_TYPE)strcmp : c);

crypto/mem.c:157:1: Parameter `num`
      155.   }
      156.   
      157. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
      158.   {
      159.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:159:17: Call
      157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
      158.   {
      159.       void *ret = CRYPTO_malloc(num, file, line);
                             ^
      160.   
      161.       if (ret != NULL)

crypto/mem.c:125:9: Assignment
        123.   
        124.       if (num <= 0)
        125.           return NULL;
                       ^
        126.   
        127.       allow_customize = 0;

crypto/mem.c:159:5: Assignment
      157.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
      158.   {
      159.       void *ret = CRYPTO_malloc(num, file, line);
                 ^
      160.   
      161.       if (ret != NULL)

crypto/mem.c:163:5: Assignment
      161.       if (ret != NULL)
      162.           memset(ret, 0, num);
      163.       return ret;
                 ^
      164.   }
      165.   

crypto/lhash/lhash.c:119:10: Assignment
    117.       if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL)
    118.           goto err0;
    119.       if ((ret->b = OPENSSL_zalloc(sizeof(*ret->b) * MIN_NODES)) == NULL)
                    ^
    120.           goto err1;
    121.       ret->comp = ((c == NULL) ? (LHASH_COMP_FN_TYPE)strcmp : c);

crypto/err/err.c:397:13: Call
395.       hash = int_thread_get(0, 0);
396.       if (hash) {
397.           p = lh_ERR_STATE_delete(hash, d);
                   ^
398.           /* If there are no other references, and we just removed the
399.            * last item, delete the int_thread_hash */

crypto/lhash/lhash.c:189:1: Parameter `*lh->b`
  187.   }
  188.   
  189. > void *lh_delete(_LHASH *lh, const void *data)
  190.   {
  191.       unsigned long hash;

crypto/lhash/lhash.c:212:9: Call
  210.       if ((lh->num_nodes > MIN_NODES) &&
  211.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
  212.           contract(lh);
                 ^
  213.   
  214.       return (ret);

crypto/lhash/lhash.c:323:1: <Offset trace>
321.   }
322.   
323. > static void contract(_LHASH *lh)
324.   {
325.       LHASH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:323:1: Parameter `lh->p`
    321.   }
    322.   
    323. > static void contract(_LHASH *lh)
    324.   {
    325.       LHASH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:343:9: Assignment
    341.           lh->b = n;
    342.       } else
    343.           lh->p--;
                   ^
    344.   
    345.       lh->num_nodes--;

crypto/lhash/lhash.c:323:1: <Length trace>
321.   }
322.   
323. > static void contract(_LHASH *lh)
324.   {
325.       LHASH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:323:1: Parameter `*lh->b`
    321.   }
    322.   
    323. > static void contract(_LHASH *lh)
    324.   {
    325.       LHASH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:348:10: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `lh_delete` 
    346.       lh->num_contracts++;
    347.   
    348.       n1 = lh->b[(int)lh->p];
                    ^
    349.       if (n1 == NULL)
    350.           lh->b[(int)lh->p] = np;

