crypto/srp/srp_vfy.c:365: error: BUFFER_OVERRUN_L3
  Offset: 6 Size: [1, +oo] by call to `TXT_DB_read`.
Showing all 11 steps of the trace


crypto/srp/srp_vfy.c:365:18: Call
363.       error_code = SRP_ERR_VBASE_INCOMPLETE_FILE;
364.   
365.       if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)
                        ^
366.           goto err;
367.   

crypto/txt_db/txt_db.c:20:1: <Offset trace>
18.   #define BUFSIZE 512
19.   
20. > TXT_DB *TXT_DB_read(BIO *in, int num)
21.   {
22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:20:1: Parameter `num`
  18.   #define BUFSIZE 512
  19.   
  20. > TXT_DB *TXT_DB_read(BIO *in, int num)
  21.   {
  22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:20:1: <Length trace>
18.   #define BUFSIZE 512
19.   
20. > TXT_DB *TXT_DB_read(BIO *in, int num)
21.   {
22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:20:1: Parameter `num`
  18.   #define BUFSIZE 512
  19.   
  20. > TXT_DB *TXT_DB_read(BIO *in, int num)
  21.   {
  22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:53:5: Assignment
  51.       }
  52.   
  53.       add = (num + 1) * sizeof(char *);
            ^
  54.       buf->data[size - 1] = '\0';
  55.       offset = 0;

crypto/txt_db/txt_db.c:75:22: Call
  73.           else {
  74.               buf->data[offset - 1] = '\0'; /* blat the '\n' */
  75.               if ((p = OPENSSL_malloc(add + offset)) == NULL)
                             ^
  76.                   goto err;
  77.               offset = 0;

crypto/mem.c:166:9: Assignment
    164.   
    165.       if (num == 0)
    166.           return NULL;
                   ^
    167.   
    168.       FAILTEST();

crypto/txt_db/txt_db.c:75:18: Assignment
  73.           else {
  74.               buf->data[offset - 1] = '\0'; /* blat the '\n' */
  75.               if ((p = OPENSSL_malloc(add + offset)) == NULL)
                         ^
  76.                   goto err;
  77.               offset = 0;

crypto/txt_db/txt_db.c:79:9: Assignment
  77.               offset = 0;
  78.           }
  79.           pp = (char **)p;
                ^
  80.           p += add;
  81.           n = 0;

crypto/txt_db/txt_db.c:110:9: Array access: Offset: 6 Size: [1, +oo] by call to `TXT_DB_read` 
  108.               goto err;
  109.           }
  110.           pp[n] = p;
                 ^
  111.           if (!sk_OPENSSL_PSTRING_push(ret->data, pp))
  112.               goto err;

