crypto/conf/conf_def.c:563: error: INTEGER_OVERFLOW_L2
  ([2, +oo] - [1, 2147483644]):unsigned64 by call to `BUF_MEM_grow_clean`.
Showing all 10 steps of the trace


crypto/conf/conf_def.c:460:10: Call
458.   
459.       len = strlen(from) + 1;
460.       if (!BUF_MEM_grow(buf, len))
                ^
461.           goto err;
462.   

crypto/buffer/buffer.c:122:1: Parameter `len`
  120.   }
  121.   
  122. > size_t BUF_MEM_grow(BUF_MEM *str, size_t len)
  123.   {
  124.       char *ret;

crypto/conf/conf_def.c:563:18: Call
561.                   goto err;
562.               }
563.               if (!BUF_MEM_grow_clean(buf,
                        ^
564.                           (strlen(p) + buf->length - (e - from)))) {
565.                   CONFerr(CONF_F_STR_COPY, ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:158:1: Parameter `len`
  156.   }
  157.   
  158. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
  159.   {
  160.       char *ret;

crypto/buffer/buffer.c:182:15: Call
  180.           ret = sec_alloc_realloc(str, n);
  181.       else
  182.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                       ^
  183.       if (ret == NULL) {
  184.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:193:1: <LHS trace>
191.   }
192.   
193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
194.                              const char *file, int line)
195.   {

crypto/mem.c:193:1: Parameter `num`
    191.   }
    192.   
    193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
    194.                              const char *file, int line)
    195.   {

crypto/mem.c:193:1: <RHS trace>
191.   }
192.   
193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
194.                              const char *file, int line)
195.   {

crypto/mem.c:193:1: Parameter `num`
    191.   }
    192.   
    193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
    194.                              const char *file, int line)
    195.   {

crypto/mem.c:208:9: Binary operation: ([2, +oo] - [1, 2147483644]):unsigned64 by call to `BUF_MEM_grow_clean` 
    206.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
    207.       if (num < old_len) {
    208.           memset((char*)str + num, 0, old_len - num);
                   ^
    209.           return str;
    210.       }

