crypto/conf/conf.c:312: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `sk_delete_ptr`.
Showing all 16 steps of the trace


crypto/conf/conf.c:141:5: Call
139.   		ret=h;
140.   
141.   	sv=new_section(ret,section);
           ^
142.   	if (sv == NULL)
143.   		{

crypto/conf/conf.c:671:10: Call
  669.   	CONF_VALUE *v=NULL,*vv;
  670.   
  671.   	if ((sk=sk_new_null()) == NULL)
                  ^
  672.   		goto err;
  673.   	if ((v=(CONF_VALUE *)Malloc(sizeof(CONF_VALUE))) == NULL)

crypto/stack/stack.c:125:2: Assignment
    123.   	ret->comp=c;
    124.   	ret->num_alloc=MIN_NODES;
    125.   	ret->num=0;
            ^
    126.   	ret->sorted=0;
    127.   	return(ret);

crypto/conf/conf.c:304:9: Call
302.   				}
303.   			v->section=tv->section;	
304.   			if (!sk_push(ts,(char *)v))
               ^
305.   				{
306.   				CONFerr(CONF_F_CONF_LOAD,ERR_R_MALLOC_FAILURE);

crypto/stack/stack.c:233:1: Parameter `st->num`
  231.   	}
  232.   
  233. > int sk_push(STACK *st, char *data)
  234.   	{
  235.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:235:9: Call
  233.   int sk_push(STACK *st, char *data)
  234.   	{
  235.   	return(sk_insert(st,data,st->num));
                 ^
  236.   	}
  237.   

crypto/stack/stack.c:134:1: Parameter `st->num`
    132.   	}
    133.   
    134. > int sk_insert(STACK *st, char *data, int loc)
    135.   	{
    136.   	char **s;

crypto/conf/conf.c:312:5: Call
310.   			if (vv != NULL)
311.   				{
312.   				sk_delete_ptr(ts,(char *)vv);
           ^
313.   				Free(vv->name);
314.   				Free(vv->value);

crypto/stack/stack.c:172:1: Parameter `*st->data`
  170.   	}
  171.   
  172. > char *sk_delete_ptr(STACK *st, char *p)
  173.   	{
  174.   	int i;

crypto/stack/stack.c:178:11: Call
  176.   	for (i=0; i<st->num; i++)
  177.   		if (st->data[i] == p)
  178.   			return(sk_delete(st,i));
                   ^
  179.   	return(NULL);
  180.   	}

crypto/stack/stack.c:182:1: <Offset trace>
180.   	}
181.   
182. > char *sk_delete(STACK *st, int loc)
183.   	{
184.   	char *ret;

crypto/stack/stack.c:182:1: Parameter `loc`
    180.   	}
    181.   
    182. > char *sk_delete(STACK *st, int loc)
    183.   	{
    184.   	char *ret;

crypto/stack/stack.c:193:3: Assignment
    191.   	if (loc != st->num-1)
    192.   		{
    193.   		j=st->num-1;
             ^
    194.   		for (i=loc; i<j; i++)
    195.   			st->data[i]=st->data[i+1];

crypto/stack/stack.c:182:1: <Length trace>
180.   	}
181.   
182. > char *sk_delete(STACK *st, int loc)
183.   	{
184.   	char *ret;

crypto/stack/stack.c:182:1: Parameter `*st->data`
    180.   	}
    181.   
    182. > char *sk_delete(STACK *st, int loc)
    183.   	{
    184.   	char *ret;

crypto/stack/stack.c:195:16: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `sk_delete_ptr` 
    193.   		j=st->num-1;
    194.   		for (i=loc; i<j; i++)
    195.   			st->data[i]=st->data[i+1];
                          ^
    196.   		/* In theory memcpy is not safe for this
    197.   		 * memcpy( &(st->data[loc]),