TXT_DB *TXT_DB_read(BIO *in, int num)
{
    TXT_DB *ret = NULL;
    int esc = 0;
    long ln = 0;
    int i, add, n;
    int size = BUFSIZE;
    int offset = 0;
    char *p, *f;
    OPENSSL_STRING *pp;
    BUF_MEM *buf = NULL;
    if ((buf = BUF_MEM_new()) == NULL)
        goto err;
    if (!BUF_MEM_grow(buf, size))
        goto err;
    if ((ret = OPENSSL_malloc(sizeof(*ret))) == NULL)
        goto err;
    ret->num_fields = num;
    ret->index = NULL;
    ret->qual = NULL;
    if ((ret->data = sk_OPENSSL_PSTRING_new_null()) == NULL)
        goto err;
    if ((ret->index = OPENSSL_malloc(sizeof(*ret->index) * num)) == NULL)
        goto err;
    if ((ret->qual = OPENSSL_malloc(sizeof(*(ret->qual)) * num)) == NULL)
        goto err;
    for (i = 0; i < num; i++) {
        ret->index[i] = NULL;
        ret->qual[i] = NULL;
    }
    add = (num + 1) * sizeof(char *);
    buf->data[size - 1] = '\0';
    offset = 0;
    for (;;) {
        if (offset != 0) {
            size += BUFSIZE;
            if (!BUF_MEM_grow_clean(buf, size))
                goto err;
        }
        buf->data[offset] = '\0';
        BIO_gets(in, &(buf->data[offset]), size - offset);
        ln++;
        if (buf->data[offset] == '\0')
            break;
        if ((offset == 0) && (buf->data[0] == '#'))
            continue;
        i = strlen(&(buf->data[offset]));
        offset += i;
        if (buf->data[offset - 1] != '\n')
            continue;
        else {
            buf->data[offset - 1] = '\0';
            if ((p = OPENSSL_malloc(add + offset)) == NULL)
                goto err;
            offset = 0;
        }
        pp = (char **)p;
        p += add;
        n = 0;
        pp[n++] = p;
        i = 0;
        f = buf->data;
        esc = 0;
        for (;;) {
            if (*f == '\0')
                break;
            if (*f == '\t') {
                if (esc)
                    p--;
                else {
                    *(p++) = '\0';
                    f++;
                    if (n >= num)
                        break;
                    pp[n++] = p;
                    continue;
                }
            }
            esc = (*f == '\\');
            *(p++) = *(f++);
        }
        *(p++) = '\0';
        if ((n != num) || (*f != '\0')) {
            ret->error = DB_ERROR_WRONG_NUM_FIELDS;
            goto err;
        }
        pp[n] = p;
        if (!sk_OPENSSL_PSTRING_push(ret->data, pp))
            goto err;
    }
    BUF_MEM_free(buf);
    return ret;
 err:
    BUF_MEM_free(buf);
    if (ret != NULL) {
        sk_OPENSSL_PSTRING_free(ret->data);
        OPENSSL_free(ret->index);
        OPENSSL_free(ret->qual);
        OPENSSL_free(ret);
    }
    return (NULL);
}
['int SRP_VBASE_init(SRP_VBASE *vb, char *verifier_file)\n{\n    int error_code;\n    STACK_OF(SRP_gN) *SRP_gN_tab = sk_SRP_gN_new_null();\n    char *last_index = NULL;\n    int i;\n    char **pp;\n    SRP_gN *gN = NULL;\n    SRP_user_pwd *user_pwd = NULL;\n    TXT_DB *tmpdb = NULL;\n    BIO *in = BIO_new(BIO_s_file());\n    error_code = SRP_ERR_OPEN_FILE;\n    if (in == NULL || BIO_read_filename(in, verifier_file) <= 0)\n        goto err;\n    error_code = SRP_ERR_VBASE_INCOMPLETE_FILE;\n    if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)\n        goto err;\n    error_code = SRP_ERR_MEMORY;\n    if (vb->seed_key) {\n        last_index = SRP_get_default_gN(NULL)->id;\n    }\n    for (i = 0; i < sk_OPENSSL_PSTRING_num(tmpdb->data); i++) {\n        pp = sk_OPENSSL_PSTRING_value(tmpdb->data, i);\n        if (pp[DB_srptype][0] == DB_SRP_INDEX) {\n            if ((gN = OPENSSL_malloc(sizeof(*gN))) == NULL)\n                goto err;\n            if ((gN->id = OPENSSL_strdup(pp[DB_srpid])) == NULL\n                || (gN->N = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpverifier]))\n                        == NULL\n                || (gN->g = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpsalt]))\n                        == NULL\n                || sk_SRP_gN_insert(SRP_gN_tab, gN, 0) == 0)\n                goto err;\n            gN = NULL;\n            if (vb->seed_key != NULL) {\n                last_index = pp[DB_srpid];\n            }\n        } else if (pp[DB_srptype][0] == DB_SRP_VALID) {\n            const SRP_gN *lgN;\n            