crypto/asn1/a_d2i_fp.c:172: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [0, 16]):unsigned64 by call to `BUF_MEM_grow_clean`.
Showing all 7 steps of the trace


crypto/asn1/a_d2i_fp.c:148:2: Assignment
146.   	int ret=-1;
147.   	ASN1_const_CTX c;
148.   	int want=HEADER_SIZE;
        ^
149.   	int eos=0;
150.   #if defined(__GNUC__) && defined(__ia64)

crypto/asn1/a_d2i_fp.c:172:9: Call
170.   			want-=(len-off);
171.   
172.   			if (!BUF_MEM_grow_clean(b,len+want))
               ^
173.   				{
174.   				ASN1err(ASN1_F_ASN1_D2I_READ_BIO,ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:128:1: <LHS trace>
126.   	}
127.   
128. > int BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
129.   	{
130.   	char *ret;

crypto/buffer/buffer.c:128:1: Parameter `len`
  126.   	}
  127.   
  128. > int BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
  129.   	{
  130.   	char *ret;

crypto/buffer/buffer.c:128:1: <RHS trace>
126.   	}
127.   
128. > int BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
129.   	{
130.   	char *ret;

crypto/buffer/buffer.c:128:1: Parameter `len`
  126.   	}
  127.   
  128. > int BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
  129.   	{
  130.   	char *ret;

crypto/buffer/buffer.c:135:3: Binary operation: ([0, +oo] - [0, 16]):unsigned64 by call to `BUF_MEM_grow_clean` 
  133.   	if (str->length >= len)
  134.   		{
  135.   		memset(&str->data[len],0,str->length-len);
           ^
  136.   		str->length=len;
  137.   		return(len);

int BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
	{
	char *ret;
	size_t n;
	if (str->length >= len)
		{
		memset(&str->data[len],0,str->length-len);
		str->length=len;
		return(len);
		}
	if (str->max >= len)
		{
		memset(&str->data[str->length],0,len-str->length);
		str->length=len;
		return(len);
		}
	n=(len+3)/3*4;
	if (str->data == NULL)
		ret=OPENSSL_malloc(n);
	else
		ret=OPENSSL_realloc_clean(str->data,str->max,n);
	if (ret == NULL)
		{
		BUFerr(BUF_F_BUF_MEM_GROW_CLEAN,ERR_R_MALLOC_FAILURE);
		len=0;
		}
	else
		{
		str->data=ret;
		str->max=n;
		memset(&str->data[str->length],0,len-str->length);
		str->length=len;
		}
	return(len);
	}
['static int asn1_d2i_read_bio(BIO *in, BUF_MEM **pb)\n\t{\n\tBUF_MEM *b;\n\tunsigned char *p;\n\tint i;\n\tint ret=-1;\n\tASN1_const_CTX c;\n\tint want=HEADER_SIZE;\n\tint eos=0;\n#if defined(__GNUC__) && defined(__ia64)\n\tlong off=0;\n#else\n\tint off=0;\n#endif\n\tint len=0;\n\tb=BUF_MEM_new();\n\tif (b == NULL)\n\t\t{\n\t\tASN1err(ASN1_F_ASN1_D2I_READ_BIO,ERR_R_MALLOC_FAILURE);\n\t\treturn -1;\n\t\t}\n\tERR_clear_error();\n\tfor (;;)\n\t\t{\n\t\tif (want >= (len-off))\n\t\t\t{\n\t\t\twant-=(len-off);\n\t\t\tif (!BUF_MEM_grow_clean(b,len+want))\n\t\t\t\t{\n\t\t\t\tASN1err(ASN1_F_ASN1_D2I_READ_BIO,ERR_R_MALLOC_FAILURE);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\ti=BIO_read(in,&(b->data[len]),want);\n\t\t\tif ((i < 0) && ((len-off) == 0))\n\t\t\t\t{\n\t\t\t\tASN1err(ASN1_F_ASN1_D2I_READ_BIO,ASN1_R_NOT_ENOUGH_DATA);\n\t\t\t\tgoto err;\n\t\t\t\t}\n\t\t\tif (i > 0)\n\t\t\t\tlen+=i;\n\t\t\t}\n\t\tp=(unsigned char *)&(b->data[off]);\n\t\tc.p=p;\n\t\tc.inf=ASN1_get_object(&(c.p),&(c.slen),&(c.tag),&(c.xclass),\n\t\t\tlen-off);\n\t\tif (c.inf & 0x80)\n\t\t\t{\n\t\t\tunsigned long e;\n\t\t\te=ERR_GET_REASON(ERR_peek_error());\n\t\t\tif (e != ASN1_R_TOO_LONG)\n\t\t\t\tgoto err;\n\t\t\telse\n\t\t\t\tERR_clear_error();\n\t\t\t}\n\t\ti=c.p-p;\n\t\toff+=i;\n\t\tif (c.inf & 1)\n\t\t\t{\n\t\t\teos++;\n\t\t\twant=HEADER_SIZE;\n\t\t\t}\n\t\telse if (eos && (c.slen == 0) && (c.tag == V_ASN1_EOC))\n\t\t\t{\n\t\t\teos--;\n\t\t\tif (eos <= 0)\n\t\t\t\tbreak;\n\t\t\telse\n\t\t\t\twant=HEADER_SIZE;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\twant=(int)c.slen;\n\t\t\tif (want > (len-off))\n\t\t\t\t{\n\t\t\t\twant-=(len-off);\n\t\t\t\tif (!BUF_MEM_grow_clean(b,len+want))\n\t\t\t\t\t{\n\t\t\t\t\tASN1err(ASN1_F_ASN1_D2I_READ_BIO,ERR_R_MALLOC_FAILURE);\n\t\t\t\t\tgoto err;\n\t\t\t\t\t}\n\t\t\t\twhile (want > 0)\n\t\t\t\t\t{\n\t\t\t\t\ti=BIO_read(in,&(b->data[len]),want);\n\t\t\t\t\tif (i <= 0)\n\t\t\t\t\t\t{\n\t\t\t\t\t\tASN1err(ASN1_F_ASN1_D2I_READ_BIO,\n\t\t\t\t\t\t    ASN1_R_NOT_ENOUGH_DATA);\n\t\t\t\t\t\tgoto err;\n\t\t\t\t\t\t}\n\t\t\t\t\tlen+=i;\n\t\t\t\t\twant -= i;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\toff+=(int)c.slen;\n\t\t\tif (eos <= 0)\n\t\t\t\t{\n\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\telse\n\t\t\t\twant=HEADER_SIZE;\n\t\t\t}\n\t\t}\n\t*pb = b;\n\treturn off;\nerr:\n\tif (b != NULL) BUF_MEM_free(b);\n\treturn(ret);\n\t}', 'int BUF_MEM_grow_clean(BUF_MEM *str, size_t len)\n\t{\n\tchar *ret;\n\tsize_t n;\n\tif (str->length >= len)\n\t\t{\n\t\tmemset(&str->data[len],0,str->length-len);\n\t\tstr->length=len;\n\t\treturn(len);\n\t\t}\n\tif (str->max >= len)\n\t\t{\n\t\tmemset(&str->data[str->length],0,len-str->length);\n\t\tstr->length=len;\n\t\treturn(len);\n\t\t}\n\tn=(len+3)/3*4;\n\tif (str->data == NULL)\n\t\tret=OPENSSL_malloc(n);\n\telse\n\t\tret=OPENSSL_realloc_clean(str->data,str->max,n);\n\tif (ret == NULL)\n\t\t{\n\t\tBUFerr(BUF_F_BUF_MEM_GROW_CLEAN,ERR_R_MALLOC_FAILURE);\n\t\tlen=0;\n\t\t}\n\telse\n\t\t{\n\t\tstr->data=ret;\n\t\tstr->max=n;\n\t\tmemset(&str->data[str->length],0,len-str->length);\n\t\tstr->length=len;\n\t\t}\n\treturn(len);\n\t}']