apps/apps.c:1575: error: BUFFER_OVERRUN_L3
  Offset: [55, +oo] Size: [1, +oo] by call to `TXT_DB_read`.
Showing all 6 steps of the trace


apps/apps.c:1575:18: Call
1573.           goto err;
1574.       }
1575.       if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)
                         ^
1576.           goto err;
1577.   

crypto/txt_db/txt_db.c:69:1: <Length trace>
67.   #define BUFSIZE 512
68.   
69. > TXT_DB *TXT_DB_read(BIO *in, int num)
70.   {
71.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:69:1: Parameter `num`
  67.   #define BUFSIZE 512
  68.   
  69. > TXT_DB *TXT_DB_read(BIO *in, int num)
  70.   {
  71.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:102:5: Assignment
  100.       }
  101.   
  102.       add = (num + 1) * sizeof(char *);
             ^
  103.       buf->data[size - 1] = '\0';
  104.       offset = 0;

crypto/txt_db/txt_db.c:129:9: Assignment
  127.           }
  128.           pp = (char **)p;
  129.           p += add;
                 ^
  130.           n = 0;
  131.           pp[n++] = p;

crypto/txt_db/txt_db.c:152:13: Array access: Offset: [55, +oo] Size: [1, +oo] by call to `TXT_DB_read` 
  150.               }
  151.               esc = (*f == '\\');
  152.               *(p++) = *(f++);
                     ^
  153.           }
  154.           *(p++) = '\0';

