test/evp_test.c:1557: error: BUFFER_OVERRUN_L2
  Offset added: [0, 2147483646] Size: 104 by call to `BUF_strdup`.
Showing all 11 steps of the trace


test/evp_test.c:1557:27: Call
1555.       } else if (strcmp(encoding, "invalid") == 0) {
1556.           edata->encoding = BASE64_INVALID_ENCODING;
1557.           t->expected_err = BUF_strdup("DECODE_ERROR");
                                  ^
1558.           if (t->expected_err == NULL)
1559.               return 0;

crypto/buffer/buf_str.c:73:1: Parameter `*str`
  71.   }
  72.   
  73. > char *BUF_strdup(const char *str)
  74.   {
  75.       if (str == NULL)

crypto/buffer/buf_str.c:77:12: Call
  75.       if (str == NULL)
  76.           return NULL;
  77.       return BUF_strndup(str, strlen(str));
                   ^
  78.   }
  79.   

crypto/buffer/buf_str.c:87:11: <Offset trace>
85.           return NULL;
86.   
87.       siz = BUF_strnlen(str, siz);
                ^
88.   
89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:87:11: Call
    85.           return NULL;
    86.   
    87.       siz = BUF_strnlen(str, siz);
                    ^
    88.   
    89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:64:1: Parameter `*str`
      62.   #include <openssl/buffer.h>
      63.   
      64. > size_t BUF_strnlen(const char *str, size_t maxlen)
      65.   {
      66.       const char *p;

crypto/buffer/buf_str.c:70:5: Assignment
      68.       for (p = str; maxlen-- != 0 && *p != '\0'; ++p) ;
      69.   
      70.       return p - str;
                ^
      71.   }
      72.   

crypto/buffer/buf_str.c:87:5: Assignment
    85.           return NULL;
    86.   
    87.       siz = BUF_strnlen(str, siz);
              ^
    88.   
    89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:80:1: <Length trace>
78.   }
79.   
80. > char *BUF_strndup(const char *str, size_t siz)
81.   {
82.       char *ret;

crypto/buffer/buf_str.c:80:1: Parameter `*str`
    78.   }
    79.   
    80. > char *BUF_strndup(const char *str, size_t siz)
    81.   {
    82.       char *ret;

crypto/buffer/buf_str.c:98:5: Array access: Offset added: [0, 2147483646] Size: 104 by call to `BUF_strdup` 
    96.       }
    97.   
    98.       memcpy(ret, str, siz);
               ^
    99.       ret[siz] = '\0';
    100.   

char *BUF_strndup(const char *str, size_t siz)
{
    char *ret;
    if (str == NULL)
        return NULL;
    siz = BUF_strnlen(str, siz);
    if (siz >= INT_MAX)
        return NULL;
    ret = OPENSSL_malloc(siz + 1);
    if (ret == NULL) {
        BUFerr(BUF_F_BUF_STRNDUP, ERR_R_MALLOC_FAILURE);
        return NULL;
    }
    memcpy(ret, str, siz);
    ret[siz] = '\0';
    return (ret);
}
['static int encode_test_init(struct evp_test *t, const char *encoding)\n{\n    struct encode_data *edata = OPENSSL_zalloc(sizeof(*edata));\n    if (strcmp(encoding, "canonical") == 0) {\n        edata->encoding = BASE64_CANONICAL_ENCODING;\n    } else if (strcmp(encoding, "valid") == 0) {\n        edata->encoding = BASE64_VALID_ENCODING;\n    } else if (strcmp(encoding, "invalid") == 0) {\n        edata->encoding = BASE64_INVALID_ENCODING;\n        t->expected_err = BUF_strdup("DECODE_ERROR");\n        if (t->expected_err == NULL)\n            return 0;\n    } else {\n        fprintf(stderr, "Bad encoding: %s. Should be one of "\n                "{canonical, valid, invalid}\\n", encoding);\n        return 0;\n    }\n    t->data = edata;\n    return 1;\n}', 'char *BUF_strdup(const char *str)\n{\n    if (str == NULL)\n        return NULL;\n    return BUF_strndup(str, strlen(str));\n}', "char *BUF_strndup(const char *str, size_t siz)\n{\n    char *ret;\n    if (str == NULL)\n        return NULL;\n    siz = BUF_strnlen(str, siz);\n    if (siz >= INT_MAX)\n        return NULL;\n    ret = OPENSSL_malloc(siz + 1);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_STRNDUP, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    memcpy(ret, str, siz);\n    ret[siz] = '\\0';\n    return (ret);\n}", "size_t BUF_strnlen(const char *str, size_t maxlen)\n{\n    const char *p;\n    for (p = str; maxlen-- != 0 && *p != '\\0'; ++p) ;\n    return p - str;\n}"]