apps/srp.c:503: error: BUFFER_OVERRUN_L3
  Offset: [16, +oo] Size: [1, +oo] by call to `update_index`.
Showing all 29 steps of the trace


apps/srp.c:481:22: Call
479.                   if (!
480.                       (gNid =
481.                        srp_create_user(user, &(row[DB_srpverifier]),
                            ^
482.                                        &(row[DB_srpsalt]),
483.                                        gNrow ? gNrow[DB_srpsalt] : gN,

apps/srp.c:215:14: Call
  213.           if (!
  214.               (gNid =
  215.                SRP_create_verifier(user, password, &salt, srp_verifier, N,
                      ^
  216.                                    g))) {
  217.               BIO_printf(bio_err, "Internal error creating SRP verifier\n");

crypto/srp/srp_vfy.c:613:10: Call
    611.       }
    612.   
    613.       if (!SRP_create_verifier_BN(user, pass, &s, &v, N_bn, g_bn))
                    ^
    614.           goto err;
    615.   

crypto/srp/srp_vfy.c:681:9: Call
      679.       }
      680.   
      681.       x = SRP_Calc_x(salttmp, user, pass);
                     ^
      682.   
      683.       *verifier = BN_new();

crypto/srp/srp_lib.c:221:5: Call
        219.           goto err;
        220.   
        221.       EVP_DigestInit_ex(ctxt, EVP_sha1(), NULL);
                   ^
        222.       EVP_DigestUpdate(ctxt, user, strlen(user));
        223.       EVP_DigestUpdate(ctxt, ":", 1);

crypto/evp/digest.c:193:20: Call
          191.           } else {
          192.               /* Ask if an ENGINE is reserved for this job */
          193.               impl = ENGINE_get_digest_engine(type->type);
                                    ^
          194.           }
          195.           if (impl != NULL) {

crypto/engine/tb_digest.c:110:12: Call
            108.   ENGINE *ENGINE_get_digest_engine(int nid)
            109.   {
            110.       return engine_table_select(&digest_table, nid);
                              ^
            111.   }
            112.   

crypto/engine/eng_table.c:256:10: Call
              254.        * operations. But don't worry about a fprintf(stderr).
              255.        */
              256.       if (!int_table_check(table, 0))
                              ^
              257.           goto end;
              258.       tmplate.nid = nid;

crypto/engine/eng_table.c:117:15: Call
                115.       if (!create)
                116.           return 0;
                117.       if ((lh = lh_ENGINE_PILE_new(engine_pile_hash, engine_pile_cmp)) == NULL)
                                     ^
                118.           return 0;
                119.       *t = (ENGINE_TABLE *)lh;

crypto/engine/eng_int.h:218:1: Call
                  216.   typedef struct st_engine_pile ENGINE_PILE;
                  217.   
                  218. > DEFINE_LHASH_OF(ENGINE_PILE);
                  219.   
                  220.   #ifdef  __cplusplus

crypto/lhash/lhash.c:123:5: Assignment
                    121.       ret->hash = ((h == NULL) ? (LHASH_HASH_FN_TYPE)lh_strhash : h);
                    122.       ret->num_nodes = MIN_NODES / 2;
                    123.       ret->num_alloc_nodes = MIN_NODES;
                               ^
                    124.       ret->pmax = MIN_NODES / 2;
                    125.       ret->up_load = UP_LOAD;

apps/srp.c:503:25: Call
501.                       || (userinfo
502.                           && ((row[DB_srpinfo] = OPENSSL_strdup(userinfo)) == NULL))
503.                       || !update_index(db, row)) {
                               ^
504.                       OPENSSL_free(row[DB_srpid]);
505.                       OPENSSL_free(row[DB_srpgN]);

apps/srp.c:138:1: Parameter `(*db->db->index)->num_alloc_nodes`
  136.   }
  137.   
  138. > static int update_index(CA_DB *db, char **row)
  139.   {
  140.       char **irow;

apps/srp.c:150:10: Call
  148.       irow[DB_NUMBER] = NULL;
  149.   
  150.       if (!TXT_DB_insert(db->db, irow)) {
                  ^
  151.           BIO_printf(bio_err, "failed to update srpvfile\n");
  152.           BIO_printf(bio_err, "TXT_DB error number %ld\n", db->db->error);

