crypto/bio/bio_cb.c:64: error: INTEGER_OVERFLOW_L2
  ([0, 2147483647] - 1):unsigned64 by call to `BIO_snprintf`.
Showing all 10 steps of the trace


crypto/bio/bio_cb.c:34:9: Assignment
32.       /* Ignore errors and continue printing the other information. */
33.       if (len < 0)
34.           len = 0;
              ^
35.       p = buf + len;
36.       p_maxlen = sizeof(buf) - len;

crypto/bio/bio_cb.c:36:5: Assignment
34.           len = 0;
35.       p = buf + len;
36.       p_maxlen = sizeof(buf) - len;
          ^
37.   
38.       switch (cmd) {

crypto/bio/bio_cb.c:64:9: Call
62.           break;
63.       case BIO_CB_GETS:
64.           BIO_snprintf(p, p_maxlen, "gets(%lu) - %s\n", (unsigned long)argi,
              ^
65.                        bio->method->name);
66.           break;

crypto/bio/b_print.c:895:1: Parameter `n`
  893.    * function should be renamed, but to what?)
  894.    */
  895. > int BIO_snprintf(char *buf, size_t n, const char *format, ...)
  896.   {
  897.       va_list args;

crypto/bio/b_print.c:902:11: Call
  900.       va_start(args, format);
  901.   
  902.       ret = BIO_vsnprintf(buf, n, format, args);
                   ^
  903.   
  904.       va_end(args);

crypto/bio/b_print.c:908:1: Parameter `n`
    906.   }
    907.   
    908. > int BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)
    909.   {
    910.       size_t retlen;

crypto/bio/b_print.c:913:9: Call
    911.       int truncated;
    912.   
    913.       if(!_dopr(&buf, NULL, &n, &retlen, &truncated, format, args))
                   ^
    914.           return -1;
    915.   

crypto/bio/b_print.c:83:1: <LHS trace>
81.   #define OSSL_MAX(p,q) ((p >= q) ? p : q)
82.   
83. > static int
84.   _dopr(char **sbuffer,
85.         char **buffer,

crypto/bio/b_print.c:83:1: Parameter `*maxlen`
      81.   #define OSSL_MAX(p,q) ((p >= q) ? p : q)
      82.   
      83. > static int
      84.   _dopr(char **sbuffer,
      85.         char **buffer,

crypto/bio/b_print.c:353:23: Binary operation: ([0, 2147483647] - 1):unsigned64 by call to `BIO_snprintf` 
      351.        */
      352.       if (buffer == NULL) {
      353.           *truncated = (currlen > *maxlen - 1);
                                   ^
      354.           if (*truncated)
      355.               currlen = *maxlen - 1;

