apps/verify.c:151: error: BUFFER_OVERRUN_L3
  Offset: [0, 1] Size: [0, +oo] by call to `X509_STORE_free`.
Showing all 9 steps of the trace


apps/verify.c:88:11: Call
86.   	X509_LOOKUP *lookup=NULL;
87.   
88.   	cert_ctx=X509_STORE_new();
                ^
89.   	if (cert_ctx == NULL) goto end;
90.   	X509_STORE_set_verify_cb_func(cert_ctx,cb);

crypto/x509/x509_lu.c:204:24: Call
  202.   	ret->certs=lh_new(x509_object_hash,x509_object_cmp);
  203.   	ret->cache=1;
  204.   	ret->get_cert_methods=sk_new_null();
                                ^
  205.   	ret->verify=NULL;
  206.   	ret->verify_cb=NULL;

crypto/stack/stack.c:130:2: Assignment
    128.   	ret->comp=c;
    129.   	ret->num_alloc=MIN_NODES;
    130.   	ret->num=0;
            ^
    131.   	ret->sorted=0;
    132.   	return(ret);

apps/verify.c:151:24: Call
149.   	if (ret == 1)
150.   		BIO_printf(bio_err,"usage: verify [-verbose] [-CApath path] [-CAfile file] cert1 cert2 ...\n");
151.   	if (cert_ctx != NULL) X509_STORE_free(cert_ctx);
                              ^
152.   	EXIT(ret);
153.   	}

crypto/x509/x509_lu.c:229:1: <Offset trace>
227.   	}
228.   
229. > void X509_STORE_free(X509_STORE *vfy)
230.   	{
231.   	int i;

crypto/x509/x509_lu.c:229:1: Parameter `vfy->get_cert_methods->num`
  227.   	}
  228.   
  229. > void X509_STORE_free(X509_STORE *vfy)
  230.   	{
  231.   	int i;

crypto/x509/x509_lu.c:229:1: <Length trace>
227.   	}
228.   
229. > void X509_STORE_free(X509_STORE *vfy)
230.   	{
231.   	int i;

crypto/x509/x509_lu.c:229:1: Parameter `*vfy->get_cert_methods->data`
  227.   	}
  228.   
  229. > void X509_STORE_free(X509_STORE *vfy)
  230.   	{
  231.   	int i;

crypto/x509/x509_lu.c:241:21: Array access: Offset: [0, 1] Size: [0, +oo] by call to `X509_STORE_free` 
  239.   	for (i=0; i<sk_num(sk); i++)
  240.   		{
  241.   		lu=(X509_LOOKUP *)sk_value(sk,i);
                             ^
  242.   		X509_LOOKUP_shutdown(lu);
  243.   		X509_LOOKUP_free(lu);

