crypto/pem/pem_lib.c:760: error: INTEGER_OVERFLOW_L2
  ([-5, 246] - 6):unsigned64.
Showing all 11 steps of the trace


crypto/pem/pem_lib.c:745:15: <LHS trace>
743.   
744.       do {
745.           len = BIO_gets(bp, linebuf, LINESIZE);
                     ^
746.   
747.           if (len <= 0) {

crypto/pem/pem_lib.c:745:15: Call
743.   
744.       do {
745.           len = BIO_gets(bp, linebuf, LINESIZE);
                     ^
746.   
747.           if (len <= 0) {

crypto/bio/bio_lib.c:438:9: Assignment
  436.       if ((b == NULL) || (b->method == NULL) || (b->method->bgets == NULL)) {
  437.           BIOerr(BIO_F_BIO_GETS, BIO_R_UNSUPPORTED_METHOD);
  438.           return (-2);
                 ^
  439.       }
  440.   

crypto/pem/pem_lib.c:745:9: Assignment
743.   
744.       do {
745.           len = BIO_gets(bp, linebuf, LINESIZE);
               ^
746.   
747.           if (len <= 0) {

crypto/pem/pem_lib.c:753:15: Call
751.   
752.           /* Strip trailing garbage and standardize ending. */
753.           len = sanitize_line(linebuf, len, flags & ~PEM_FLAG_ONLY_B64);
                     ^
754.   
755.           /* Allow leading empty or non-matching lines. */

crypto/pem/pem_lib.c:686:1: Parameter `len`
  684.   
  685.   /* Some helpers for PEM_read_bio_ex(). */
  686. > static int sanitize_line(char *linebuf, int len, unsigned int flags)
  687.   {
  688.       int i;

crypto/pem/pem_lib.c:695:9: Assignment
  693.               len--;
  694.           /* Go back to whitespace before applying uniform line ending. */
  695.           len++;
                 ^
  696.       } else if (flags & PEM_FLAG_ONLY_B64) {
  697.           for (i = 0; i < len; ++i) {

crypto/pem/pem_lib.c:715:13: Assignment
  713.       }
  714.       /* The caller allocated LINESIZE+1, so this is safe. */
  715.       linebuf[len++] = '\n';
                     ^
  716.       linebuf[len] = '\0';
  717.       return len;

crypto/pem/pem_lib.c:717:5: Assignment
  715.       linebuf[len++] = '\n';
  716.       linebuf[len] = '\0';
  717.       return len;
             ^
  718.   }
  719.   

crypto/pem/pem_lib.c:753:9: Assignment
751.   
752.           /* Strip trailing garbage and standardize ending. */
753.           len = sanitize_line(linebuf, len, flags & ~PEM_FLAG_ONLY_B64);
               ^
754.   
755.           /* Allow leading empty or non-matching lines. */

crypto/pem/pem_lib.c:760:5: Binary operation: ([-5, 246] - 6):unsigned64
758.                || strncmp(linebuf + len - TAILLEN, tailstr, TAILLEN) != 0);
759.       linebuf[len - TAILLEN] = '\0';
760.       len = len - BEGINLEN - TAILLEN + 1;
           ^
761.       *name = pem_malloc(len, flags);
762.       if (*name == NULL) {