static int
_dopr(char **sbuffer,
      char **buffer,
      size_t *maxlen,
      size_t *retlen, int *truncated, const char *format, va_list args)
{
    char ch;
    int64_t value;
    LDOUBLE fvalue;
    char *strvalue;
    int min;
    int max;
    int state;
    int flags;
    int cflags;
    size_t currlen;
    state = DP_S_DEFAULT;
    flags = currlen = cflags = min = 0;
    max = -1;
    ch = *format++;
    while (state != DP_S_DONE) {
        if (ch == '\0' || (buffer == NULL && currlen >= *maxlen))
            state = DP_S_DONE;
        switch (state) {
        case DP_S_DEFAULT:
            if (ch == '%')
                state = DP_S_FLAGS;
            else
                if(!doapr_outch(sbuffer, buffer, &currlen, maxlen, ch))
                    return 0;
            ch = *format++;
            break;
        case DP_S_FLAGS:
            switch (ch) {
            case '-':
                flags |= DP_F_MINUS;
                ch = *format++;
                break;
            case '+':
                flags |= DP_F_PLUS;
                ch = *format++;
                break;
            case ' ':
                flags |= DP_F_SPACE;
                ch = *format++;
                break;
            case '#':
                flags |= DP_F_NUM;
                ch = *format++;
                break;
            case '0':
                flags |= DP_F_ZERO;
                ch = *format++;
                break;
            default:
                state = DP_S_MIN;
                break;
            }
            break;
        case DP_S_MIN:
            if (isdigit((unsigned char)ch)) {
                min = 10 * min + char_to_int(ch);
                ch = *format++;
            } else if (ch == '*') {
                min = va_arg(args, int);
                ch = *format++;
                state = DP_S_DOT;
            } else
                state = DP_S_DOT;
            break;
        case DP_S_DOT:
            if (ch == '.') {
                state = DP_S_MAX;
                ch = *format++;
            } else
                state = DP_S_MOD;
            break;
        case DP_S_MAX:
            if (isdigit((unsigned char)ch)) {
                if (max < 0)
                    max = 0;
                max = 10 * max + char_to_int(ch);
                ch = *format++;
            } else if (ch == '*') {
                max = va_arg(args, int);
                ch = *format++;
                state = DP_S_MOD;
            } else
                state = DP_S_MOD;
            break;
        case DP_S_MOD:
            switch (ch) {
            case 'h':
                cflags = DP_C_SHORT;
                ch = *format++;
                break;
            case 'l':
                if (*format == 'l') {
                    cflags = DP_C_LLONG;
                    format++;
                } else
                    cflags = DP_C_LONG;
                ch = *format++;
                break;
            case 'q':
            case 'j':
                cflags = DP_C_LLONG;
                ch = *format++;
                break;
            case 'L':
                cflags = DP_C_LDOUBLE;
                ch = *format++;
                break;
            case 'z':
                cflags = DP_C_SIZE;
                ch = *format++;
                break;
            default:
                break;
            }
            state = DP_S_CONV;
            break;
        case DP_S_CONV:
            switch (ch) {
            case 'd':
            case 'i':
                switch (cflags) {
                case DP_C_SHORT:
                    value = (short int)va_arg(args, int);
                    break;
                case DP_C_LONG:
                    value = va_arg(args, long int);
                    break;
                case DP_C_LLONG:
                    value = va_arg(args, int64_t);
                    break;
                case DP_C_SIZE:
                    value = va_arg(args, ossl_ssize_t);
                    break;
                default:
                    value = va_arg(args, int);
                    break;
                }
                if (!fmtint(sbuffer, buffer, &currlen, maxlen, value, 10, min,
                            max, flags))
                    return 0;
                break;
            case 'X':
                flags |= DP_F_UP;
            case 'x':
            case 'o':
            case 'u':
                flags |= DP_F_UNSIGNED;
                switch (cflags) {
                case DP_C_SHORT:
                    value = (unsigned short int)va_arg(args, unsigned int);
                    break;
                case DP_C_LONG:
                    value = va_arg(args, unsigned long int);
                    break;
                case DP_C_LLONG:
                    value = va_arg(args, uint64_t);
                    break;
                case DP_C_SIZE:
                    value = va_arg(args, size_t);
                    break;
                default:
                    value = va_arg(args, unsigned int);
                    break;
