test/lhash_test.c:30: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `OPENSSL_LH_delete`.
Showing all 10 steps of the trace


test/lhash_test.c:30:1: Parameter `lh->pmax`
28.   #endif
29.   
30. > DEFINE_LHASH_OF(int);
31.   
32.   static int int_tests[] = { 65537, 13, 1, 3, -5, 6, 7, 4, -10, -12, -14, 22, 9,

test/lhash_test.c:30:1: Call
28.   #endif
29.   
30. > DEFINE_LHASH_OF(int);
31.   
32.   static int int_tests[] = { 65537, 13, 1, 3, -5, 6, 7, 4, -10, -12, -14, 22, 9,

crypto/lhash/lhash.c:102:1: Parameter `lh->pmax`
  100.   }
  101.   
  102. > void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
  103.   {
  104.       unsigned long hash;

crypto/lhash/lhash.c:125:9: Call
  123.       if ((lh->num_nodes > MIN_NODES) &&
  124.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
  125.           contract(lh);
                 ^
  126.   
  127.       return ret;

crypto/lhash/lhash.c:231:1: <Offset trace>
229.   }
230.   
231. > static void contract(OPENSSL_LHASH *lh)
232.   {
233.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:231:1: Parameter `lh->p`
    229.   }
    230.   
    231. > static void contract(OPENSSL_LHASH *lh)
    232.   {
    233.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:251:9: Assignment
    249.           lh->b = n;
    250.       } else
    251.           lh->p--;
                   ^
    252.   
    253.       lh->num_nodes--;

crypto/lhash/lhash.c:231:1: <Length trace>
229.   }
230.   
231. > static void contract(OPENSSL_LHASH *lh)
232.   {
233.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:231:1: Parameter `*lh->b`
    229.   }
    230.   
    231. > static void contract(OPENSSL_LHASH *lh)
    232.   {
    233.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:256:10: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `OPENSSL_LH_delete` 
    254.       lh->num_contracts++;
    255.   
    256.       n1 = lh->b[(int)lh->p];
                    ^
    257.       if (n1 == NULL)
    258.           lh->b[(int)lh->p] = np;

static void contract(OPENSSL_LHASH *lh)
{
    OPENSSL_LH_NODE **n, *n1, *np;
    np = lh->b[lh->p + lh->pmax - 1];
    lh->b[lh->p + lh->pmax - 1] = NULL;
    if (lh->p == 0) {
        n = OPENSSL_realloc(lh->b,
                            (unsigned int)(sizeof(OPENSSL_LH_NODE *) * lh->pmax));
        if (n == NULL) {
            lh->error++;
            return;
        }
        lh->num_contract_reallocs++;
        lh->num_alloc_nodes /= 2;
        lh->pmax /= 2;
        lh->p = lh->pmax - 1;
        lh->b = n;
    } else
        lh->p--;
    lh->num_nodes--;
    lh->num_contracts++;
    n1 = lh->b[(int)lh->p];
    if (n1 == NULL)
        lh->b[(int)lh->p] = np;
    else {
        while (n1->next != NULL)
            n1 = n1->next;
        n1->next = np;
    }
}
['DEFINE_LHASH_OF(int)', 'void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)\n{\n    unsigned long hash;\n    OPENSSL_LH_NODE *nn, **rn;\n    void *ret;\n    lh->error = 0;\n    rn = getrn(lh, data, &hash);\n    if (*rn == NULL) {\n        lh->num_no_delete++;\n        return NULL;\n    } else {\n        nn = *rn;\n        *rn = nn->next;\n        ret = nn->data;\n        OPENSSL_free(nn);\n        lh->num_delete++;\n    }\n    lh->num_items--;\n    if ((lh->num_nodes > MIN_NODES) &&\n        (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))\n        contract(lh);\n    return ret;\n}', 'static void contract(OPENSSL_LHASH *lh)\n{\n    OPENSSL_LH_NODE **n, *n1, *np;\n    np = lh->b[lh->p + lh->pmax - 1];\n    lh->b[lh->p + lh->pmax - 1] = NULL;\n    if (lh->p == 0) {\n        n = OPENSSL_realloc(lh->b,\n                            (unsigned int)(sizeof(OPENSSL_LH_NODE *) * lh->pmax));\n        if (n == NULL) {\n            lh->error++;\n            return;\n        }\n        lh->num_contract_reallocs++;\n        lh->num_alloc_nodes /= 2;\n        lh->pmax /= 2;\n        lh->p = lh->pmax - 1;\n        lh->b = n;\n    } else\n        lh->p--;\n    lh->num_nodes--;\n    lh->num_contracts++;\n    n1 = lh->b[(int)lh->p];\n    if (n1 == NULL)\n        lh->b[(int)lh->p] = np;\n    else {\n        while (n1->next != NULL)\n            n1 = n1->next;\n        n1->next = np;\n    }\n}']