crypto/dso/dso_dlfcn.c:325: error: BUFFER_OVERRUN_S2
  Offset: [`filespec1->strlen` + 1, `filespec1->strlen` + `filespec2->strlen` + 1] (⇐ [1, `filespec2->strlen` + 1] + `filespec1->strlen`) Size: [1, `filespec1->strlen` + `filespec2->strlen` + 2].
Showing all 6 steps of the trace


crypto/dso/dso_dlfcn.c:270:1: <Offset trace>
268.   }
269.   
270. > static char *dlfcn_merger(DSO *dso, const char *filespec1,
271.                             const char *filespec2)
272.   {

crypto/dso/dso_dlfcn.c:270:1: Parameter `filespec1->strlen`
268.   }
269.   
270. > static char *dlfcn_merger(DSO *dso, const char *filespec1,
271.                             const char *filespec2)
272.   {

crypto/dso/dso_dlfcn.c:270:1: <Length trace>
268.   }
269.   
270. > static char *dlfcn_merger(DSO *dso, const char *filespec1,
271.                             const char *filespec2)
272.   {

crypto/dso/dso_dlfcn.c:270:1: Parameter `filespec2->strlen`
268.   }
269.   
270. > static char *dlfcn_merger(DSO *dso, const char *filespec1,
271.                             const char *filespec2)
272.   {

crypto/dso/dso_dlfcn.c:311:9: Assignment
309.           int spec2len, len;
310.   
311.           spec2len = strlen(filespec2);
               ^
312.           len = spec2len + strlen(filespec1);
313.   

crypto/dso/dso_dlfcn.c:325:9: Array access: Offset: [filespec1->strlen + 1, filespec1->strlen + filespec2->strlen + 1] (⇐ [1, filespec2->strlen + 1] + filespec1->strlen) Size: [1, filespec1->strlen + filespec2->strlen + 2]
323.           strcpy(merged, filespec2);
324.           merged[spec2len] = '/';
325.           strcpy(&merged[spec2len + 1], filespec1);
               ^
326.       }
327.       return (merged);

static char *dlfcn_merger(DSO *dso, const char *filespec1,
                          const char *filespec2)
{
    char *merged;
    if (!filespec1 && !filespec2) {
        DSOerr(DSO_F_DLFCN_MERGER, ERR_R_PASSED_NULL_PARAMETER);
        return (NULL);
    }
    if (!filespec2 || (filespec1 != NULL && filespec1[0] == '/')) {
        merged = OPENSSL_malloc(strlen(filespec1) + 1);
        if (merged == NULL) {
            DSOerr(DSO_F_DLFCN_MERGER, ERR_R_MALLOC_FAILURE);
            return (NULL);
        }
        strcpy(merged, filespec1);
    }
    else if (!filespec1) {
        merged = OPENSSL_malloc(strlen(filespec2) + 1);
        if (merged == NULL) {
            DSOerr(DSO_F_DLFCN_MERGER, ERR_R_MALLOC_FAILURE);
            return (NULL);
        }
        strcpy(merged, filespec2);
    } else {
        int spec2len, len;
        spec2len = strlen(filespec2);
        len = spec2len + strlen(filespec1);
        if (spec2len && filespec2[spec2len - 1] == '/') {
            spec2len--;
            len--;
        }
        merged = OPENSSL_malloc(len + 2);
        if (merged == NULL) {
            DSOerr(DSO_F_DLFCN_MERGER, ERR_R_MALLOC_FAILURE);
            return (NULL);
        }
        strcpy(merged, filespec2);
        merged[spec2len] = '/';
        strcpy(&merged[spec2len + 1], filespec1);
    }
    return (merged);
}
["static char *dlfcn_merger(DSO *dso, const char *filespec1,\n                          const char *filespec2)\n{\n    char *merged;\n    if (!filespec1 && !filespec2) {\n        DSOerr(DSO_F_DLFCN_MERGER, ERR_R_PASSED_NULL_PARAMETER);\n        return (NULL);\n    }\n    if (!filespec2 || (filespec1 != NULL && filespec1[0] == '/')) {\n        merged = OPENSSL_malloc(strlen(filespec1) + 1);\n        if (merged == NULL) {\n            DSOerr(DSO_F_DLFCN_MERGER, ERR_R_MALLOC_FAILURE);\n            return (NULL);\n        }\n        strcpy(merged, filespec1);\n    }\n    else if (!filespec1) {\n        merged = OPENSSL_malloc(strlen(filespec2) + 1);\n        if (merged == NULL) {\n            DSOerr(DSO_F_DLFCN_MERGER, ERR_R_MALLOC_FAILURE);\n            return (NULL);\n        }\n        strcpy(merged, filespec2);\n    } else {\n        int spec2len, len;\n        spec2len = strlen(filespec2);\n        len = spec2len + strlen(filespec1);\n        if (spec2len && filespec2[spec2len - 1] == '/') {\n            spec2len--;\n            len--;\n        }\n        merged = OPENSSL_malloc(len + 2);\n        if (merged == NULL) {\n            DSOerr(DSO_F_DLFCN_MERGER, ERR_R_MALLOC_FAILURE);\n            return (NULL);\n        }\n        strcpy(merged, filespec2);\n        merged[spec2len] = '/';\n        strcpy(&merged[spec2len + 1], filespec1);\n    }\n    return (merged);\n}"]