void X509_STORE_free(X509_STORE *vfy)
	{
	int i;
	STACK *sk;
	X509_LOOKUP *lu;
	if(vfy == NULL)
	    return;
	sk=vfy->get_cert_methods;
	for (i=0; i<sk_num(sk); i++)
		{
		lu=(X509_LOOKUP *)sk_value(sk,i);
		X509_LOOKUP_shutdown(lu);
		X509_LOOKUP_free(lu);
		}
	sk_free(sk);
	CRYPTO_free_ex_data(x509_store_meth,(char *)vfy,&vfy->ex_data);
	lh_doall(vfy->certs,cleanup);
	lh_free(vfy->certs);
	Free(vfy);
	}
['int MAIN(int argc, char **argv)\n\t{\n\tint i,ret=1;\n\tchar *CApath=NULL,*CAfile=NULL;\n\tX509_STORE *cert_ctx=NULL;\n\tX509_LOOKUP *lookup=NULL;\n\tcert_ctx=X509_STORE_new();\n\tif (cert_ctx == NULL) goto end;\n\tX509_STORE_set_verify_cb_func(cert_ctx,cb);\n\tERR_load_crypto_strings();\n\tapps_startup();\n\tif (bio_err == NULL)\n\t\tif ((bio_err=BIO_new(BIO_s_file())) != NULL)\n\t\t\tBIO_set_fp(bio_err,stderr,BIO_NOCLOSE|BIO_FP_TEXT);\n\targc--;\n\targv++;\n\tfor (;;)\n\t\t{\n\t\tif (argc >= 1)\n\t\t\t{\n\t\t\tif (strcmp(*argv,"-CApath") == 0)\n\t\t\t\t{\n\t\t\t\tif (argc-- < 1) goto end;\n\t\t\t\tCApath= *(++argv);\n\t\t\t\t}\n\t\t\telse if (strcmp(*argv,"-CAfile") == 0)\n\t\t\t\t{\n\t\t\t\tif (argc-- < 1) goto end;\n\t\t\t\tCAfile= *(++argv);\n\t\t\t\t}\n\t\t\telse if (strcmp(*argv,"-help") == 0)\n\t\t\t\tgoto end;\n\t\t\telse if (strcmp(*argv,"-verbose") == 0)\n\t\t\t\tv_verbose=1;\n\t\t\telse if (argv[0][0] == \'-\')\n\t\t\t\tgoto end;\n\t\t\telse\n\t\t\t\tbreak;\n\t\t\targc--;\n\t\t\targv++;\n\t\t\t}\n\t\telse\n\t\t\tbreak;\n\t\t}\n\tlookup=X509_STORE_add_lookup(cert_ctx,X509_LOOKUP_file());\n\tif (lookup == NULL) abort();\n\tif (!X509_LOOKUP_load_file(lookup,CAfile,X509_FILETYPE_PEM))\n\t\tX509_LOOKUP_load_file(lookup,NULL,X509_FILETYPE_DEFAULT);\n\tlookup=X509_STORE_add_lookup(cert_ctx,X509_LOOKUP_hash_dir());\n\tif (lookup == NULL) abort();\n\tif (!X509_LOOKUP_add_dir(lookup,CApath,X509_FILETYPE_PEM))\n\t\tX509_LOOKUP_add_dir(lookup,NULL,X509_FILETYPE_DEFAULT);\n\tERR_clear_error();\n\tif (argc < 1) check(cert_ctx,NULL);\n\telse\n\t\tfor (i=0; i<argc; i++)\n\t\t\tcheck(cert_ctx,argv[i]);\n\tret=0;\nend:\n\tif (ret == 1)\n\t\tBIO_printf(bio_err,"usage: verify [-verbose] [-CApath path] [-CAfile file] cert1 cert2 ...\\n");\n\tif (cert_ctx != NULL) X509_STORE_free(cert_ctx);\n\tEXIT(ret);\n\t}', 'X509_STORE *X509_STORE_new(void)\n\t{\n\tX509_STORE *ret;\n\tif ((ret=(X509_STORE *)Malloc(sizeof(X509_STORE))) == NULL)\n\t\treturn(NULL);\n\tret->certs=lh_new(x509_object_hash,x509_object_cmp);\n\tret->cache=1;\n\tret->get_cert_methods=sk_new_null();\n\tret->verify=NULL;\n\tret->verify_cb=NULL;\n\tmemset(&ret->ex_data,0,sizeof(CRYPTO_EX_DATA));\n\tret->references=1;\n\tret->depth=0;\n\treturn(ret);\n\t}', 'STACK *sk_new(int (*c)())\n\t{\n\tSTACK *ret;\n\tint i;\n\tif ((ret=(STACK *)Malloc(sizeof(STACK))) == NULL)\n\t\tgoto err0;\n\tif ((ret->data=(char **)Malloc(sizeof(char *)*MIN_NODES)) == NULL)\n\t\tgoto err1;\n\tfor (i=0; i<MIN_NODES; i++)\n\t\tret->data[i]=NULL;\n\tret->comp=c;\n\tret->num_alloc=MIN_NODES;\n\tret->num=0;\n\tret->sorted=0;\n\treturn(ret);\nerr1:\n\tFree((char *)ret);\nerr0:\n\treturn(NULL);\n\t}', 'void X509_STORE_free(X509_STORE *vfy)\n\t{\n\tint i;\n\tSTACK *sk;\n\tX509_LOOKUP *lu;\n\tif(vfy == NULL)\n\t    return;\n\tsk=vfy->get_cert_methods;\n\tfor (i=0; i<sk_num(sk); i++)\n\t\t{\n\t\tlu=(X509_LOOKUP *)sk_value(sk,i);\n\t\tX509_LOOKUP_shutdown(lu);\n\t\tX509_LOOKUP_free(lu);\n\t\t}\n\tsk_free(sk);\n\tCRYPTO_free_ex_data(x509_store_meth,(char *)vfy,&vfy->ex_data);\n\tlh_doall(vfy->certs,cleanup);\n\tlh_free(vfy->certs);\n\tFree(vfy);\n\t}']