crypto/conf/conf_def.c:287: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] (⇐ [0, +oo] + -1) Size: [1, 2147483644].
Showing all 5 steps of the trace


crypto/conf/conf_def.c:243:5: <Length trace>
241.       }
242.   
243.       bufnum = 0;
           ^
244.       again = 0;
245.       for (;;) {

crypto/conf/conf_def.c:243:5: Assignment
241.       }
242.   
243.       bufnum = 0;
           ^
244.       again = 0;
245.       for (;;) {

crypto/conf/conf_def.c:277:9: Assignment
275.   
276.           /* i is the number of bytes */
277.           bufnum += i;
               ^
278.   
279.           v = NULL;

crypto/conf/conf_def.c:286:13: Assignment
284.                * is not '\\'
285.                */
286.               p = &(buff->data[bufnum - 1]);
                   ^
287.               if (IS_ESC(conf, p[0]) && ((bufnum <= 1) || !IS_ESC(conf, p[-1]))) {
288.                   bufnum--;

crypto/conf/conf_def.c:287:58: Array access: Offset: [-1, +oo] (⇐ [0, +oo] + -1) Size: [1, 2147483644]
285.                */
286.               p = &(buff->data[bufnum - 1]);
287.               if (IS_ESC(conf, p[0]) && ((bufnum <= 1) || !IS_ESC(conf, p[-1]))) {
                                                                ^
288.                   bufnum--;
289.                   again = 1;