void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
                           const char *file, int line)
{
    void *ret = NULL;
    if (str == NULL)
        return CRYPTO_malloc(num, file, line);
    if (num == 0) {
        CRYPTO_clear_free(str, old_len);
        return NULL;
    }
    if (num < old_len) {
        memset((char*)str + num, 0, old_len - num);
        return str;
    }
#ifdef CRYPTO_MDEBUG
    if (call_malloc_debug) {
        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);
        ret = malloc(num);
        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);
    } else {
        ret = malloc(num);
    }
#else
    (void)file;
    (void)line;
    ret = malloc(num);
#endif
    if (ret)
        memcpy(ret, str, old_len);
    CRYPTO_clear_free(str, old_len);
    return ret;
}
["static int str_copy(CONF *conf, char *section, char **pto, char *from)\n{\n    int q, r, rr = 0, to = 0, len = 0;\n    char *s, *e, *rp, *p, *rrp, *np, *cp, v;\n    BUF_MEM *buf;\n    if ((buf = BUF_MEM_new()) == NULL)\n        return (0);\n    len = strlen(from) + 1;\n    if (!BUF_MEM_grow(buf, len))\n        goto err;\n    for (;;) {\n        if (IS_QUOTE(conf, *from)) {\n            q = *from;\n            from++;\n            while (!IS_EOF(conf, *from) && (*from != q)) {\n                if (IS_ESC(conf, *from)) {\n                    from++;\n                    if (IS_EOF(conf, *from))\n                        break;\n                }\n                buf->data[to++] = *(from++);\n            }\n            if (*from == q)\n                from++;\n        } else if (IS_DQUOTE(conf, *from)) {\n            q = *from;\n            from++;\n            while (!IS_EOF(conf, *from)) {\n                if (*from == q) {\n                    if (*(from + 1) == q) {\n                        from++;\n                    } else {\n                        break;\n                    }\n                }\n                buf->data[to++] = *(from++);\n            }\n            if (*from == q)\n                from++;\n        } else if (IS_ESC(conf, *from)) {\n            from++;\n            v = *(from++);\n            if (IS_EOF(conf, v))\n                break;\n            else if (v == 'r')\n                v = '\\r';\n            else if (v == 'n')\n                v = '\\n';\n            else if (v == 'b')\n                v = '\\b';\n            else if (v == 't')\n                v = '\\t';\n            buf->data[to++] = v;\n        } else if (IS_EOF(conf, *from))\n            break;\n        else if (*from == '$') {\n            rrp = NULL;\n            s = &(from[1]);\n            if (*s == '{')\n                q = '}';\n            else if (*s == '(')\n                q = ')';\n            else\n                q = 0;\n            if (q)\n                s++;\n            cp = section;\n            e = np = s;\n            while (IS_ALPHA_NUMERIC(conf, *e))\n                e++;\n            if ((e[0] == ':') && (e[1] == ':')) {\n                cp = np;\n                rrp = e;\n                rr = *e;\n                *rrp = '\\0';\n                e += 2;\n                np = e;\n                while (IS_ALPHA_NUMERIC(conf, *e))\n                    e++;\n            }\n            r = *e;\n            *e = '\\0';\n            rp = e;\n            if (q) {\n                if (r != q) {\n                    CONFerr(CONF_F_STR_COPY, CONF_R_NO_CLOSE_BRACE);\n                    goto err;\n                }\n                e++;\n            }\n            p = _CONF_get_string(conf, cp, np);\n            if (rrp != NULL)\n                *rrp = rr;\n            *rp = r;\n            if (p == NULL) {\n                CONFerr(CONF_F_STR_COPY, CONF_R_VARIABLE_HAS_NO_VALUE);\n                goto err;\n            }\n            if (!BUF_MEM_grow_clean(buf,\n                        (strlen(p) + buf->length - (e - from)))) {\n                CONFerr(CONF_F_STR_COPY, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            while (*p)\n                buf->data[to++] = *(p++);\n            len -= e - from;\n            from = e;\n            *rp = r;\n        } else\n            buf->data[to++] = *(from++);\n    }\n    buf->data[to] = '\\0';\n    OPENSSL_free(*pto);\n    *pto = buf->data;\n    OPENSSL_free(buf);\n    return (1);\n err:\n    BUF_MEM_free(buf);\n    return (0);\n}", 'size_t BUF_MEM_grow(BUF_MEM *str, size_t len)\n{\n    char *ret;\n    size_t n;\n    if (str->length >= len) {\n        str->length = len;\n        return (len);\n    }\n    if (str->max >= len) {\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n        return (len);\n    }\n    if (len > LIMIT_BEFORE_EXPANSION) {\n        BUFerr(BUF_F_BUF_MEM_GROW, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    n = (len + 3) / 3 * 4;\n    if ((str->flags & BUF_MEM_FLAG_SECURE))\n        ret = sec_alloc_realloc(str, n);\n    else\n        ret = OPENSSL_realloc(str->data, n);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_MEM_GROW, ERR_R_MALLOC_FAILURE);\n        len = 0;\n    } else {\n        str->data = ret;\n        str->max = n;\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n    }\n    return (len);\n}', 'size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)\n{\n    char *ret;\n    size_t n;\n    if (str->length >= len) {\n        memset(&str->data[len], 0, str->length - len);\n        str->length = len;\n        return (len);\n    }\n    if (str->max >= len) {\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n        return (len);\n    }\n    if (len > LIMIT_BEFORE_EXPANSION) {\n        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    n = (len + 3) / 3 * 4;\n    if ((str->flags & BUF_MEM_FLAG_SECURE))\n        ret = sec_alloc_realloc(str, n);\n    else\n        ret = OPENSSL_clear_realloc(str->data, str->max, n);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);\n        len = 0;\n    } else {\n        str->data = ret;\n        str->max = n;\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n    }\n    return (len);\n}', 'void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,\n                           const char *file, int line)\n{\n    void *ret = NULL;\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_clear_free(str, old_len);\n        return NULL;\n    }\n    if (num < old_len) {\n        memset((char*)str + num, 0, old_len - num);\n        return str;\n    }\n#ifdef CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n    if (ret)\n        memcpy(ret, str, old_len);\n    CRYPTO_clear_free(str, old_len);\n    return ret;\n}']