static void contract(_LHASH *lh)
{
    LHASH_NODE **n, *n1, *np;
    np = lh->b[lh->p + lh->pmax - 1];
    lh->b[lh->p + lh->pmax - 1] = NULL;
    if (lh->p == 0) {
        n = OPENSSL_realloc(lh->b,
                            (unsigned int)(sizeof(LHASH_NODE *) * lh->pmax));
        if (n == NULL) {
            lh->error++;
            return;
        }
        lh->num_contract_reallocs++;
        lh->num_alloc_nodes /= 2;
        lh->pmax /= 2;
        lh->p = lh->pmax - 1;
        lh->b = n;
    } else
        lh->p--;
    lh->num_nodes--;
    lh->num_contracts++;
    n1 = lh->b[(int)lh->p];
    if (n1 == NULL)
        lh->b[(int)lh->p] = np;
    else {
        while (n1->next != NULL)
            n1 = n1->next;
        n1->next = np;
    }
}
['static void int_thread_del_item(const ERR_STATE *d)\n{\n    ERR_STATE *p = NULL;\n    LHASH_OF(ERR_STATE) *hash;\n    CRYPTO_w_lock(CRYPTO_LOCK_ERR);\n    hash = int_thread_get(0, 0);\n    if (hash) {\n        p = lh_ERR_STATE_delete(hash, d);\n        if (int_thread_hash_references == 1\n            && int_thread_hash\n            && lh_ERR_STATE_num_items(int_thread_hash) == 0) {\n            int_thread_hash_references = 0;\n            lh_ERR_STATE_free(int_thread_hash);\n            int_thread_hash = NULL;\n            hash = NULL;\n        }\n    }\n    CRYPTO_w_unlock(CRYPTO_LOCK_ERR);\n    int_thread_release(&hash);\n    ERR_STATE_free(p);\n}', 'static LHASH_OF(ERR_STATE) *int_thread_get(int create, int lockit)\n{\n    LHASH_OF(ERR_STATE) *ret = NULL;\n    if (lockit)\n        CRYPTO_w_lock(CRYPTO_LOCK_ERR);\n    if (!int_thread_hash && create) {\n        int_thread_hash = lh_ERR_STATE_new();\n    }\n    if (int_thread_hash != NULL) {\n        int_thread_hash_references++;\n        ret = int_thread_hash;\n    }\n    if (lockit)\n        CRYPTO_w_unlock(CRYPTO_LOCK_ERR);\n    return ret;\n}', '_LHASH *lh_new(LHASH_HASH_FN_TYPE h, LHASH_COMP_FN_TYPE c)\n{\n    _LHASH *ret;\n    if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL)\n        goto err0;\n    if ((ret->b = OPENSSL_zalloc(sizeof(*ret->b) * MIN_NODES)) == NULL)\n        goto err1;\n    ret->comp = ((c == NULL) ? (LHASH_COMP_FN_TYPE)strcmp : c);\n    ret->hash = ((h == NULL) ? (LHASH_HASH_FN_TYPE)lh_strhash : h);\n    ret->num_nodes = MIN_NODES / 2;\n    ret->num_alloc_nodes = MIN_NODES;\n    ret->pmax = MIN_NODES / 2;\n    ret->up_load = UP_LOAD;\n    ret->down_load = DOWN_LOAD;\n    return (ret);\n err1:\n    OPENSSL_free(ret);\n err0:\n    return (NULL);\n}', 'void *CRYPTO_zalloc(size_t num, const char *file, int line)\n{\n    void *ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL)\n        memset(ret, 0, num);\n    return ret;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifdef CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}', 'void *lh_delete(_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    LHASH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        lh->num_no_delete++;\n        return (NULL);\n    } else {\n        nn = *rn;\n        *rn = nn->next;\n        ret = nn->data;\n        OPENSSL_free(nn);\n        lh->num_delete++;\n    }\n    lh->num_items--;\n    if ((lh->num_nodes > MIN_NODES) &&\n        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))\n        contract(lh);\n    return (ret);\n}', 'static void contract(_LHASH *lh)\n{\n    LHASH_NODE **n, *n1, *np;\n    np = lh->b[lh->p + lh->pmax - 1];\n    lh->b[lh->p + lh->pmax - 1] = NULL;\n    if (lh->p == 0) {\n        n = OPENSSL_realloc(lh->b,\n                            (unsigned int)(sizeof(LHASH_NODE *) * lh->pmax));\n        if (n == NULL) {\n            lh->error++;\n            return;\n        }\n        lh->num_contract_reallocs++;\n        lh->num_alloc_nodes /= 2;\n        lh->pmax /= 2;\n        lh->p = lh->pmax - 1;\n        lh->b = n;\n    } else\n        lh->p--;\n    lh->num_nodes--;\n    lh->num_contracts++;\n    n1 = lh->b[(int)lh->p];\n    if (n1 == NULL)\n        lh->b[(int)lh->p] = np;\n    else {\n        while (n1->next != NULL)\n            n1 = n1->next;\n        n1->next = np;\n    }\n}']