char *sk_delete(STACK *st, int loc)
	{
	char *ret;
	int i,j;
	if ((st == NULL) || (st->num == 0) || (loc < 0)
					 || (loc >= st->num)) return(NULL);
	ret=st->data[loc];
	if (loc != st->num-1)
		{
		j=st->num-1;
		for (i=loc; i<j; i++)
			st->data[i]=st->data[i+1];
		}
	st->num--;
	return(ret);
	}
['LHASH *CONF_load(LHASH *h, char *file, long *line)\n\t{\n\tLHASH *ret=NULL;\n\tFILE *in=NULL;\n#define BUFSIZE\t512\n\tchar btmp[16];\n\tint bufnum=0,i,ii;\n\tBUF_MEM *buff=NULL;\n\tchar *s,*p,*end;\n\tint again,n;\n\tlong eline=0;\n\tCONF_VALUE *v=NULL,*vv,*tv;\n\tCONF_VALUE *sv=NULL;\n\tchar *section=NULL,*buf;\n\tSTACK *section_sk=NULL,*ts;\n\tchar *start,*psection,*pname;\n\tif ((buff=BUF_MEM_new()) == NULL)\n\t\t{\n\t\tCONFerr(CONF_F_CONF_LOAD,ERR_R_BUF_LIB);\n\t\tgoto err;\n\t\t}\n#ifdef VMS\n\tin=fopen(file,"r");\n#else\n\tin=fopen(file,"rb");\n#endif\n\tif (in == NULL)\n\t\t{\n\t\tSYSerr(SYS_F_FOPEN,get_last_sys_error());\n\t\tERR_set_error_data(BUF_strdup(file),\n\t\t\tERR_TXT_MALLOCED|ERR_TXT_STRING);\n\t\tCONFerr(CONF_F_CONF_LOAD,ERR_R_SYS_LIB);\n\t\tgoto err;\n\t\t}\n\tsection=(char *)Malloc(10);\n\tif (section == NULL)\n\t\t{\n\t\tCONFerr(CONF_F_CONF_LOAD,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tstrcpy(section,"default");\n\tif (h == NULL)\n\t\t{\n\t\tif ((ret=lh_new(hash,cmp)) == NULL)\n\t\t\t{\n\t\t\tCONFerr(CONF_F_CONF_LOAD,ERR_R_MALLOC_FAILURE);\n\t\t\tgoto err;\n\t\t\t}\n\t\t}\n\telse\n\t\tret=h;\n\tsv=new_section(ret,section);\n\tif (sv == NULL)\n\t\t{\n\t\tCONFerr(CONF_F_CONF_LOAD,CONF_R_UNABLE_TO_CREATE_NEW_SECTION);\n\t\tgoto err;\n\t\t}\n\tsection_sk=(STACK *)sv->value;\n\tbufnum=0;\n\tfor (;;)\n\t\t{\n\t\tagain=0;\n\t\tif (!BUF_MEM_grow(buff,bufnum+BUFSIZE))\n\t\t\t{\n\t\t\tCONFerr(CONF_F_CONF_LOAD,ERR_R_BUF_LIB);\n\t\t\tgoto err;\n\t\t\t}\n\t\tp= &(buff->data[bufnum]);\n\t\t*p=\'\\0\';\n\t\tfgets(p,BUFSIZE-1,in);\n\t\tp[BUFSIZE-1]=\'\\0\';\n\t\tii=i=strlen(p);\n\t\tif (i == 0) break;\n\t\twhile (i > 0)\n\t\t\t{\n\t\t\tif ((p[i-1] != \'\\r\') && (p[i-1] != \'\\n\'))\n\t\t\t\tbreak;\n\t\t\telse\n\t\t\t\ti--;\n\t\t\t}\n\t\tif (i == ii)\n\t\t\tagain=1;\n\t\telse\n\t\t\t{\n\t\t\tp[i]=\'\\0\';\n\t\t\teline++;\n\t\t\t}\n\t\tbufnum+=i;\n\t\tv=NULL;\n\t\tif (bufnum >= 1)\n\t\t\t{\n\t\t\tp= &(buff->data[bufnum-1]);\n\t\t\tif (\tIS_ESC(p[0]) &&\n\t\t\t\t((bufnum <= 1) || !IS_ESC(p[-1])))\n\t\t\t\t{\n\t\t\t\tbufnum--;\n\t\t\t\tagain=1;\n\t\t\t\t}\n\t\t\t}\n\t\tif (again) continue;\n\t\tbufnum=0;\n\t\tbuf=buff->data;\n\t\tclear_comments(buf);\n\t\tn=strlen(buf);\n\t\ts=eat_ws(buf);\n\t\tif (IS_EOF(*s)) continue;\n\t\tif (*s == \'[\')\n\t\t\t{\n\t\t\tchar *ss;\n\t\t\ts++;\n\t\t\tstart=eat_ws(s);\n\t\t\tss=start;\nagain:\n\t\t\tend=eat_alpha_numeric(ss);\n\t\t\tp=eat_ws(end);\n\t\t\tif (*p != \']\')\n\t\t\t\t{\n\t\t\t\tif (*p != \'\\0\')\n\t\t\t\t\t{\n\t\t\t\t\tss=p;\n\t\t\t\t\tgoto