                }
                if (!fmtint(sbuffer, buffer, &currlen, maxlen, value,
                            ch == 'o' ? 8 : (ch == 'u' ? 10 : 16),
                            min, max, flags))
                    return 0;
                break;
            case 'f':
                if (cflags == DP_C_LDOUBLE)
                    fvalue = va_arg(args, LDOUBLE);
                else
                    fvalue = va_arg(args, double);
                if (!fmtfp(sbuffer, buffer, &currlen, maxlen, fvalue, min, max,
                           flags, F_FORMAT))
                    return 0;
                break;
            case 'E':
                flags |= DP_F_UP;
            case 'e':
                if (cflags == DP_C_LDOUBLE)
                    fvalue = va_arg(args, LDOUBLE);
                else
                    fvalue = va_arg(args, double);
                if (!fmtfp(sbuffer, buffer, &currlen, maxlen, fvalue, min, max,
                           flags, E_FORMAT))
                    return 0;
                break;
            case 'G':
                flags |= DP_F_UP;
            case 'g':
                if (cflags == DP_C_LDOUBLE)
                    fvalue = va_arg(args, LDOUBLE);
                else
                    fvalue = va_arg(args, double);
                if (!fmtfp(sbuffer, buffer, &currlen, maxlen, fvalue, min, max,
                           flags, G_FORMAT))
                    return 0;
                break;
            case 'c':
                if(!doapr_outch(sbuffer, buffer, &currlen, maxlen,
                            va_arg(args, int)))
                    return 0;
                break;
            case 's':
                strvalue = va_arg(args, char *);
                if (max < 0) {
                    if (buffer)
                        max = INT_MAX;
                    else
                        max = *maxlen;
                }
                if (!fmtstr(sbuffer, buffer, &currlen, maxlen, strvalue,
                            flags, min, max))
                    return 0;
                break;
            case 'p':
                value = (size_t)va_arg(args, void *);
                if (!fmtint(sbuffer, buffer, &currlen, maxlen,
                            value, 16, min, max, flags | DP_F_NUM))
                    return 0;
                break;
            case 'n':
                {
                    int *num;
                    num = va_arg(args, int *);
                    *num = currlen;
                }
                break;
            case '%':
                if(!doapr_outch(sbuffer, buffer, &currlen, maxlen, ch))
                    return 0;
                break;
            case 'w':
                ch = *format++;
                break;
            default:
                break;
            }
            ch = *format++;
            state = DP_S_DEFAULT;
            flags = cflags = min = 0;
            max = -1;
            break;
        case DP_S_DONE:
            break;
        default:
            break;
        }
    }
    if (buffer == NULL) {
        *truncated = (currlen > *maxlen - 1);
        if (*truncated)
            currlen = *maxlen - 1;
    }
    if(!doapr_outch(sbuffer, buffer, &currlen, maxlen, '\0'))
        return 0;
    *retlen = currlen - 1;
    return 1;
}
['long BIO_debug_callback(BIO *bio, int cmd, const char *argp,\n                        int argi, long argl, long ret)\n{\n    BIO *b;\n    char buf[256];\n    char *p;\n    long r = 1;\n    int len;\n    size_t p_maxlen;\n    if (BIO_CB_RETURN & cmd)\n        r = ret;\n    len = BIO_snprintf(buf, sizeof buf, "BIO[%p]: ", (void *)bio);\n    if (len < 0)\n        len = 0;\n    p = buf + len;\n    p_maxlen = sizeof(buf) - len;\n    switch (cmd) {\n    case BIO_CB_FREE:\n        BIO_snprintf(p, p_maxlen, "Free - %s\\n", bio->method->name);\n        break;\n    case BIO_CB_READ:\n        if (bio->method->type & BIO_TYPE_DESCRIPTOR)\n            BIO_snprintf(p, p_maxlen, "read(%d,%lu) - %s fd=%d\\n",\n                         bio->num, (unsigned long)argi,\n                         bio->method->name, bio->num);\n        else\n            BIO_snprintf(p, p_maxlen, "read(%d,%lu) - %s\\n",\n                         bio->num, (unsigned long)argi, bio->method->name);\n        break;\n    case BIO_CB_WRITE:\n        if (bio->method->type & BIO_TYPE_DESCRIPTOR)\n            BIO_snprintf(p, p_maxlen, "write(%d,%lu) - %s fd=%d\\n",\n                         bio->num, (unsigned long)argi,\n                         bio->method->name, bio->num);\n        else\n            BIO_snprintf(p, p_maxlen, "write(%d,%lu) - %s\\n",\n                         bio->num, (unsigned long)argi, bio->method->name);\n        break;\n    case BIO_CB_PUTS:\n        BIO_snprintf(p, p_maxlen, "puts() - %s\\n", bio->method->name);\n        break;\n    case BIO_CB_GETS:\n        BIO_snprintf(p, p_maxlen, "gets(%lu) - %s\\n", (unsigned long)argi,\n                     bio->method->name);\n        break;\n    case BIO_CB_CTRL:\n        BIO_snprintf(p, p_maxlen, "ctrl(%lu) - %s\\n", (unsigned