crypto/x509/x509_vpm.c:487: error: BUFFER_OVERRUN_L2
  Offset added: [0, 2147483646] Size: 1024 by call to `X509_VERIFY_PARAM_set1_ip`.
Showing all 16 steps of the trace


crypto/x509/x509_vpm.c:479:1: Array declaration
477.   }
478.   
479. > int X509_VERIFY_PARAM_set1_ip_asc(X509_VERIFY_PARAM *param, const char *ipasc)
480.   {
481.       unsigned char ipout[16];

crypto/x509/x509_vpm.c:487:12: Call
485.       if (iplen == 0)
486.           return 0;
487.       return X509_VERIFY_PARAM_set1_ip(param, ipout, iplen);
                  ^
488.   }
489.   

crypto/x509/x509_vpm.c:470:1: Parameter `*ip`
  468.   }
  469.   
  470. > int X509_VERIFY_PARAM_set1_ip(X509_VERIFY_PARAM *param,
  471.                                 const unsigned char *ip, size_t iplen)
  472.   {

crypto/x509/x509_vpm.c:475:12: Call
  473.       if (iplen != 0 && iplen != 4 && iplen != 16)
  474.           return 0;
  475.       return int_x509_param_set1((char **)&param->id->ip, &param->id->iplen,
                    ^
  476.                                  (char *)ip, iplen);
  477.   }

crypto/x509/x509_vpm.c:321:1: Parameter `*src`
    319.   }
    320.   
    321. > static int int_x509_param_set1(char **pdest, size_t *pdestlen,
    322.                                  const char *src, size_t srclen)
    323.   {

crypto/x509/x509_vpm.c:327:19: Call
    325.       if (src) {
    326.           if (srclen == 0) {
    327.               tmp = BUF_strdup(src);
                             ^
    328.               srclen = strlen(src);
    329.           } else

crypto/buffer/buf_str.c:73:1: Parameter `*str`
      71.   }
      72.   
      73. > char *BUF_strdup(const char *str)
      74.   {
      75.       if (str == NULL)

crypto/buffer/buf_str.c:77:12: Call
      75.       if (str == NULL)
      76.           return NULL;
      77.       return BUF_strndup(str, strlen(str));
                       ^
      78.   }
      79.   

crypto/buffer/buf_str.c:87:11: <Offset trace>
85.           return NULL;
86.   
87.       siz = BUF_strnlen(str, siz);
                ^
88.   
89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:87:11: Call
        85.           return NULL;
        86.   
        87.       siz = BUF_strnlen(str, siz);
                        ^
        88.   
        89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:64:1: Parameter `*str`
          62.   #include <openssl/buffer.h>
          63.   
          64. > size_t BUF_strnlen(const char *str, size_t maxlen)
          65.   {
          66.       const char *p;

crypto/buffer/buf_str.c:70:5: Assignment
          68.       for (p = str; maxlen-- != 0 && *p != '\0'; ++p) ;
          69.   
          70.       return p - str;
                    ^
          71.   }
          72.   

crypto/buffer/buf_str.c:87:5: Assignment
        85.           return NULL;
        86.   
        87.       siz = BUF_strnlen(str, siz);
                  ^
        88.   
        89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:80:1: <Length trace>
78.   }
79.   
80. > char *BUF_strndup(const char *str, size_t siz)
81.   {
82.       char *ret;

crypto/buffer/buf_str.c:80:1: Parameter `*str`
        78.   }
        79.   
        80. > char *BUF_strndup(const char *str, size_t siz)
        81.   {
        82.       char *ret;

crypto/buffer/buf_str.c:98:5: Array access: Offset added: [0, 2147483646] Size: 1024 by call to `X509_VERIFY_PARAM_set1_ip` 
        96.       }
        97.   
        98.       memcpy(ret, str, siz);
                   ^
        99.       ret[siz] = '\0';
        100.   

char *BUF_strndup(const char *str, size_t siz)
{
    char *ret;
    if (str == NULL)
        return NULL;
    siz = BUF_strnlen(str, siz);
    if (siz >= INT_MAX)
        return NULL;
    ret = OPENSSL_malloc(siz + 1);
    if (ret == NULL) {
        BUFerr(BUF_F_BUF_STRNDUP, ERR_R_MALLOC_FAILURE);
        return NULL;
    }
    memcpy(ret, str, siz);
    ret[siz] = '\0';
    return (ret);
}
['int X509_VERIFY_PARAM_set1_ip_asc(X509_VERIFY_PARAM *param, const char *ipasc)\n{\n    unsigned char ipout[16];\n    size_t iplen;\n    iplen = (size_t)a2i_ipadd(ipout, ipasc);\n    if (iplen == 0)\n        return 0;\n    return X509_VERIFY_PARAM_set1_ip(param, ipout, iplen);\n}', 'int X509_VERIFY_PARAM_set1_ip(X509_VERIFY_PARAM *param,\n                              const unsigned char *ip, size_t iplen)\n{\n    if (iplen != 0 && iplen != 4 && iplen != 16)\n        return 0;\n    return int_x509_param_set1((char **)&param->id->ip, &param->id->iplen,\n                               (char *)ip, iplen);\n}', 'static int int_x509_param_set1(char **pdest, size_t *pdestlen,\n                               const char *src, size_t srclen)\n{\n    void *tmp;\n    if (src) {\n        if (srclen == 0) {\n            tmp = BUF_strdup(src);\n            srclen = strlen(src);\n        } else\n            tmp = BUF_memdup(src, srclen);\n        if (!tmp)\n            return 0;\n    } else {\n        tmp = NULL;\n        srclen = 0;\n    }\n    OPENSSL_free(*pdest);\n    *pdest = tmp;\n    if (pdestlen)\n        *pdestlen = srclen;\n    return 1;\n}', 'char *BUF_strdup(const char *str)\n{\n    if (str == NULL)\n        return NULL;\n    return BUF_strndup(str, strlen(str));\n}', "char *BUF_strndup(const char *str, size_t siz)\n{\n    char *ret;\n    if (str == NULL)\n        return NULL;\n    siz = BUF_strnlen(str, siz);\n    if (siz >= INT_MAX)\n        return NULL;\n    ret = OPENSSL_malloc(siz + 1);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_STRNDUP, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    memcpy(ret, str, siz);\n    ret[siz] = '\\0';\n    return (ret);\n}", "size_t BUF_strnlen(const char *str, size_t maxlen)\n{\n    const char *p;\n    for (p = str; maxlen-- != 0 && *p != '\\0'; ++p) ;\n    return p - str;\n}"]