crypto/txt_db/txt_db.c:277:1: Parameter `(*db->index)->num_alloc_nodes`
    275.   }
    276.   
    277. > int TXT_DB_insert(TXT_DB *db, OPENSSL_STRING *row)
    278.   {
    279.       int i;

crypto/txt_db/txt_db.c:305:19: Call
    303.               if ((db->qual[i] != NULL) && (db->qual[i] (row) == 0))
    304.                   continue;
    305.               (void)lh_OPENSSL_STRING_insert(db->index[i], row);
                             ^
    306.           }
    307.       }

include/openssl/lhash.h:269:1: Parameter `lh->num_alloc_nodes`
      267.     lh_doall_arg(CHECKED_LHASH_OF(type, lh), fn, CHECKED_PTR_OF(arg_type, arg))
      268.   
      269. > DEFINE_LHASH_OF(OPENSSL_STRING);
      270.   DEFINE_LHASH_OF(OPENSSL_CSTRING);
      271.   

include/openssl/lhash.h:269:1: Call
      267.     lh_doall_arg(CHECKED_LHASH_OF(type, lh), fn, CHECKED_PTR_OF(arg_type, arg))
      268.   
      269. > DEFINE_LHASH_OF(OPENSSL_STRING);
      270.   DEFINE_LHASH_OF(OPENSSL_CSTRING);
      271.   

crypto/lhash/lhash.c:155:1: Parameter `lh->num_alloc_nodes`
        153.   }
        154.   
        155. > void *lh_insert(_LHASH *lh, void *data)
        156.   {
        157.       unsigned long hash;

crypto/lhash/lhash.c:163:9: Call
        161.       lh->error = 0;
        162.       if (lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes))
        163.           expand(lh);
                       ^
        164.   
        165.       rn = getrn(lh, data, &hash);

crypto/lhash/lhash.c:278:1: <Offset trace>
276.   }
277.   
278. > static void expand(_LHASH *lh)
279.   {
280.       LHASH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:278:1: Parameter `lh->num_alloc_nodes`
          276.   }
          277.   
          278. > static void expand(_LHASH *lh)
          279.   {
          280.       LHASH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:304:9: Assignment
          302.   
          303.       if ((lh->p) >= lh->pmax) {
          304.           j = (int)lh->num_alloc_nodes * 2;
                         ^
          305.           n = OPENSSL_realloc(lh->b, (int)(sizeof(LHASH_NODE *) * j));
          306.           if (n == NULL) {

crypto/lhash/lhash.c:278:1: <Length trace>
276.   }
277.   
278. > static void expand(_LHASH *lh)
279.   {
280.       LHASH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:278:1: Parameter `*lh->b`
          276.   }
          277.   
          278. > static void expand(_LHASH *lh)
          279.   {
          280.       LHASH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:305:13: Call
          303.       if ((lh->p) >= lh->pmax) {
          304.           j = (int)lh->num_alloc_nodes * 2;
          305.           n = OPENSSL_realloc(lh->b, (int)(sizeof(LHASH_NODE *) * j));
                             ^
          306.           if (n == NULL) {
          307.               /* fputs("realloc error in lhash",stderr); */

crypto/mem.c:165:9: Assignment
            163.       if (num == 0) {
            164.           CRYPTO_free(str, file, line);
            165.           return NULL;
                           ^
            166.       }
            167.   

crypto/lhash/lhash.c:305:9: Assignment
          303.       if ((lh->p) >= lh->pmax) {
          304.           j = (int)lh->num_alloc_nodes * 2;
          305.           n = OPENSSL_realloc(lh->b, (int)(sizeof(LHASH_NODE *) * j));
                         ^
          306.           if (n == NULL) {
          307.               /* fputs("realloc error in lhash",stderr); */

crypto/lhash/lhash.c:313:13: Array access: Offset: [16, +oo] Size: [1, +oo] by call to `update_index` 
          311.           }
          312.           for (i = (int)lh->num_alloc_nodes; i < j; i++) /* 26/02/92 eay */
          313.               n[i] = NULL;        /* 02/03/92 eay */
                             ^
          314.           lh->pmax = lh->num_alloc_nodes;
          315.           lh->num_alloc_nodes = j;