again;\n\t\t\t\t\t}\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD,CONF_R_MISSING_CLOSE_SQUARE_BRACKET);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t*end=\'\\0\';\n\t\t\tif (!str_copy(ret,NULL,&section,start)) goto err;\n\t\t\tif ((sv=get_section(ret,section)) == NULL)\n\t\t\t\tsv=new_section(ret,section);\n\t\t\tif (sv == NULL)\n\t\t\t\t{\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD,CONF_R_UNABLE_TO_CREATE_NEW_SECTION);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tsection_sk=(STACK *)sv->value;\n\t\t\tcontinue;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tpname=s;\n\t\t\tpsection=NULL;\n\t\t\tend=eat_alpha_numeric(s);\n\t\t\tif ((end[0] == \':\') && (end[1] == \':\'))\n\t\t\t\t{\n\t\t\t\t*end=\'\\0\';\n\t\t\t\tend+=2;\n\t\t\t\tpsection=pname;\n\t\t\t\tpname=end;\n\t\t\t\tend=eat_alpha_numeric(end);\n\t\t\t\t}\n\t\t\tp=eat_ws(end);\n\t\t\tif (*p != \'=\')\n\t\t\t\t{\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD,CONF_R_MISSING_EQUAL_SIGN);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\t*end=\'\\0\';\n\t\t\tp++;\n\t\t\tstart=eat_ws(p);\n\t\t\twhile (!IS_EOF(*p))\n\t\t\t\tp++;\n\t\t\tp--;\n\t\t\twhile ((p != start) && (IS_WS(*p)))\n\t\t\t\tp--;\n\t\t\tp++;\n\t\t\t*p=\'\\0\';\n\t\t\tif ((v=(CONF_VALUE *)Malloc(sizeof(CONF_VALUE))) == NULL)\n\t\t\t\t{\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD,ERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tif (psection == NULL) psection=section;\n\t\t\tv->name=(char *)Malloc(strlen(pname)+1);\n\t\t\tv->value=NULL;\n\t\t\tif (v->name == NULL)\n\t\t\t\t{\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD,ERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tstrcpy(v->name,pname);\n\t\t\tif (!str_copy(ret,psection,&(v->value),start)) goto err;\n\t\t\tif (strcmp(psection,section) != 0)\n\t\t\t\t{\n\t\t\t\tif ((tv=get_section(ret,psection))\n\t\t\t\t\t== NULL)\n\t\t\t\t\ttv=new_section(ret,psection);\n\t\t\t\tif (tv == NULL)\n\t\t\t\t\t{\n\t\t\t\t\tCONFerr(CONF_F_CONF_LOAD,CONF_R_UNABLE_TO_CREATE_NEW_SECTION);\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\tts=(STACK *)tv->value;\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\ttv=sv;\n\t\t\t\tts=section_sk;\n\t\t\t\t}\n\t\t\tv->section=tv->section;\n\t\t\tif (!sk_push(ts,(char *)v))\n\t\t\t\t{\n\t\t\t\tCONFerr(CONF_F_CONF_LOAD,ERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tvv=(CONF_VALUE *)lh_insert(ret,(char *)v);\n\t\t\tif (vv != NULL)\n\t\t\t\t{\n\t\t\t\tsk_delete_ptr(ts,(char *)vv);\n\t\t\t\tFree(vv->name);\n\t\t\t\tFree(vv->value);\n\t\t\t\tFree(vv);\n\t\t\t\t}\n\t\t\tv=NULL;\n\t\t\t}\n\t\t}\n\tif (buff != NULL) BUF_MEM_free(buff);\n\tif (section != NULL) Free(section);\n\tif (in != NULL) fclose(in);\n\treturn(ret);\nerr:\n\tif (buff != NULL) BUF_MEM_free(buff);\n\tif (section != NULL) Free(section);\n\tif (line != NULL) *line=eline;\n\tsprintf(btmp,"%ld",eline);\n\tERR_add_error_data(2,"line ",btmp);\n\tif (in != NULL) fclose(in);\n\tif ((h != ret) && (ret != NULL)) CONF_free(ret);\n\tif (v != NULL)\n\t\t{\n\t\tif (v->name != NULL) Free(v->name);\n\t\tif (v->value != NULL) Free(v->value);\n\t\tif (v != NULL) Free(v);\n\t\t}\n\treturn(NULL);\n\t}', 'static CONF_VALUE *new_section(LHASH *conf, char *section)\n\t{\n\tSTACK *sk=NULL;\n\tint ok=0,i;\n\tCONF_VALUE *v=NULL,*vv;\n\tif ((sk=sk_new_null()) == NULL)\n\t\tgoto err;\n\tif ((v=(CONF_VALUE *)Malloc(sizeof(CONF_VALUE))) == NULL)\n\t\tgoto err;\n\ti=strlen(section)+1;\n\tif ((v->section=(char *)Malloc(i)) == NULL)\n\t\tgoto err;\n\tmemcpy(v->section,section,i);\n\tv->name=NULL;\n\tv->value=(char *)sk;\n\tvv=(CONF_VALUE *)lh_insert(conf,(char *)v);\n\tif (vv != NULL)\n\t\t{\n#if !defined(NO_STDIO) && !defined(WIN16)\n\t\tfprintf(stderr,"internal fault\\n");\n#endif\n\t\tabort();\n\t\t}\n\tok=1;\nerr:\n\tif (!ok)\n\t\t{\n\t\tif (sk != NULL) sk_free(sk);\n\t\tif (v != NULL) Free(v);\n\t\tv=NULL;\n\t\t}\n\treturn(v);\n\t}', 'STACK *sk_new(int (*c)())\n\t{\n\tSTACK *ret;\n\tint i;\n\tif ((ret=(STACK *)Malloc(sizeof(STACK))) == NULL)\n\t\tgoto err0;\n\tif ((ret->data=(char **)Malloc(sizeof(char *)*MIN_NODES)) == NULL)\n\t\tgoto err1;\n\tfor (i=0; i<MIN_NODES; i++)\n\t\tret->data[i]=NULL;\n\tret->comp=c;\n\tret->num_alloc=MIN_NODES;\n\tret->num=0;\n\tret->sorted=0;\n\treturn(ret);\nerr1:\n\tFree((char *)ret);\nerr0:\n\treturn(NULL);\n\t}', 'int sk_push(STACK *st, char *data)\n\t{\n\treturn(sk_insert(st,data,st->num));\n\t}', 'int sk_insert(STACK *st, char *data, int loc)\n\t{\n\tchar **s;\n\tif(st == NULL) return 0;\n\tif (st->num_alloc <= st->num+1)\n\t\t{\n\t\ts=(char **)Realloc((char *)st->data,\n\t\t\t(unsigned int)sizeof(char *)*st->num_alloc*2);\n\t\tif (s == NULL)\n\t\t\treturn(0);\n\t\tst->data=s;\n\t\tst->num_alloc*=2;\n\t\t}\n\tif ((loc >= (int)st->num) || (loc < 0))\n\t\tst->data[st->num]=data;\n\telse\n\t\t{\n\t\tint i;\n\t\tchar **f,**t;\n\t\tf=(char **)st->data;\n\t\tt=(char **)&(st->data[1]);\n\t\tfor (i=st->num; i>=loc; i--)\n\t\t\tt[i]=f[i];\n#ifdef undef\n\t\tmemmove( (char *)&(st->data[loc+1]),\n\t\t\t(char *)&(st->data[loc]),\n\t\t\tsizeof(char *)*(st->num-loc));\n#endif\n\t\tst->data[loc]=data;\n\t\t}\n\tst->num++;\n\tst->sorted=0;\n\treturn(st->num);\n\t}', 'char *sk_delete_ptr(STACK *st, char *p)\n\t{\n\tint i;\n\tfor (i=0; i<st->num; i++)\n\t\tif (st->data[i] == p)\n\t\t\treturn(sk_delete(st,i));\n\treturn(NULL);\n\t}', 'char *sk_delete(STACK *st, int loc)\n\t{\n\tchar *ret;\n\tint i,j;\n\tif ((st == NULL) || (st->num == 0) || (loc < 0)\n\t\t\t\t\t || (loc >= st->num)) return(NULL);\n\tret=st->data[loc];\n\tif (loc != st->num-1)\n\t\t{\n\t\tj=st->num-1;\n\t\tfor (i=loc; i<j; i++)\n\t\t\tst->data[i]=st->data[i+1];\n\t\t}\n\tst->num--;\n\treturn(ret);\n\t}']