apps/rehash.c:231: error: BUFFER_OVERRUN_L2
  Offset added: [0, 2147483646] Size: 32768 by call to `add_entry`.
Showing all 14 steps of the trace


apps/rehash.c:200:1: Array declaration
198.    * This can be -1 if bad filename, or an error count.
199.    */
200. > static int handle_symlink(const char *filename, const char *fullpath)
201.   {
202.       unsigned int hash = 0;

apps/rehash.c:231:12: Call
229.       linktarget[n] = 0;
230.   
231.       return add_entry(type, hash, linktarget, NULL, 0, id);
                  ^
232.   }
233.   

apps/rehash.c:132:1: Parameter `*filename`
  130.    * Process an entry; return number of errors.
  131.    */
  132. > static int add_entry(enum Type type, unsigned int hash, const char *filename,
  133.                         const unsigned char *digest, int need_symlink,
  134.                         unsigned short old_id)

apps/rehash.c:178:24: Call
  176.           *ep = nilhentry;
  177.           ep->old_id = ~0;
  178.           ep->filename = BUF_strdup(filename);
                                ^
  179.           if (bp->last_entry)
  180.               bp->last_entry->next = ep;

crypto/buffer/buf_str.c:73:1: Parameter `*str`
    71.   }
    72.   
    73. > char *BUF_strdup(const char *str)
    74.   {
    75.       if (str == NULL)

crypto/buffer/buf_str.c:77:12: Call
    75.       if (str == NULL)
    76.           return NULL;
    77.       return BUF_strndup(str, strlen(str));
                     ^
    78.   }
    79.   

crypto/buffer/buf_str.c:87:11: <Offset trace>
85.           return NULL;
86.   
87.       siz = BUF_strnlen(str, siz);
                ^
88.   
89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:87:11: Call
      85.           return NULL;
      86.   
      87.       siz = BUF_strnlen(str, siz);
                      ^
      88.   
      89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:64:1: Parameter `*str`
        62.   #include <openssl/buffer.h>
        63.   
        64. > size_t BUF_strnlen(const char *str, size_t maxlen)
        65.   {
        66.       const char *p;

crypto/buffer/buf_str.c:70:5: Assignment
        68.       for (p = str; maxlen-- != 0 && *p != '\0'; ++p) ;
        69.   
        70.       return p - str;
                  ^
        71.   }
        72.   

crypto/buffer/buf_str.c:87:5: Assignment
      85.           return NULL;
      86.   
      87.       siz = BUF_strnlen(str, siz);
                ^
      88.   
      89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:80:1: <Length trace>
78.   }
79.   
80. > char *BUF_strndup(const char *str, size_t siz)
81.   {
82.       char *ret;

crypto/buffer/buf_str.c:80:1: Parameter `*str`
      78.   }
      79.   
      80. > char *BUF_strndup(const char *str, size_t siz)
      81.   {
      82.       char *ret;

crypto/buffer/buf_str.c:98:5: Array access: Offset added: [0, 2147483646] Size: 32768 by call to `add_entry` 
      96.       }
      97.   
      98.       memcpy(ret, str, siz);
                 ^
      99.       ret[siz] = '\0';
      100.   