static void expand(_LHASH *lh)
{
    LHASH_NODE **n, **n1, **n2, *np;
    unsigned int p, i, j;
    unsigned long hash, nni;
    lh->num_nodes++;
    lh->num_expands++;
    p = (int)lh->p++;
    n1 = &(lh->b[p]);
    n2 = &(lh->b[p + (int)lh->pmax]);
    *n2 = NULL;
    nni = lh->num_alloc_nodes;
    for (np = *n1; np != NULL;) {
        hash = np->hash;
        if ((hash % nni) != p) {
            *n1 = (*n1)->next;
            np->next = *n2;
            *n2 = np;
        } else
            n1 = &((*n1)->next);
        np = *n1;
    }
    if ((lh->p) >= lh->pmax) {
        j = (int)lh->num_alloc_nodes * 2;
        n = OPENSSL_realloc(lh->b, (int)(sizeof(LHASH_NODE *) * j));
        if (n == NULL) {
            lh->error++;
            lh->p = 0;
            return;
        }
        for (i = (int)lh->num_alloc_nodes; i < j; i++)
            n[i] = NULL;
        lh->pmax = lh->num_alloc_nodes;
        lh->num_alloc_nodes = j;
        lh->num_expand_reallocs++;
        lh->p = 0;
        lh->b = n;
    }
}
['char *SRP_create_verifier(const char *user, const char *pass, char **salt,\n                          char **verifier, const char *N, const char *g)\n{\n    int len;\n    char *result = NULL, *vf = NULL;\n    BIGNUM *N_bn = NULL, *g_bn = NULL, *s = NULL, *v = NULL;\n    unsigned char tmp[MAX_LEN];\n    unsigned char tmp2[MAX_LEN];\n    char *defgNid = NULL;\n    int vfsize = 0;\n    if ((user == NULL) ||\n        (pass == NULL) || (salt == NULL) || (verifier == NULL))\n        goto err;\n    if (N) {\n        if ((len = t_fromb64(tmp, N)) == 0)\n            goto err;\n        N_bn = BN_bin2bn(tmp, len, NULL);\n        if ((len = t_fromb64(tmp, g)) == 0)\n            goto err;\n        g_bn = BN_bin2bn(tmp, len, NULL);\n        defgNid = "*";\n    } else {\n        SRP_gN *gN = SRP_get_gN_by_id(g, NULL);\n        if (gN == NULL)\n            goto err;\n        N_bn = gN->N;\n        g_bn = gN->g;\n        defgNid = gN->id;\n    }\n    if (*salt == NULL) {\n        if (RAND_bytes(tmp2, SRP_RANDOM_SALT_LEN) <= 0)\n            goto err;\n        s = BN_bin2bn(tmp2, SRP_RANDOM_SALT_LEN, NULL);\n    } else {\n        if ((len = t_fromb64(tmp2, *salt)) == 0)\n            goto err;\n        s = BN_bin2bn(tmp2, len, NULL);\n    }\n    if (!SRP_create_verifier_BN(user, pass, &s, &v, N_bn, g_bn))\n        goto err;\n    BN_bn2bin(v, tmp);\n    vfsize = BN_num_bytes(v) * 2;\n    if (((vf = OPENSSL_malloc(vfsize)) == NULL))\n        goto err;\n    t_tob64(vf, tmp, BN_num_bytes(v));\n    if (*salt == NULL) {\n        char *tmp_salt;\n        if ((tmp_salt = OPENSSL_malloc(SRP_RANDOM_SALT_LEN * 2)) == NULL) {\n            goto err;\n        }\n        t_tob64(tmp_salt, tmp2, SRP_RANDOM_SALT_LEN);\n        *salt = tmp_salt;\n    }\n    *verifier = vf;\n    vf = NULL;\n    result = defgNid;\n err:\n    if (N) {\n        BN_free(N_bn);\n        BN_free(g_bn);\n    }\n    OPENSSL_clear_free(vf, vfsize);\n    BN_clear_free(s);\n    BN_clear_free(v);\n    return result;\n}', 'int SRP_create_verifier_BN(const char *user, const char *pass, BIGNUM **salt,\n                           BIGNUM **verifier, const BIGNUM *N,\n                           const BIGNUM *g)\n{\n    int result = 0;\n    BIGNUM *x = NULL;\n    BN_CTX *bn_ctx = BN_CTX_new();\n    unsigned char tmp2[MAX_LEN];\n    BIGNUM *salttmp = NULL;\n    if ((user == NULL) ||\n        (pass == NULL) ||\n        (salt == NULL) ||\n        (verifier == NULL) || (N == NULL) || (g == NULL) || (bn_ctx == NULL))\n        goto err;\n    if (*salt == NULL) {\n        if (RAND_bytes(tmp2, SRP_RANDOM_SALT_LEN) <= 0)\n            goto err;\n        salttmp = BN_bin2bn(tmp2, SRP_RANDOM_SALT_LEN, NULL);\n    } else {\n        salttmp = *salt;\n    }\n    x = SRP_Calc_x(salttmp, user, pass);\n    *verifier = BN_new();\n    if (*verifier == NULL)\n        goto err;\n    if (!BN_mod_exp(*verifier, g, x, N, bn_ctx)) {\n        BN_clear_free(*verifier);\n        goto err;\n    }\n    result = 1;\n    *salt = salttmp;\n err:\n    if (salt != NULL && *salt != salttmp)\n        BN_clear_free(salttmp);\n    BN_clear_free(x);\n    BN_CTX_free(bn_ctx);\n    return result;\n}', 'BIGNUM *SRP_Calc_x(BIGNUM *s, const char *user, const char *pass)\n{\n    unsigned char dig[SHA_DIGEST_LENGTH];\n    EVP_MD_CTX *ctxt;\n    unsigned char *cs;\n    BIGNUM *res = NULL;\n    if ((s == NULL) || (user == NULL) || (pass == NULL))\n        return NULL;\n    ctxt = EVP_MD_CTX_new();\n    if (ctxt == NULL)\n        return NULL;\n    if ((cs = OPENSSL_malloc(BN_num_bytes(s))) == NULL)\n        goto err;\n    EVP_DigestInit_ex(ctxt, EVP_sha1(), NULL);\n    EVP_DigestUpdate(ctxt, user, strlen(user));\n    EVP_DigestUpdate(ctxt, ":", 1);\n    EVP_DigestUpdate(ctxt, pass, strlen(pass));\n    EVP_DigestFinal_ex(ctxt, dig, NULL);\n    EVP_DigestInit_ex(ctxt, EVP_sha1(), NULL);\n    BN_bn2bin(s, cs);\n    EVP_DigestUpdate(ctxt, cs, BN_num_bytes(s));\n    OPENSSL_free(cs);\n    EVP_DigestUpdate(ctxt, dig, sizeof(dig));\n    EVP_DigestFinal_ex(ctxt, dig, NULL);\n    res = BN_bin2bn(dig, sizeof(dig), NULL);\n err:\n    EVP_MD_CTX_free(ctxt);\n    return res;\n}', 'int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *impl)\n{\n    EVP_MD_CTX_clear_flags(ctx, EVP_MD_CTX_FLAG_CLEANED);\n#ifndef OPENSSL_NO_ENGINE\n    if (ctx->engine && ctx->digest && (!type ||\n                                       (type\n                                        && (type->type ==\n                                            ctx->digest->type))))\n        goto skip_to_init;\n    if (type) {\n        ENGINE_finish(ctx->engine);\n        if (impl != NULL) {\n            if (!ENGINE_init(impl)) {\n                EVPerr(EVP_F_EVP_DIGESTINIT_EX, EVP_R_INITIALIZATION_ERROR);\n                return 0;\n            }\n        } else {\n            impl = ENGINE_get_digest_engine(type->type);\n        }\n        if (impl != NULL) {\n            const EVP_MD *d = ENGINE_get_digest(impl, type->type);\n            if (d == NULL) {\n                EVPerr(EVP_F_EVP_DIGESTINIT_EX, EVP_R_INITIALIZATION_ERROR);\n                ENGINE_finish(impl);\n                return 0;\n            }\n            type = d;\n            ctx->engine = impl;\n        } else\n            ctx->engine = NULL;\n    } else {\n        if (!ctx->digest) {\n            EVPerr(EVP_F_EVP_DIGESTINIT_EX, EVP_R_NO_DIGEST_SET);\n            return 0;\n        }\n        type = ctx->digest;\n    }\n#endif\n    if (ctx->digest != type) {\n        if (ctx->digest && ctx->digest->ctx_size)\n            OPENSSL_free(ctx->md_data);\n        ctx->digest = type;\n        if (!