TXT_DB *TXT_DB_read(BIO *in, int num)
{
    TXT_DB *ret = NULL;
    int esc = 0;
    long ln = 0;
    int i, add, n;
    int size = BUFSIZE;
    int offset = 0;
    char *p, *f;
    OPENSSL_STRING *pp;
    BUF_MEM *buf = NULL;
    if ((buf = BUF_MEM_new()) == NULL)
        goto err;
    if (!BUF_MEM_grow(buf, size))
        goto err;
    if ((ret = OPENSSL_malloc(sizeof(*ret))) == NULL)
        goto err;
    ret->num_fields = num;
    ret->index = NULL;
    ret->qual = NULL;
    if ((ret->data = sk_OPENSSL_PSTRING_new_null()) == NULL)
        goto err;
    if ((ret->index = OPENSSL_malloc(sizeof(*ret->index) * num)) == NULL)
        goto err;
    if ((ret->qual = OPENSSL_malloc(sizeof(*(ret->qual)) * num)) == NULL)
        goto err;
    for (i = 0; i < num; i++) {
        ret->index[i] = NULL;
        ret->qual[i] = NULL;
    }
    add = (num + 1) * sizeof(char *);
    buf->data[size - 1] = '\0';
    offset = 0;
    for (;;) {
        if (offset != 0) {
            size += BUFSIZE;
            if (!BUF_MEM_grow_clean(buf, size))
                goto err;
        }
        buf->data[offset] = '\0';
        BIO_gets(in, &(buf->data[offset]), size - offset);
        ln++;
        if (buf->data[offset] == '\0')
            break;
        if ((offset == 0) && (buf->data[0] == '#'))
            continue;
        i = strlen(&(buf->data[offset]));
        offset += i;
        if (buf->data[offset - 1] != '\n')
            continue;
        else {
            buf->data[offset - 1] = '\0';
            if ((p = OPENSSL_malloc(add + offset)) == NULL)
                goto err;
            offset = 0;
        }
        pp = (char **)p;
        p += add;
        n = 0;
        pp[n++] = p;
        i = 0;
        f = buf->data;
        esc = 0;
        for (;;) {
            if (*f == '\0')
                break;
            if (*f == '\t') {
                if (esc)
                    p--;
                else {
                    *(p++) = '\0';
                    f++;
                    if (n >= num)
                        break;
                    pp[n++] = p;
                    continue;
                }
            }
            esc = (*f == '\\');
            *(p++) = *(f++);
        }
        *(p++) = '\0';
        if ((n != num) || (*f != '\0')) {
            ret->error = DB_ERROR_WRONG_NUM_FIELDS;
            goto err;
        }
        pp[n] = p;
        if (!sk_OPENSSL_PSTRING_push(ret->data, pp))
            goto err;
    }
    BUF_MEM_free(buf);
    return ret;
 err:
    BUF_MEM_free(buf);
    if (ret != NULL) {
        sk_OPENSSL_PSTRING_free(ret->data);
        OPENSSL_free(ret->index);
        OPENSSL_free(ret->qual);
        OPENSSL_free(ret);
    }
    return (NULL);
}
['CA_DB *load_index(char *dbfile, DB_ATTR *db_attr)\n{\n    CA_DB *retdb = NULL;\n    TXT_DB *tmpdb = NULL;\n    BIO *in;\n    CONF *dbattr_conf = NULL;\n    char buf[BSIZE];\n    in = BIO_new_file(dbfile, "r");\n    if (in == NULL) {\n        ERR_print_errors(bio_err);\n        goto err;\n    }\n    if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)\n        goto err;\n#ifndef OPENSSL_SYS_VMS\n    BIO_snprintf(buf, sizeof buf, "%s.attr", dbfile);\n#else\n    BIO_snprintf(buf, sizeof buf, "%s-attr", dbfile);\n#endif\n    dbattr_conf = app_load_config(buf);\n    retdb = app_malloc(sizeof(*retdb), "new DB");\n    retdb->db = tmpdb;\n    tmpdb = NULL;\n    if (db_attr)\n        retdb->attributes = *db_attr;\n    else {\n        retdb->attributes.unique_subject = 1;\n    }\n    if (dbattr_conf) {\n        char *p = NCONF_get_string(dbattr_conf, NULL, "unique_subject");\n        if (p) {\n#ifdef RL_DEBUG\n            BIO_printf(bio_err,\n                       "DEBUG[load_index]: unique_subject = \\"%s\\"\\n", p);\n#endif\n            retdb->attributes.unique_subject = parse_yesno(p, 1);\n        }\n    }\n err:\n    NCONF_free(dbattr_conf);\n    TXT_DB_free(tmpdb);\n    BIO_free_all(in);\n    return retdb;\n}', "TXT_DB *TXT_DB_read(BIO *in, int num)\n{\n    TXT_DB *ret = NULL;\n    int esc = 0;\n    long ln = 0;\n    int i, add, n;\n    int size = BUFSIZE;\n    int offset = 0;\n    char *p, *f;\n    OPENSSL_STRING *pp;\n    BUF_MEM *buf = NULL;\n    if ((buf = BUF_MEM_new()) == NULL)\n        goto err;\n    if (!BUF_MEM_grow(buf, size))\n        goto err;\n    if ((ret = OPENSSL_malloc(sizeof(*ret))) == NULL)\n        goto err;\n    ret->num_fields = num;\n    ret->index = NULL;\n    ret->qual = NULL;\n    if ((ret->data = sk_OPENSSL_PSTRING_new_null()) == NULL)\n        goto err;\n    if ((ret->index = OPENSSL_malloc(sizeof(*ret->index) * num)) == NULL)\n        goto err;\n    if ((ret->qual = OPENSSL_malloc(sizeof(*(ret->qual)) * num)) == NULL)\n        goto err;\n    for (i = 0; i < num; i++) {\n        ret->index[i] = NULL;\n        ret->qual[i] = NULL;\n    }\n    add = (num + 1) * sizeof(char *);\n    buf->data[size - 1] = '\\0';\n    offset = 0;\n    for (;;) {\n        if (offset != 0) {\n            size += BUFSIZE;\n            if (!BUF_MEM_grow_clean(buf, size))\n                goto err;\n        }\n        buf->data[offset] = '\\0';\n        BIO_gets(in, &(buf->data[offset]), size - offset);\n        ln++;\n        if (buf->data[offset] == '\\0')\n            break;\n        if ((offset == 0) && (buf->data[0] == '#'))\n            continue;\n        i = strlen(&(buf->data[offset]));\n        offset += i;\n        if (buf->data[offset - 1] != '\\n')\n            continue;\n        else {\n            buf->data[offset - 1] = '\\0';\n            if ((p = OPENSSL_malloc(add + offset)) == NULL)\n                goto err;\n            offset = 0;\n        }\n        pp = (char **)p;\n        p += add;\n        n = 0;\n        pp[n++] = p;\n        i = 0;\n        f = buf->data;\n        esc = 0;\n        for (;;) {\n            if (*f == '\\0')\n                break;\n            if (*f == '\\t') {\n                if (esc)\n                    p--;\n                else {\n                    *(p++) = '\\0';\n                    f++;\n                    if (n >= num)\n                        break;\n                    pp[n++] = p;\n                    continue;\n                }\n            }\n            esc = (*f == '\\\\');\n            *(p++) = *(f++);\n        }\n        *(p++) = '\\0';\n        if ((n != num) || (*f != '\\0')) {\n            ret->error = DB_ERROR_WRONG_NUM_FIELDS;\n            goto err;\n        }\n        pp[n] = p;\n        if (!sk_OPENSSL_PSTRING_push(ret->data, pp))\n            goto err;\n    }\n    BUF_MEM_free(buf);\n    return ret;\n err:\n    BUF_MEM_free(buf);\n    if (ret != NULL) {\n        sk_OPENSSL_PSTRING_free(ret->data);\n        OPENSSL_free(ret->index);\n        OPENSSL_free(ret->qual);\n        OPENSSL_free(ret);\n    }\n    return (NULL);\n}"]