crypto/err/err.c:517: error: BUFFER_OVERRUN_L3
  Offset: [16, +oo] Size: [1, +oo] by call to `lh_ERR_STRING_DATA_insert`.
Showing all 18 steps of the trace


crypto/err/err.c:512:12: Call
510.   
511.       CRYPTO_w_lock(CRYPTO_LOCK_ERR);
512.       hash = get_hash(1, 0);
                  ^
513.       if (hash) {
514.           for (; str->error; str++) {

crypto/err/err.c:269:26: Call
  267.           CRYPTO_w_lock(CRYPTO_LOCK_ERR);
  268.       if (!int_error_hash && create) {
  269.           int_error_hash = lh_ERR_STRING_DATA_new(err_string_data_hash,
                                  ^
  270.                                                   err_string_data_cmp);
  271.       }

include/openssl/err.h:318:1: Call
    316.   } ERR_STRING_DATA;
    317.   
    318. > DEFINE_LHASH_OF(ERR_STRING_DATA);
    319.   
    320.   void ERR_put_error(int lib, int func, int reason, const char *file, int line);

crypto/lhash/lhash.c:124:5: Assignment
      122.       ret->hash = ((h == NULL) ? (LHASH_HASH_FN_TYPE)lh_strhash : h);
      123.       ret->num_nodes = MIN_NODES / 2;
      124.       ret->num_alloc_nodes = MIN_NODES;
                 ^
      125.       ret->pmax = MIN_NODES / 2;
      126.       ret->up_load = UP_LOAD;

crypto/err/err.c:517:19: Call
515.               if (lib)
516.                   str->error |= ERR_PACK(lib, 0, 0);
517.               (void)lh_ERR_STRING_DATA_insert(hash, str);
                         ^
518.           }
519.       }

include/openssl/err.h:318:1: Parameter `lh->num_alloc_nodes`
  316.   } ERR_STRING_DATA;
  317.   
  318. > DEFINE_LHASH_OF(ERR_STRING_DATA);
  319.   
  320.   void ERR_put_error(int lib, int func, int reason, const char *file, int line);

include/openssl/err.h:318:1: Call
  316.   } ERR_STRING_DATA;
  317.   
  318. > DEFINE_LHASH_OF(ERR_STRING_DATA);
  319.   
  320.   void ERR_put_error(int lib, int func, int reason, const char *file, int line);

crypto/lhash/lhash.c:156:1: Parameter `lh->num_alloc_nodes`
    154.   }
    155.   
    156. > void *lh_insert(_LHASH *lh, void *data)
    157.   {
    158.       unsigned long hash;

crypto/lhash/lhash.c:164:9: Call
    162.       lh->error = 0;
    163.       if (lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes))
    164.           expand(lh);
                   ^
    165.   
    166.       rn = getrn(lh, data, &hash);

crypto/lhash/lhash.c:279:1: <Offset trace>
277.   }
278.   
279. > static void expand(_LHASH *lh)
280.   {
281.       LHASH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:279:1: Parameter `lh->num_alloc_nodes`
      277.   }
      278.   
      279. > static void expand(_LHASH *lh)
      280.   {
      281.       LHASH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:305:9: Assignment
      303.   
      304.       if ((lh->p) >= lh->pmax) {
      305.           j = (int)lh->num_alloc_nodes * 2;
                     ^
      306.           n = OPENSSL_realloc(lh->b, (int)(sizeof(LHASH_NODE *) * j));
      307.           if (n == NULL) {

crypto/lhash/lhash.c:279:1: <Length trace>
277.   }
278.   
279. > static void expand(_LHASH *lh)
280.   {
281.       LHASH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:279:1: Parameter `*lh->b`
      277.   }
      278.   
      279. > static void expand(_LHASH *lh)
      280.   {
      281.       LHASH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:306:13: Call
      304.       if ((lh->p) >= lh->pmax) {
      305.           j = (int)lh->num_alloc_nodes * 2;
      306.           n = OPENSSL_realloc(lh->b, (int)(sizeof(LHASH_NODE *) * j));
                         ^
      307.           if (n == NULL) {
      308.               /* fputs("realloc error in lhash",stderr); */

crypto/mem.c:173:9: Assignment
        171.       if (num == 0) {
        172.           CRYPTO_free(str);
        173.           return NULL;
                       ^
        174.       }
        175.   

crypto/lhash/lhash.c:306:9: Assignment
      304.       if ((lh->p) >= lh->pmax) {
      305.           j = (int)lh->num_alloc_nodes * 2;
      306.           n = OPENSSL_realloc(lh->b, (int)(sizeof(LHASH_NODE *) * j));
                     ^
      307.           if (n == NULL) {
      308.               /* fputs("realloc error in lhash",stderr); */

crypto/lhash/lhash.c:314:13: Array access: Offset: [16, +oo] Size: [1, +oo] by call to `lh_ERR_STRING_DATA_insert` 
      312.           }
      313.           for (i = (int)lh->num_alloc_nodes; i < j; i++) /* 26/02/92 eay */
      314.               n[i] = NULL;        /* 02/03/92 eay */
                         ^
      315.           lh->pmax = lh->num_alloc_nodes;
      316.           lh->num_alloc_nodes = j;