(ctx->flags & EVP_MD_CTX_FLAG_NO_INIT) && type->ctx_size) {\n            ctx->update = type->update;\n            ctx->md_data = OPENSSL_zalloc(type->ctx_size);\n            if (ctx->md_data == NULL) {\n                EVPerr(EVP_F_EVP_DIGESTINIT_EX, ERR_R_MALLOC_FAILURE);\n                return 0;\n            }\n        }\n    }\n#ifndef OPENSSL_NO_ENGINE\n skip_to_init:\n#endif\n    if (ctx->pctx) {\n        int r;\n        r = EVP_PKEY_CTX_ctrl(ctx->pctx, -1, EVP_PKEY_OP_TYPE_SIG,\n                              EVP_PKEY_CTRL_DIGESTINIT, 0, ctx);\n        if (r <= 0 && (r != -2))\n            return 0;\n    }\n    if (ctx->flags & EVP_MD_CTX_FLAG_NO_INIT)\n        return 1;\n    return ctx->digest->init(ctx);\n}', 'ENGINE *ENGINE_get_digest_engine(int nid)\n{\n    return engine_table_select(&digest_table, nid);\n}', 'ENGINE *engine_table_select(ENGINE_TABLE **table, int nid)\n#else\nENGINE *engine_table_select_tmp(ENGINE_TABLE **table, int nid, const char *f,\n                                int l)\n#endif\n{\n    ENGINE *ret = NULL;\n    ENGINE_PILE tmplate, *fnd = NULL;\n    int initres, loop = 0;\n    if (!(*table)) {\n#ifdef ENGINE_TABLE_DEBUG\n        fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, nothing "\n                "registered!\\n", f, l, nid);\n#endif\n        return NULL;\n    }\n    ERR_set_mark();\n    CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);\n    if (!int_table_check(table, 0))\n        goto end;\n    tmplate.nid = nid;\n    fnd = lh_ENGINE_PILE_retrieve(&(*table)->piles, &tmplate);\n    if (!fnd)\n        goto end;\n    if (fnd->funct && engine_unlocked_init(fnd->funct)) {\n#ifdef ENGINE_TABLE_DEBUG\n        fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, using "\n                "ENGINE \'%s\' cached\\n", f, l, nid, fnd->funct->id);\n#endif\n        ret = fnd->funct;\n        goto end;\n    }\n    if (fnd->uptodate) {\n        ret = fnd->funct;\n        goto end;\n    }\n trynext:\n    ret = sk_ENGINE_value(fnd->sk, loop++);\n    if (!ret) {\n#ifdef ENGINE_TABLE_DEBUG\n        fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, no "\n                "registered implementations would initialise\\n", f, l, nid);\n#endif\n        goto end;\n    }\n    if ((ret->funct_ref > 0) || !(table_flags & ENGINE_TABLE_FLAG_NOINIT))\n        initres = engine_unlocked_init(ret);\n    else\n        initres = 0;\n    if (initres) {\n        if ((fnd->funct != ret) && engine_unlocked_init(ret)) {\n            if (fnd->funct)\n                engine_unlocked_finish(fnd->funct, 0);\n            fnd->funct = ret;\n#ifdef ENGINE_TABLE_DEBUG\n            fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, "\n                    "setting default to \'%s\'\\n", f, l, nid, ret->id);\n#endif\n        }\n#ifdef ENGINE_TABLE_DEBUG\n        fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, using "\n                "newly initialised \'%s\'\\n", f, l, nid, ret->id);\n#endif\n        goto end;\n    }\n    goto trynext;\n end:\n    if (fnd)\n        fnd->uptodate = 1;\n#ifdef ENGINE_TABLE_DEBUG\n    if (ret)\n        fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, caching "\n                "ENGINE \'%s\'\\n", f, l, nid, ret->id);\n    else\n        fprintf(stderr, "engine_table_dbg: %s:%d, nid=%d, caching "\n                "\'no matching ENGINE\'\\n", f, l, nid);\n#endif\n    CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);\n    ERR_pop_to_mark();\n    return ret;\n}', 'static int int_table_check(ENGINE_TABLE **t, int create)\n{\n    LHASH_OF(ENGINE_PILE) *lh;\n    if (*t)\n        return 1;\n    if (!create)\n        return 0;\n    if ((lh = lh_ENGINE_PILE_new(engine_pile_hash, engine_pile_cmp)) == NULL)\n        return 0;\n    *t = (ENGINE_TABLE *)lh;\n    return 1;\n}', 'DEFINE_LHASH_OF(ENGINE_PILE)', '_LHASH *lh_new(LHASH_HASH_FN_TYPE h, LHASH_COMP_FN_TYPE c)\n{\n    _LHASH *ret;\n    if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL)\n        goto err0;\n    