crypto/x509v3/v3_alt.c:166: error: BUFFER_OVERRUN_L2
  Offset added: [0, 2147483646] Size: 80 by call to `X509V3_add_value`.
Showing all 13 steps of the trace


crypto/x509v3/v3_alt.c:166:13: Call
164.               }
165.           } else {
166.               X509V3_add_value("IP Address", "<invalid>", &ret);
                   ^
167.               break;
168.           }

crypto/x509v3/v3_utl.c:83:1: Parameter `*value`
  81.   /* Add a CONF_VALUE name value pair to stack */
  82.   
  83. > int X509V3_add_value(const char *name, const char *value,
  84.                        STACK_OF(CONF_VALUE) **extlist)
  85.   {

crypto/x509v3/v3_utl.c:91:28: Call
  89.       if (name && (tname = BUF_strdup(name)) == NULL)
  90.           goto err;
  91.       if (value && (tvalue = BUF_strdup(value)) == NULL)
                                   ^
  92.           goto err;
  93.       if ((vtmp = OPENSSL_malloc(sizeof(*vtmp))) == NULL)

crypto/buffer/buf_str.c:73:1: Parameter `*str`
    71.   }
    72.   
    73. > char *BUF_strdup(const char *str)
    74.   {
    75.       if (str == NULL)

crypto/buffer/buf_str.c:77:12: Call
    75.       if (str == NULL)
    76.           return NULL;
    77.       return BUF_strndup(str, strlen(str));
                     ^
    78.   }
    79.   

crypto/buffer/buf_str.c:87:11: <Offset trace>
85.           return NULL;
86.   
87.       siz = BUF_strnlen(str, siz);
                ^
88.   
89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:87:11: Call
      85.           return NULL;
      86.   
      87.       siz = BUF_strnlen(str, siz);
                      ^
      88.   
      89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:64:1: Parameter `*str`
        62.   #include <openssl/buffer.h>
        63.   
        64. > size_t BUF_strnlen(const char *str, size_t maxlen)
        65.   {
        66.       const char *p;

crypto/buffer/buf_str.c:70:5: Assignment
        68.       for (p = str; maxlen-- != 0 && *p != '\0'; ++p) ;
        69.   
        70.       return p - str;
                  ^
        71.   }
        72.   

crypto/buffer/buf_str.c:87:5: Assignment
      85.           return NULL;
      86.   
      87.       siz = BUF_strnlen(str, siz);
                ^
      88.   
      89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:80:1: <Length trace>
78.   }
79.   
80. > char *BUF_strndup(const char *str, size_t siz)
81.   {
82.       char *ret;

crypto/buffer/buf_str.c:80:1: Parameter `*str`
      78.   }
      79.   
      80. > char *BUF_strndup(const char *str, size_t siz)
      81.   {
      82.       char *ret;

crypto/buffer/buf_str.c:98:5: Array access: Offset added: [0, 2147483646] Size: 80 by call to `X509V3_add_value` 
      96.       }
      97.   
      98.       memcpy(ret, str, siz);
                 ^
      99.       ret[siz] = '\0';
      100.   

char *BUF_strndup(const char *str, size_t siz)
{
    char *ret;
    if (str == NULL)
        return NULL;
    siz = BUF_strnlen(str, siz);
    if (siz >= INT_MAX)
        return NULL;
    ret = OPENSSL_malloc(siz + 1);
    if (ret == NULL) {
        BUFerr(BUF_F_BUF_STRNDUP, ERR_R_MALLOC_FAILURE);
        return NULL;
    }
    memcpy(ret, str, siz);
    ret[siz] = '\0';
    return (ret);
}
['STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,\n                                       GENERAL_NAME *gen,\n                                       STACK_OF(CONF_VALUE) *ret)\n{\n    unsigned char *p;\n    char oline[256], htmp[5];\n    int i;\n    switch (gen->type) {\n    case GEN_OTHERNAME:\n        X509V3_add_value("othername", "<unsupported>", &ret);\n        break;\n    case GEN_X400:\n        X509V3_add_value("X400Name", "<unsupported>", &ret);\n        break;\n    case GEN_EDIPARTY:\n        X509V3_add_value("EdiPartyName", "<unsupported>", &ret);\n        break;\n    case GEN_EMAIL:\n        X509V3_add_value_uchar("email", gen->d.ia5->data, &ret);\n        break;\n    case GEN_DNS:\n        X509V3_add_value_uchar("DNS", gen->d.ia5->data, &ret);\n        break;\n    case GEN_URI:\n        X509V3_add_value_uchar("URI", gen->d.ia5->data, &ret);\n        break;\n    case GEN_DIRNAME:\n        X509_NAME_oneline(gen->d.dirn, oline, 256);\n        X509V3_add_value("DirName", oline, &ret);\n        break;\n    case GEN_IPADD:\n        p = gen->d.ip->data;\n        if (gen->d.ip->length == 4)\n            BIO_snprintf(oline, sizeof oline,\n                         "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);\n        else if (gen->d.ip->length == 16) {\n            oline[0] = 0;\n            for (i = 0; i < 8; i++) {\n                BIO_snprintf(htmp, sizeof htmp, "%X", p[0] << 8 | p[1]);\n                p += 2;\n                strcat(oline, htmp);\n                if (i != 7)\n                    strcat(oline, ":");\n            }\n        } else {\n            X509V3_add_value("IP Address", "<invalid>", &ret);\n            break;\n        }\n        X509V3_add_value("IP Address", oline, &ret);\n        break;\n    case GEN_RID:\n        i2t_ASN1_OBJECT(oline, 256, gen->d.rid);\n        X509V3_add_value("Registered ID", oline, &ret);\n        break;\n    }\n    return ret;\n}', 'int X509V3_add_value(const char *name, const char *value,\n                     STACK_OF(CONF_VALUE) **extlist)\n{\n    CONF_VALUE *vtmp = NULL;\n    char *tname = NULL, *tvalue = NULL;\n    if (name && (tname = BUF_strdup(name)) == NULL)\n        goto err;\n    if (value && (tvalue = BUF_strdup(value)) == NULL)\n        goto err;\n    if ((vtmp = OPENSSL_malloc(sizeof(*vtmp))) == NULL)\n        goto err;\n    if (*extlist == NULL && (*extlist = sk_CONF_VALUE_new_null()) == NULL)\n        goto err;\n    vtmp->section = NULL;\n    vtmp->name = tname;\n    vtmp->value = tvalue;\n    if (!sk_CONF_VALUE_push(*extlist, vtmp))\n        goto err;\n    return 1;\n err:\n    X509V3err(X509V3_F_X509V3_ADD_VALUE, ERR_R_MALLOC_FAILURE);\n    OPENSSL_free(vtmp);\n    OPENSSL_free(tname);\n    OPENSSL_free(tvalue);\n    return 0;\n}', 'char *BUF_strdup(const char *str)\n{\n    if (str == NULL)\n        return NULL;\n    return BUF_strndup(str, strlen(str));\n}', "char *BUF_strndup(const char *str, size_t siz)\n{\n    char *ret;\n    if (str == NULL)\n        return NULL;\n    siz = BUF_strnlen(str, siz);\n    if (siz >= INT_MAX)\n        return NULL;\n    ret = OPENSSL_malloc(siz + 1);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_STRNDUP, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    memcpy(ret, str, siz);\n    ret[siz] = '\\0';\n    return (ret);\n}", "size_t BUF_strnlen(const char *str, size_t maxlen)\n{\n    const char *p;\n    for (p = str; maxlen-- != 0 && *p != '\\0'; ++p) ;\n    return p - str;\n}"]