static int def_load_bio(CONF *conf, BIO *in, long *line)
{
#define CONFBUFSIZE     512
    int bufnum = 0, i, ii;
    BUF_MEM *buff = NULL;
    char *s, *p, *end;
    int again;
    long eline = 0;
    char btmp[DECIMAL_SIZE(eline) + 1];
    CONF_VALUE *v = NULL, *tv;
    CONF_VALUE *sv = NULL;
    char *section = NULL, *buf;
    char *start, *psection, *pname;
    void *h = (void *)(conf->data);
    if ((buff = BUF_MEM_new()) == NULL) {
        CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_BUF_LIB);
        goto err;
    }
    section = OPENSSL_strdup("default");
    if (section == NULL) {
        CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    if (_CONF_new_data(conf) == 0) {
        CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE);
        goto err;
    }
    sv = _CONF_new_section(conf, section);
    if (sv == NULL) {
        CONFerr(CONF_F_DEF_LOAD_BIO, CONF_R_UNABLE_TO_CREATE_NEW_SECTION);
        goto err;
    }
    bufnum = 0;
    again = 0;
    for (;;) {
        if (!BUF_MEM_grow(buff, bufnum + CONFBUFSIZE)) {
            CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_BUF_LIB);
            goto err;
        }
        p = &(buff->data[bufnum]);
        *p = '\0';
        BIO_gets(in, p, CONFBUFSIZE - 1);
        p[CONFBUFSIZE - 1] = '\0';
        ii = i = strlen(p);
        if (i == 0 && !again)
            break;
        again = 0;
        while (i > 0) {
            if ((p[i - 1] != '\r') && (p[i - 1] != '\n'))
                break;
            else
                i--;
        }
        if (ii && i == ii)
            again = 1;
        else {
            p[i] = '\0';
            eline++;
        }
        bufnum += i;
        v = NULL;
        if (bufnum >= 1) {
            p = &(buff->data[bufnum - 1]);
            if (IS_ESC(conf, p[0]) && ((bufnum <= 1) || !IS_ESC(conf, p[-1]))) {
                bufnum--;
                again = 1;
            }
        }
        if (again)
            continue;
        bufnum = 0;
        buf = buff->data;
        clear_comments(conf, buf);
        s = eat_ws(conf, buf);
        if (IS_EOF(conf, *s))
            continue;
        if (*s == '[') {
            char *ss;
            s++;
            start = eat_ws(conf, s);
            ss = start;
 again:
            end = eat_alpha_numeric(conf, ss);
            p = eat_ws(conf, end);
            if (*p != ']') {
                if (*p != '\0' && ss != p) {
                    ss = p;
                    goto again;
                }
                CONFerr(CONF_F_DEF_LOAD_BIO,
                        CONF_R_MISSING_CLOSE_SQUARE_BRACKET);
                goto err;
            }
            *end = '\0';
            if (!str_copy(conf, NULL, &section, start))
                goto err;
            if ((sv = _CONF_get_section(conf, section)) == NULL)
                sv = _CONF_new_section(conf, section);
            if (sv == NULL) {
                CONFerr(CONF_F_DEF_LOAD_BIO,
                        CONF_R_UNABLE_TO_CREATE_NEW_SECTION);
                goto err;
            }
            continue;
        } else {
            pname = s;
            psection = NULL;
            end = eat_alpha_numeric(conf, s);
            if ((end[0] == ':') && (end[1] == ':')) {
                *end = '\0';
                end += 2;
                psection = pname;
                pname = end;
                end = eat_alpha_numeric(conf, end);
            }
            p = eat_ws(conf, end);
            if (*p != '=') {
                CONFerr(CONF_F_DEF_LOAD_BIO, CONF_R_MISSING_EQUAL_SIGN);
                goto err;
            }
            *end = '\0';
            p++;
            start = eat_ws(conf, p);
            while (!IS_EOF(conf, *p))
                p++;
            p--;
            while ((p != start) && (IS_WS(conf, *p)))
                p--;
            p++;
            *p = '\0';
            if ((v = OPENSSL_malloc(sizeof(*v))) == NULL) {
                CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE);
                goto err;
            }
            if (psection == NULL)
                psection = section;
            v->name = OPENSSL_malloc(strlen(pname) + 1);
            v->value = NULL;
            if (v->name == NULL) {
                CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE);
                goto err;
            }
            OPENSSL_strlcpy(v->name, pname, strlen(pname) + 1);
            if (!str_copy(conf, psection, &(v->value), start))
                goto err;
            if (strcmp(psection, section) != 0) {
                if ((tv = _CONF_get_section(conf, psection))
                    == NULL)
                    tv = _CONF_new_section(conf, psection);
                if (tv == NULL) {
                    CONFerr(CONF_F_DEF_LOAD_BIO,
                            CONF_R_UNABLE_TO_CREATE_NEW_SECTION);
                    goto err;
                }
            } else
                tv = sv;
            if (_CONF_add_string(conf, tv, v) == 0) {
                CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE);
                goto err;
            }
            v = NULL;
        }
    }
    BUF_MEM_free(buff);
    OPENSSL_free(section);
    return (1);
 err:
    BUF_MEM_free(buff);
    OPENSSL_free(section);
    if (line != NULL)
        *line = eline;
    BIO_snprintf(btmp, sizeof btmp, "%ld", eline);
    ERR_add_error_data(2, "line ", btmp);
    if (h != conf->data) {
        CONF_free(conf->data);
        conf->data = NULL;
    }
    if (v != NULL) {
        OPENSSL_free(v->name);
        OPENSSL_free(v->value);
        OPENSSL_free(v);
    }
    return (0);
}