if ((ret->b = OPENSSL_zalloc(sizeof(*ret->b) * MIN_NODES)) == NULL)\n        goto err1;\n    ret->comp = ((c == NULL) ? (LHASH_COMP_FN_TYPE)strcmp : c);\n    ret->hash = ((h == NULL) ? (LHASH_HASH_FN_TYPE)lh_strhash : h);\n    ret->num_nodes = MIN_NODES / 2;\n    ret->num_alloc_nodes = MIN_NODES;\n    ret->pmax = MIN_NODES / 2;\n    ret->up_load = UP_LOAD;\n    ret->down_load = DOWN_LOAD;\n    return (ret);\n err1:\n    OPENSSL_free(ret);\n err0:\n    return (NULL);\n}', 'int TXT_DB_insert(TXT_DB *db, OPENSSL_STRING *row)\n{\n    int i;\n    OPENSSL_STRING *r;\n    for (i = 0; i < db->num_fields; i++) {\n        if (db->index[i] != NULL) {\n            if ((db->qual[i] != NULL) && (db->qual[i] (row) == 0))\n                continue;\n            r = lh_OPENSSL_STRING_retrieve(db->index[i], row);\n            if (r != NULL) {\n                db->error = DB_ERROR_INDEX_CLASH;\n                db->arg1 = i;\n                db->arg_row = r;\n                goto err;\n            }\n        }\n    }\n    if (!sk_OPENSSL_PSTRING_push(db->data, row)) {\n        db->error = DB_ERROR_MALLOC;\n        goto err;\n    }\n    for (i = 0; i < db->num_fields; i++) {\n        if (db->index[i] != NULL) {\n            if ((db->qual[i] != NULL) && (db->qual[i] (row) == 0))\n                continue;\n            (void)lh_OPENSSL_STRING_insert(db->index[i], row);\n        }\n    }\n    return (1);\n err:\n    return (0);\n}', 'void *lh_insert(_LHASH *lh, void *data)\n{\n    unsigned long hash;\n    LHASH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    if (lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes))\n        expand(lh);\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        if ((nn = OPENSSL_malloc(sizeof(*nn))) == NULL) {\n            lh->error++;\n            return (NULL);\n        }\n        nn->data = data;\n        nn->next = NULL;\n        nn->hash = hash;\n        *rn = nn;\n        ret = NULL;\n        lh->num_insert++;\n        lh->num_items++;\n    } else {\n        ret = (*rn)->data;\n        (*rn)->data = data;\n        lh->num_replace++;\n    }\n    return (ret);\n}', 'static void expand(_LHASH *lh)\n{\n    LHASH_NODE **n, **n1, **n2, *np;\n    unsigned int p, i, j;\n    unsigned long hash, nni;\n    lh->num_nodes++;\n    lh->num_expands++;\n    p = (int)lh->p++;\n    n1 = &(lh->b[p]);\n    n2 = &(lh->b[p + (int)lh->pmax]);\n    *n2 = NULL;\n    nni = lh->num_alloc_nodes;\n    for (np = *n1; np != NULL;) {\n        hash = np->hash;\n        if ((hash % nni) != p) {\n            *n1 = (*n1)->next;\n            np->next = *n2;\n            *n2 = np;\n        } else\n            n1 = &((*n1)->next);\n        np = *n1;\n    }\n    if ((lh->p) >= lh->pmax) {\n        j = (int)lh->num_alloc_nodes * 2;\n        n = OPENSSL_realloc(lh->b, (int)(sizeof(LHASH_NODE *) * j));\n        if (n == NULL) {\n            lh->error++;\n            lh->p = 0;\n            return;\n        }\n        for (i = (int)lh->num_alloc_nodes; i < j; i++)\n            n[i] = NULL;\n        lh->pmax = lh->num_alloc_nodes;\n        lh->num_alloc_nodes = j;\n        lh->num_expand_reallocs++;\n        lh->p = 0;\n        lh->b = n;\n    }\n}', 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)\n        return realloc_impl(str, num, file, line);\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str, file, line);\n        return NULL;\n    }\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    osslargused(file); osslargused(line);\n#endif\n    return realloc(str, num);\n}']