char *BUF_strndup(const char *str, size_t siz)
{
    char *ret;
    if (str == NULL)
        return NULL;
    siz = BUF_strnlen(str, siz);
    if (siz >= INT_MAX)
        return NULL;
    ret = OPENSSL_malloc(siz + 1);
    if (ret == NULL) {
        BUFerr(BUF_F_BUF_STRNDUP, ERR_R_MALLOC_FAILURE);
        return NULL;
    }
    memcpy(ret, str, siz);
    ret[siz] = '\0';
    return (ret);
}
["static int handle_symlink(const char *filename, const char *fullpath)\n{\n    unsigned int hash = 0;\n    int i, type, id;\n    unsigned char ch;\n    char linktarget[PATH_MAX], *endptr;\n    ssize_t n;\n    for (i = 0; i < 8; i++) {\n        ch = filename[i];\n        if (!isxdigit(ch))\n            return -1;\n        hash <<= 4;\n        hash += app_hex(ch);\n    }\n    if (filename[i++] != '.')\n        return -1;\n    for (type = OSSL_NELEM(suffixes) - 1; type > 0; type--)\n        if (strcasecmp(suffixes[type], &filename[i]) == 0)\n            break;\n    i += strlen(suffixes[type]);\n    id = strtoul(&filename[i], &endptr, 10);\n    if (*endptr != '\\0')\n        return -1;\n    n = readlink(fullpath, linktarget, sizeof(linktarget));\n    if (n < 0 || n >= (int)sizeof(linktarget))\n        return -1;\n    linktarget[n] = 0;\n    return add_entry(type, hash, linktarget, NULL, 0, id);\n}", 'static int add_entry(enum Type type, unsigned int hash, const char *filename,\n                      const unsigned char *digest, int need_symlink,\n                      unsigned short old_id)\n{\n    static BUCKET nilbucket;\n    static HENTRY nilhentry;\n    BUCKET *bp;\n    HENTRY *ep, *found = NULL;\n    unsigned int ndx = (type + hash) % OSSL_NELEM(hash_table);\n    for (bp = hash_table[ndx]; bp; bp = bp->next)\n        if (bp->type == type && bp->hash == hash)\n            break;\n    if (bp == NULL) {\n        bp = app_malloc(sizeof(*bp), "hash bucket");\n        *bp = nilbucket;\n        bp->next = hash_table[ndx];\n        bp->type = type;\n        bp->hash = hash;\n        hash_table[ndx] = bp;\n    }\n    for (ep = bp->first_entry; ep; ep = ep->next) {\n        if (digest && memcmp(digest, ep->digest, evpmdsize) == 0) {\n            BIO_printf(bio_err,\n                       "%s: skipping duplicate certificate in %s\\n",\n                       opt_getprog(), filename);\n            return 1;\n        }\n        if (strcmp(filename, ep->filename) == 0) {\n            found = ep;\n            if (digest == NULL)\n                break;\n        }\n    }\n    ep = found;\n    if (ep == NULL) {\n        if (bp->num_needed >= MAX_COLLISIONS) {\n            BIO_printf(bio_err,\n                       "%s: hash table overflow for %s\\n",\n                       opt_getprog(), filename);\n            return 1;\n        }\n        ep = app_malloc(sizeof(*ep), "collision bucket");\n        *ep = nilhentry;\n        ep->old_id = ~0;\n        ep->filename = BUF_strdup(filename);\n        if (bp->last_entry)\n            bp->last_entry->next = ep;\n        if (bp->first_entry == NULL)\n            bp->first_entry = ep;\n        bp->last_entry = ep;\n    }\n    if (old_id < ep->old_id)\n        ep->old_id = old_id;\n    if (need_symlink && !ep->need_symlink) {\n        ep->need_symlink = 1;\n        bp->num_needed++;\n        memcpy(ep->digest, digest, evpmdsize);\n    }\n    return 0;\n}', 'char *BUF_strdup(const char *str)\n{\n    if (str == NULL)\n        return NULL;\n    return BUF_strndup(str, strlen(str));\n}', "char *BUF_strndup(const char *str, size_t siz)\n{\n    char *ret;\n    if (str == NULL)\n        return NULL;\n    siz = BUF_strnlen(str, siz);\n    if (siz >= INT_MAX)\n        return NULL;\n    ret = OPENSSL_malloc(siz + 1);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_STRNDUP, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    memcpy(ret, str, siz);\n    ret[siz] = '\\0';\n    return (ret);\n}", "size_t BUF_strnlen(const char *str, size_t maxlen)\n{\n    const char *p;\n    for (p = str; maxlen-- != 0 && *p != '\\0'; ++p) ;\n    return p - str;\n}"]