if ((lgN = SRP_get_gN_by_id(pp[DB_srpgN], SRP_gN_tab)) != NULL) {\n                error_code = SRP_ERR_MEMORY;\n                if ((user_pwd = SRP_user_pwd_new()) == NULL)\n                    goto err;\n                SRP_user_pwd_set_gN(user_pwd, lgN->g, lgN->N);\n                if (!SRP_user_pwd_set_ids\n                    (user_pwd, pp[DB_srpid], pp[DB_srpinfo]))\n                    goto err;\n                error_code = SRP_ERR_VBASE_BN_LIB;\n                if (!SRP_user_pwd_set_sv\n                    (user_pwd, pp[DB_srpsalt], pp[DB_srpverifier]))\n                    goto err;\n                if (sk_SRP_user_pwd_insert(vb->users_pwd, user_pwd, 0) == 0)\n                    goto err;\n                user_pwd = NULL;\n            }\n        }\n    }\n    if (last_index != NULL) {\n        if (((gN = SRP_get_gN_by_id(last_index, SRP_gN_tab)) == NULL)) {\n            error_code = SRP_ERR_VBASE_BN_LIB;\n            goto err;\n        }\n        vb->default_g = gN->g;\n        vb->default_N = gN->N;\n        gN = NULL;\n    }\n    error_code = SRP_NO_ERROR;\n err:\n    if (gN != NULL) {\n        OPENSSL_free(gN->id);\n        OPENSSL_free(gN);\n    }\n    SRP_user_pwd_free(user_pwd);\n    TXT_DB_free(tmpdb);\n    BIO_free_all(in);\n    sk_SRP_gN_free(SRP_gN_tab);\n    return error_code;\n}', "TXT_DB *TXT_DB_read(BIO *in, int num)\n{\n    TXT_DB *ret = NULL;\n    int esc = 0;\n    long ln = 0;\n    int i, add, n;\n    int size = BUFSIZE;\n    int offset = 0;\n    char *p, *f;\n    OPENSSL_STRING *pp;\n    BUF_MEM *buf = NULL;\n    if ((buf = BUF_MEM_new()) == NULL)\n        goto err;\n    if (!BUF_MEM_grow(buf, size))\n        goto err;\n    if ((ret = OPENSSL_malloc(sizeof(*ret))) == NULL)\n        goto err;\n    ret->num_fields = num;\n    ret->index = NULL;\n    ret->qual = NULL;\n    if ((ret->data = sk_OPENSSL_PSTRING_new_null()) == NULL)\n        goto err;\n    if ((ret->index = OPENSSL_malloc(sizeof(*ret->index) * num)) == NULL)\n        goto err;\n    if ((ret->qual = OPENSSL_malloc(sizeof(*(ret->qual)) * num)) == NULL)\n        goto err;\n    for (i = 0; i < num; i++) {\n        ret->index[i] = NULL;\n        ret->qual[i] = NULL;\n    }\n    add = (num + 1) * sizeof(char *);\n    buf->data[size - 1] = '\\0';\n    offset = 0;\n    for (;;) {\n        if (offset != 0) {\n            size += BUFSIZE;\n            if (!BUF_MEM_grow_clean(buf, size))\n                goto err;\n        }\n        buf->data[offset] = '\\0';\n        BIO_gets(in, &(buf->data[offset]), size - offset);\n        ln++;\n        if (buf->data[offset] == '\\0')\n            break;\n        if ((offset == 0) && (buf->data[0] == '#'))\n            continue;\n        i = strlen(&(buf->data[offset]));\n        offset += i;\n        if (buf->data[offset - 1] != '\\n')\n            continue;\n        else {\n            buf->data[offset - 1] = '\\0';\n            if ((p = OPENSSL_malloc(add + offset)) == NULL)\n                goto err;\n            offset = 0;\n        }\n        pp = (char **)p;\n        p += add;\n        n = 0;\n        pp[n++] = p;\n        i = 0;\n        f = buf->data;\n        esc = 0;\n        for (;;) {\n            if (*f == '\\0')\n                break;\n            if (*f == '\\t') {\n                if (esc)\n                    p--;\n                else {\n                    *(p++) = '\\0';\n                    f++;\n                    if (n >= num)\n                        break;\n                    pp[n++] = p;\n                    continue;\n                }\n            }\n            esc = (*f == '\\\\');\n            *(p++) = *(f++);\n        }\n        *(p++) = '\\0';\n        if ((n != num) || (*f != '\\0')) {\n            ret->error = DB_ERROR_WRONG_NUM_FIELDS;\n            goto err;\n        }\n        pp[n] = p;\n        if (!sk_OPENSSL_PSTRING_push(ret->data, pp))\n            goto err;\n    }\n    BUF_MEM_free(buf);\n    return ret;\n err:\n    BUF_MEM_free(buf);\n    if (ret != NULL) {\n        sk_OPENSSL_PSTRING_free(ret->data);\n        OPENSSL_free(ret->index);\n        OPENSSL_free(ret->qual);\n        OPENSSL_free(ret);\n    }\n    return (NULL);\n}", 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    osslargused(file); osslargused(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']