long)argi,\n                     bio->method->name);\n        break;\n    case BIO_CB_RETURN | BIO_CB_READ:\n        BIO_snprintf(p, p_maxlen, "read return %ld\\n", ret);\n        break;\n    case BIO_CB_RETURN | BIO_CB_WRITE:\n        BIO_snprintf(p, p_maxlen, "write return %ld\\n", ret);\n        break;\n    case BIO_CB_RETURN | BIO_CB_GETS:\n        BIO_snprintf(p, p_maxlen, "gets return %ld\\n", ret);\n        break;\n    case BIO_CB_RETURN | BIO_CB_PUTS:\n        BIO_snprintf(p, p_maxlen, "puts return %ld\\n", ret);\n        break;\n    case BIO_CB_RETURN | BIO_CB_CTRL:\n        BIO_snprintf(p, p_maxlen, "ctrl return %ld\\n", ret);\n        break;\n    default:\n        BIO_snprintf(p, p_maxlen, "bio callback - unknown type (%d)\\n", cmd);\n        break;\n    }\n    b = (BIO *)bio->cb_arg;\n    if (b != NULL)\n        BIO_write(b, buf, strlen(buf));\n#if !defined(OPENSSL_NO_STDIO)\n    else\n        fputs(buf, stderr);\n#endif\n    return (r);\n}', 'int BIO_snprintf(char *buf, size_t n, const char *format, ...)\n{\n    va_list args;\n    int ret;\n    va_start(args, format);\n    ret = BIO_vsnprintf(buf, n, format, args);\n    va_end(args);\n    return (ret);\n}', 'int BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)\n{\n    size_t retlen;\n    int truncated;\n    if(!_dopr(&buf, NULL, &n, &retlen, &truncated, format, args))\n        return -1;\n    if (truncated)\n        return -1;\n    else\n        return (retlen <= INT_MAX) ? (int)retlen : -1;\n}', "static int\n_dopr(char **sbuffer,\n      char **buffer,\n      size_t *maxlen,\n      size_t *retlen, int *truncated, const char *format, va_list args)\n{\n    char ch;\n    int64_t value;\n    LDOUBLE fvalue;\n    char *strvalue;\n    int min;\n    int max;\n    int state;\n    int flags;\n    int cflags;\n    size_t currlen;\n    state = DP_S_DEFAULT;\n    flags = currlen = cflags = min = 0;\n    max = -1;\n    ch = *format++;\n    while (state != DP_S_DONE) {\n        if (ch == '\\0' || (buffer == NULL && currlen >= *maxlen))\n            state = DP_S_DONE;\n        switch (state) {\n        case DP_S_DEFAULT:\n            if (ch == '%')\n                state = DP_S_FLAGS;\n            else\n                if(!doapr_outch(sbuffer, buffer, &currlen, maxlen, ch))\n                    return 0;\n            ch = *format++;\n            break;\n        case DP_S_FLAGS:\n            switch (ch) {\n            case '-':\n                flags |= DP_F_MINUS;\n                ch = *format++;\n                break;\n            case '+':\n                flags |= DP_F_PLUS;\n                ch = *format++;\n                break;\n            case ' ':\n                flags |= DP_F_SPACE;\n                ch = *format++;\n                break;\n            case '#':\n                flags |= DP_F_NUM;\n                ch = *format++;\n                break;\n            case '0':\n                flags |= DP_F_ZERO;\n                ch = *format++;\n                break;\n            default:\n                state = DP_S_MIN;\n                break;\n            }\n            break;\n        case DP_S_MIN:\n            if (isdigit((unsigned char)ch)) {\n                min = 10 * min + char_to_int(ch);\n                ch = *format++;\n            } else if (ch == '*') {\n                min = va_arg(args, int);\n                ch = *format++;\n                state = DP_S_DOT;\n            } else\n                state = DP_S_DOT;\n            break;\n        case DP_S_DOT:\n            if (ch == '.') {\n                state = DP_S_MAX;\n                ch = *format++;\n            } else\n                state = DP_S_MOD;\n            break;\n        case DP_S_MAX:\n            if (isdigit((unsigned char)ch)) {\n                if (max < 0)\n                    max = 0;\n                max = 10 * max + char_to_int(ch);\n                ch = *format++;\n            } else if (ch == '*') {\n                max = va_arg(args, int);\n                ch = *format++;\n                state = DP_S_MOD;\n            } else\n                state = DP_S_MOD;\n            break;\n        case DP_S_MOD:\n            switch (ch) {\n            case 'h':\n                cflags = DP_C_SHORT;\n                ch = *format++;\n                break;\n            case 'l':\n                if (*format == 'l') {\n                    cflags = DP_C_LLONG;\n                    format++;\n                } else\n                    cflags = DP_C_LONG;\n                ch = *format++;\n                break;\n            case 'q':\n            case 'j':\n                cflags = DP_C_LLONG;\n                ch = *format++;\n                break;\n            case 'L':\n                cflags = DP_C_LDOUBLE;\n                ch = *format++;\n                break;\n            case 'z':\n                cflags = DP_C_SIZE;\n                ch = *format++;\n                break;\n            default:\n                break;\n            }\n            state = DP_S_CONV;\n            break;\n        case DP_S_CONV:\n            