static int get_name(BIO *bp, char **name, unsigned int flags)
{
    char *linebuf;
    int ret = 0;
    size_t len;
    linebuf = pem_malloc(LINESIZE + 1, flags);
    if (linebuf == NULL) {
        PEMerr(PEM_F_GET_NAME, ERR_R_MALLOC_FAILURE);
        return 0;
    }
    do {
        len = BIO_gets(bp, linebuf, LINESIZE);
        if (len <= 0) {
            PEMerr(PEM_F_GET_NAME, PEM_R_NO_START_LINE);
            goto err;
        }
        len = sanitize_line(linebuf, len, flags & ~PEM_FLAG_ONLY_B64);
    } while (strncmp(linebuf, beginstr, BEGINLEN) != 0
             || len < TAILLEN
             || strncmp(linebuf + len - TAILLEN, tailstr, TAILLEN) != 0);
    linebuf[len - TAILLEN] = '\0';
    len = len - BEGINLEN - TAILLEN + 1;
    *name = pem_malloc(len, flags);
    if (*name == NULL) {
        PEMerr(PEM_F_GET_NAME, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    memcpy(*name, linebuf + BEGINLEN, len);
    ret = 1;
err:
    pem_free(linebuf, flags, LINESIZE + 1);
    return ret;
}
["static int get_name(BIO *bp, char **name, unsigned int flags)\n{\n    char *linebuf;\n    int ret = 0;\n    size_t len;\n    linebuf = pem_malloc(LINESIZE + 1, flags);\n    if (linebuf == NULL) {\n        PEMerr(PEM_F_GET_NAME, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    do {\n        len = BIO_gets(bp, linebuf, LINESIZE);\n        if (len <= 0) {\n            PEMerr(PEM_F_GET_NAME, PEM_R_NO_START_LINE);\n            goto err;\n        }\n        len = sanitize_line(linebuf, len, flags & ~PEM_FLAG_ONLY_B64);\n    } while (strncmp(linebuf, beginstr, BEGINLEN) != 0\n             || len < TAILLEN\n             || strncmp(linebuf + len - TAILLEN, tailstr, TAILLEN) != 0);\n    linebuf[len - TAILLEN] = '\\0';\n    len = len - BEGINLEN - TAILLEN + 1;\n    *name = pem_malloc(len, flags);\n    if (*name == NULL) {\n        PEMerr(PEM_F_GET_NAME, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    memcpy(*name, linebuf + BEGINLEN, len);\n    ret = 1;\nerr:\n    pem_free(linebuf, flags, LINESIZE + 1);\n    return ret;\n}", 'int BIO_gets(BIO *b, char *buf, int size)\n{\n    int ret;\n    size_t readbytes = 0;\n    if ((b == NULL) || (b->method == NULL) || (b->method->bgets == NULL)) {\n        BIOerr(BIO_F_BIO_GETS, BIO_R_UNSUPPORTED_METHOD);\n        return (-2);\n    }\n    if (size < 0) {\n        BIOerr(BIO_F_BIO_GETS, BIO_R_INVALID_ARGUMENT);\n        return 0;\n    }\n    if (b->callback != NULL || b->callback_ex != NULL) {\n        ret = (int)bio_call_callback(b, BIO_CB_GETS, buf, size, 0, 0L, 1, NULL);\n        if (ret <= 0)\n            return ret;\n    }\n    if (!b->init) {\n        BIOerr(BIO_F_BIO_GETS, BIO_R_UNINITIALIZED);\n        return (-2);\n    }\n    ret = b->method->bgets(b, buf, size);\n    if (ret > 0) {\n        readbytes = ret;\n        ret = 1;\n    }\n    if (b->callback != NULL || b->callback_ex != NULL)\n        ret = (int)bio_call_callback(b, BIO_CB_GETS | BIO_CB_RETURN, buf, size,\n                                     0, 0L, ret, &readbytes);\n    if (ret > 0) {\n        if (readbytes > (size_t)size)\n            ret = -1;\n        else\n            ret = (int)readbytes;\n    }\n    return ret;\n}', "static int sanitize_line(char *linebuf, int len, unsigned int flags)\n{\n    int i;\n    if (flags & PEM_FLAG_EAY_COMPATIBLE) {\n        while ((len >= 0) && (linebuf[len] <= ' '))\n            len--;\n        len++;\n    } else if (flags & PEM_FLAG_ONLY_B64) {\n        for (i = 0; i < len; ++i) {\n            if (!ossl_isbase64(linebuf[i]) || linebuf[i] == '\\n'\n                || linebuf[i] == '\\r')\n                break;\n        }\n        len = i;\n    } else {\n        for (i = 0; i < len; ++i) {\n            if (linebuf[i] == '\\n' || linebuf[i] == '\\r')\n                break;\n            if (ossl_iscntrl(linebuf[i]))\n                linebuf[i] = ' ';\n        }\n        len = i;\n    }\n    linebuf[len++] = '\\n';\n    linebuf[len] = '\\0';\n    return len;\n}"]