static void expand(_LHASH *lh)
{
    LHASH_NODE **n, **n1, **n2, *np;
    unsigned int p, i, j;
    unsigned long hash, nni;
    lh->num_nodes++;
    lh->num_expands++;
    p = (int)lh->p++;
    n1 = &(lh->b[p]);
    n2 = &(lh->b[p + (int)lh->pmax]);
    *n2 = NULL;
    nni = lh->num_alloc_nodes;
    for (np = *n1; np != NULL;) {
        hash = np->hash;
        if ((hash % nni) != p) {
            *n1 = (*n1)->next;
            np->next = *n2;
            *n2 = np;
        } else
            n1 = &((*n1)->next);
        np = *n1;
    }
    if ((lh->p) >= lh->pmax) {
        j = (int)lh->num_alloc_nodes * 2;
        n = OPENSSL_realloc(lh->b, (int)(sizeof(LHASH_NODE *) * j));
        if (n == NULL) {
            lh->error++;
            lh->p = 0;
            return;
        }
        for (i = (int)lh->num_alloc_nodes; i < j; i++)
            n[i] = NULL;
        lh->pmax = lh->num_alloc_nodes;
        lh->num_alloc_nodes = j;
        lh->num_expand_reallocs++;
        lh->p = 0;
        lh->b = n;
    }
}
['static void err_load_strings(int lib, ERR_STRING_DATA *str)\n{\n    LHASH_OF(ERR_STRING_DATA) *hash;\n    CRYPTO_w_lock(CRYPTO_LOCK_ERR);\n    hash = get_hash(1, 0);\n    if (hash) {\n        for (; str->error; str++) {\n            if (lib)\n                str->error |= ERR_PACK(lib, 0, 0);\n            (void)lh_ERR_STRING_DATA_insert(hash, str);\n        }\n    }\n    CRYPTO_w_unlock(CRYPTO_LOCK_ERR);\n}', 'static LHASH_OF(ERR_STRING_DATA) *get_hash(int create, int lockit)\n{\n    LHASH_OF(ERR_STRING_DATA) *ret = NULL;\n    if (lockit)\n        CRYPTO_w_lock(CRYPTO_LOCK_ERR);\n    if (!int_error_hash && create) {\n        int_error_hash = lh_ERR_STRING_DATA_new(err_string_data_hash,\n                                                err_string_data_cmp);\n    }\n    if (int_error_hash != NULL)\n        ret = int_error_hash;\n    if (lockit)\n        CRYPTO_w_unlock(CRYPTO_LOCK_ERR);\n    return ret;\n}', 'DEFINE_LHASH_OF(ERR_STRING_DATA)', '_LHASH *lh_new(LHASH_HASH_FN_TYPE h, LHASH_COMP_FN_TYPE c)\n{\n    _LHASH *ret;\n    if ((ret = OPENSSL_zalloc(sizeof(*ret))) == NULL)\n        goto err0;\n    if ((ret->b = OPENSSL_zalloc(sizeof(*ret->b) * MIN_NODES)) == NULL)\n        goto err1;\n    ret->comp = ((c == NULL) ? (LHASH_COMP_FN_TYPE)strcmp : c);\n    ret->hash = ((h == NULL) ? (LHASH_HASH_FN_TYPE)lh_strhash : h);\n    ret->num_nodes = MIN_NODES / 2;\n    ret->num_alloc_nodes = MIN_NODES;\n    ret->pmax = MIN_NODES / 2;\n    ret->up_load = UP_LOAD;\n    ret->down_load = DOWN_LOAD;\n    return (ret);\n err1:\n    OPENSSL_free(ret);\n err0:\n    return (NULL);\n}', 'void *lh_insert(_LHASH *lh, void *data)\n{\n    unsigned long hash;\n    LHASH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    if (lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes))\n        expand(lh);\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        if ((nn = OPENSSL_malloc(sizeof(*nn))) == NULL) {\n            lh->error++;\n            return (NULL);\n        }\n        nn->data = data;\n        nn->next = NULL;\n        nn->hash = hash;\n        *rn = nn;\n        ret = NULL;\n        lh->num_insert++;\n        lh->num_items++;\n    } else {\n        ret = (*rn)->data;\n        (*rn)->data = data;\n        lh->num_replace++;\n    }\n    return (ret);\n}', 'static void expand(_LHASH *lh)\n{\n    LHASH_NODE **n, **n1, **n2, *np;\n    unsigned int p, i, j;\n    unsigned long hash, nni;\n    lh->num_nodes++;\n    lh->num_expands++;\n    p = (int)lh->p++;\n    n1 = &(lh->b[p]);\n    n2 = &(lh->b[p + (int)lh->pmax]);\n    *n2 = NULL;\n    nni = lh->num_alloc_nodes;\n    for (np = *n1; np != NULL;) {\n        hash = np->hash;\n        if ((hash % nni) != p) {\n            *n1 = (*n1)->next;\n            np->next = *n2;\n            *n2 = np;\n        } else\n            n1 = &((*n1)->next);\n        np = *n1;\n    }\n    if ((lh->p) >= lh->pmax) {\n        j = (int)lh->num_alloc_nodes * 2;\n        n = OPENSSL_realloc(lh->b, (int)(sizeof(LHASH_NODE *) * j));\n        if (n == NULL) {\n            lh->error++;\n            lh->p = 0;\n            return;\n        }\n        for (i = (int)lh->num_alloc_nodes; i < j; i++)\n            n[i] = NULL;\n        lh->pmax = lh->num_alloc_nodes;\n        lh->num_alloc_nodes = j;\n        lh->num_expand_reallocs++;\n        lh->p = 0;\n        lh->b = n;\n    }\n}', 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str);\n        return NULL;\n    }\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    (void)file;\n    (void)line;\n#endif\n    return realloc(str, num);\n}']