switch (ch) {\n            case 'd':\n            case 'i':\n                switch (cflags) {\n                case DP_C_SHORT:\n                    value = (short int)va_arg(args, int);\n                    break;\n                case DP_C_LONG:\n                    value = va_arg(args, long int);\n                    break;\n                case DP_C_LLONG:\n                    value = va_arg(args, int64_t);\n                    break;\n                case DP_C_SIZE:\n                    value = va_arg(args, ossl_ssize_t);\n                    break;\n                default:\n                    value = va_arg(args, int);\n                    break;\n                }\n                if (!fmtint(sbuffer, buffer, &currlen, maxlen, value, 10, min,\n                            max, flags))\n                    return 0;\n                break;\n            case 'X':\n                flags |= DP_F_UP;\n            case 'x':\n            case 'o':\n            case 'u':\n                flags |= DP_F_UNSIGNED;\n                switch (cflags) {\n                case DP_C_SHORT:\n                    value = (unsigned short int)va_arg(args, unsigned int);\n                    break;\n                case DP_C_LONG:\n                    value = va_arg(args, unsigned long int);\n                    break;\n                case DP_C_LLONG:\n                    value = va_arg(args, uint64_t);\n                    break;\n                case DP_C_SIZE:\n                    value = va_arg(args, size_t);\n                    break;\n                default:\n                    value = va_arg(args, unsigned int);\n                    break;\n                }\n                if (!fmtint(sbuffer, buffer, &currlen, maxlen, value,\n                            ch == 'o' ? 8 : (ch == 'u' ? 10 : 16),\n                            min, max, flags))\n                    return 0;\n                break;\n            case 'f':\n                if (cflags == DP_C_LDOUBLE)\n                    fvalue = va_arg(args, LDOUBLE);\n                else\n                    fvalue = va_arg(args, double);\n                if (!fmtfp(sbuffer, buffer, &currlen, maxlen, fvalue, min, max,\n                           flags, F_FORMAT))\n                    return 0;\n                break;\n            case 'E':\n                flags |= DP_F_UP;\n            case 'e':\n                if (cflags == DP_C_LDOUBLE)\n                    fvalue = va_arg(args, LDOUBLE);\n                else\n                    fvalue = va_arg(args, double);\n                if (!fmtfp(sbuffer, buffer, &currlen, maxlen, fvalue, min, max,\n                           flags, E_FORMAT))\n                    return 0;\n                break;\n            case 'G':\n                flags |= DP_F_UP;\n            case 'g':\n                if (cflags == DP_C_LDOUBLE)\n                    fvalue = va_arg(args, LDOUBLE);\n                else\n                    fvalue = va_arg(args, double);\n                if (!fmtfp(sbuffer, buffer, &currlen, maxlen, fvalue, min, max,\n                           flags, G_FORMAT))\n                    return 0;\n                break;\n            case 'c':\n                if(!doapr_outch(sbuffer, buffer, &currlen, maxlen,\n                            va_arg(args, int)))\n                    return 0;\n                break;\n            case 's':\n                strvalue = va_arg(args, char *);\n                if (max < 0) {\n                    if (buffer)\n                        max = INT_MAX;\n                    else\n                        max = *maxlen;\n                }\n                if (!fmtstr(sbuffer, buffer, &currlen, maxlen, strvalue,\n                            flags, min, max))\n                    return 0;\n                break;\n            case 'p':\n                value = (size_t)va_arg(args, void *);\n                if (!fmtint(sbuffer, buffer, &currlen, maxlen,\n                            value, 16, min, max, flags | DP_F_NUM))\n                    return 0;\n                break;\n            case 'n':\n                {\n                    int *num;\n                    num = va_arg(args, int *);\n                    *num = currlen;\n                }\n                break;\n            case '%':\n                if(!doapr_outch(sbuffer, buffer, &currlen, maxlen, ch))\n                    return 0;\n                break;\n            case 'w':\n                ch = *format++;\n                break;\n            default:\n                break;\n            }\n            ch = *format++;\n            state = DP_S_DEFAULT;\n            flags = cflags = min = 0;\n            max = -1;\n            break;\n        case DP_S_DONE:\n            break;\n        default:\n            break;\n        }\n    }\n    if (buffer == NULL) {\n        *truncated = (currlen > *maxlen - 1);\n        if (*truncated)\n            currlen = *maxlen - 1;\n    }\n    if(!doapr_outch(sbuffer, buffer, &currlen, maxlen, '\\0'))\n        return 0;\n    *retlen = currlen - 1;\n    return 1;\n}"]