['static int def_load_bio(CONF *conf, BIO *in, long *line)\n{\n#define CONFBUFSIZE     512\n    int bufnum = 0, i, ii;\n    BUF_MEM *buff = NULL;\n    char *s, *p, *end;\n    int again;\n    long eline = 0;\n    char btmp[DECIMAL_SIZE(eline) + 1];\n    CONF_VALUE *v = NULL, *tv;\n    CONF_VALUE *sv = NULL;\n    char *section = NULL, *buf;\n    char *start, *psection, *pname;\n    void *h = (void *)(conf->data);\n    if ((buff = BUF_MEM_new()) == NULL) {\n        CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_BUF_LIB);\n        goto err;\n    }\n    section = OPENSSL_strdup("default");\n    if (section == NULL) {\n        CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    if (_CONF_new_data(conf) == 0) {\n        CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    sv = _CONF_new_section(conf, section);\n    if (sv == NULL) {\n        CONFerr(CONF_F_DEF_LOAD_BIO, CONF_R_UNABLE_TO_CREATE_NEW_SECTION);\n        goto err;\n    }\n    bufnum = 0;\n    again = 0;\n    for (;;) {\n        if (!BUF_MEM_grow(buff, bufnum + CONFBUFSIZE)) {\n            CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_BUF_LIB);\n            goto err;\n        }\n        p = &(buff->data[bufnum]);\n        *p = \'\\0\';\n        BIO_gets(in, p, CONFBUFSIZE - 1);\n        p[CONFBUFSIZE - 1] = \'\\0\';\n        ii = i = strlen(p);\n        if (i == 0 && !again)\n            break;\n        again = 0;\n        while (i > 0) {\n            if ((p[i - 1] != \'\\r\') && (p[i - 1] != \'\\n\'))\n                break;\n            else\n                i--;\n        }\n        if (ii && i == ii)\n            again = 1;\n        else {\n            p[i] = \'\\0\';\n            eline++;\n        }\n        bufnum += i;\n        v = NULL;\n        if (bufnum >= 1) {\n            p = &(buff->data[bufnum - 1]);\n            if (IS_ESC(conf, p[0]) && ((bufnum <= 1) || !IS_ESC(conf, p[-1]))) {\n                bufnum--;\n                again = 1;\n            }\n        }\n        if (again)\n            continue;\n        bufnum = 0;\n        buf = buff->data;\n        clear_comments(conf, buf);\n        s = eat_ws(conf, buf);\n        if (IS_EOF(conf, *s))\n            continue;\n        if (*s == \'[\') {\n            char *ss;\n            s++;\n            start = eat_ws(conf, s);\n            ss = start;\n again:\n            end = eat_alpha_numeric(conf, ss);\n            p = eat_ws(conf, end);\n            if (*p != \']\') {\n                if (*p != \'\\0\' && ss != p) {\n                    ss = p;\n                    goto again;\n                }\n                CONFerr(CONF_F_DEF_LOAD_BIO,\n                        CONF_R_MISSING_CLOSE_SQUARE_BRACKET);\n                goto err;\n            }\n            *end = \'\\0\';\n            if (!str_copy(conf, NULL, &section, start))\n                goto err;\n            if ((sv = _CONF_get_section(conf, section)) == NULL)\n                sv = _CONF_new_section(conf, section);\n            if (sv == NULL) {\n                CONFerr(CONF_F_DEF_LOAD_BIO,\n                        CONF_R_UNABLE_TO_CREATE_NEW_SECTION);\n                goto err;\n            }\n            continue;\n        } else {\n            pname = s;\n            psection = NULL;\n            end = eat_alpha_numeric(conf, s);\n            if ((end[0] == \':\') && (end[1] == \':\')) {\n                *end = \'\\0\';\n                end += 2;\n                psection = pname;\n                pname = end;\n                end = eat_alpha_numeric(conf, end);\n            }\n            p = eat_ws(conf, end);\n            if (*p != \'=\') {\n                CONFerr(CONF_F_DEF_LOAD_BIO, CONF_R_MISSING_EQUAL_SIGN);\n                goto err;\n            }\n            *end = \'\\0\';\n            p++;\n            start = eat_ws(conf, p);\n            while (!IS_EOF(conf, *p))\n                p++;\n            p--;\n            while ((p != start) && (IS_WS(conf, *p)))\n                p--;\n            p++;\n            *p = \'\\0\';\n            if ((v = OPENSSL_malloc(sizeof(*v))) == NULL) {\n                CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            if (psection == NULL)\n                psection = section;\n            v->name = OPENSSL_malloc(strlen(pname) + 1);\n            v->value = NULL;\n            if (v->name == NULL) {\n                CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            OPENSSL_strlcpy(v->name, pname, strlen(pname) + 1);\n            if (!str_copy(conf, psection, &(v->value), start))\n                goto err;\n            if (strcmp(psection, section) != 0) {\n                if ((tv = _CONF_get_section(conf, psection))\n                    == NULL)\n                    tv = _CONF_new_section(conf, psection);\n                if (tv == NULL) {\n                    CONFerr(CONF_F_DEF_LOAD_BIO,\n                            CONF_R_UNABLE_TO_CREATE_NEW_SECTION);\n                    goto err;\n                }\n            } else\n                tv = sv;\n            if (_CONF_add_string(conf, tv, v) == 0) {\n                CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            v = NULL;\n        }\n    }\n    BUF_MEM_free(buff);\n    OPENSSL_free(section);\n    return (1);\n err:\n    BUF_MEM_free(buff);\n    OPENSSL_free(section);\n    if (line != NULL)\n        *line = eline;\n    BIO_snprintf(btmp, sizeof btmp, "%ld", eline);\n    ERR_add_error_data(2, "line ", btmp);\n    if (h != conf->data) {\n        CONF_free(conf->data);\n        conf->data = NULL;\n    }\n    if (v != NULL) {\n        OPENSSL_free(v->name);\n        OPENSSL_free(v->value);\n        OPENSSL_free(v);\n    }\n    return (0);\n}']