crypto/bio/b_sock.c:511: error: BUFFER_OVERRUN_L3
  Offset added: 128 Size: [8, +oo] by call to `BIO_get_host_ip`.
Showing all 7 steps of the trace


crypto/bio/b_sock.c:498:3: Array declaration
496.   		{
497.   		p=h;
498.   		h="*";
         ^
499.   		}
500.   

crypto/bio/b_sock.c:511:8: Call
509.   	else
510.   		{
511.   		if (!BIO_get_host_ip(h,&(ip[0]))) return(INVALID_SOCKET);
              ^
512.   		l=(unsigned long)
513.   			((unsigned long)ip[0]<<24L)|

crypto/bio/b_sock.c:109:1: Parameter `*str`
  107.   #endif
  108.   
  109. > int BIO_get_host_ip(const char *str, unsigned char *ip)
  110.   	{
  111.   	int i;

crypto/bio/b_sock.c:126:6: Call
  124.   		if (!BIO_sock_init()) return(0);
  125.   
  126.   		he=BIO_gethostbyname(str);
              ^
  127.   		if (he == NULL)
  128.   			{

crypto/bio/b_sock.c:323:1: <Length trace>
321.   	}
322.   
323. > struct hostent *BIO_gethostbyname(const char *name)
324.   	{
325.   	struct hostent *ret;

crypto/bio/b_sock.c:323:1: Parameter `*name`
    321.   	}
    322.   
    323. > struct hostent *BIO_gethostbyname(const char *name)
    324.   	{
    325.   	struct hostent *ret;

crypto/bio/b_sock.c:364:3: Array access: Offset added: 128 Size: [8, +oo] by call to `BIO_get_host_ip` 
    362.   			ghbn_free(ghbn_cache[lowi].ent);
    363.   
    364.   		strncpy(ghbn_cache[lowi].name,name,128);
             ^
    365.   		ghbn_cache[lowi].ent=ghbn_dup(ret);
    366.   		ghbn_cache[lowi].order=BIO_ghbn_miss+BIO_ghbn_hits;

struct hostent *BIO_gethostbyname(const char *name)
	{
	struct hostent *ret;
	int i,lowi=0,j;
	unsigned long low= (unsigned long)-1;
	CRYPTO_w_lock(CRYPTO_LOCK_BIO_GETHOSTBYNAME);
	j=strlen(name);
	if (j < 128)
		{
		for (i=0; i<GHBN_NUM; i++)
			{
			if (low > ghbn_cache[i].order)
				{
				low=ghbn_cache[i].order;
				lowi=i;
				}
			if (ghbn_cache[i].order > 0)
				{
				if (strncmp(name,ghbn_cache[i].name,128) == 0)
					break;
				}
			}
		}
	else
		i=GHBN_NUM;
	if (i == GHBN_NUM)
		{
		BIO_ghbn_miss++;
		ret=gethostbyname(name);
		if (ret == NULL) return(NULL);
		if (j > 128) return(ret);
		if (ghbn_cache[lowi].ent != NULL)
			ghbn_free(ghbn_cache[lowi].ent);
		strncpy(ghbn_cache[lowi].name,name,128);
		ghbn_cache[lowi].ent=ghbn_dup(ret);
		ghbn_cache[lowi].order=BIO_ghbn_miss+BIO_ghbn_hits;
		}
	else
		{
		BIO_ghbn_hits++;
		ret= ghbn_cache[i].ent;
		ghbn_cache[i].order=BIO_ghbn_miss+BIO_ghbn_hits;
		}
	CRYPTO_w_unlock(CRYPTO_LOCK_BIO_GETHOSTBYNAME);
	return(ret);
	}
['int BIO_get_accept_socket(char *host, int bind_mode)\n\t{\n\tint ret=0;\n\tstruct sockaddr_in server,client;\n\tint s= -1,cs;\n\tunsigned char ip[4];\n\tunsigned short port;\n\tchar *str,*e;\n\tconst char *h,*p;\n\tunsigned long l;\n\tint err_num;\n\tif (!BIO_sock_init()) return(INVALID_SOCKET);\n\tif ((str=BUF_strdup(host)) == NULL) return(INVALID_SOCKET);\n\th=p=NULL;\n\th=str;\n\tfor (e=str; *e; e++)\n\t\t{\n\t\tif (*e == \':\')\n\t\t\t{\n\t\t\tp= &(e[1]);\n\t\t\t*e=\'\\0\';\n\t\t\t}\n\t\telse if (*e == \'/\')\n\t\t\t{\n\t\t\t*e=\'\\0\';\n\t\t\tbreak;\n\t\t\t}\n\t\t}\n\tif (p == NULL)\n\t\t{\n\t\tp=h;\n\t\th="*";\n\t\t}\n\tif (!BIO_get_port(p,&port)) return(INVALID_SOCKET);\n\tmemset((char *)&server,0,sizeof(server));\n\tserver.sin_family=AF_INET;\n\tserver.sin_port=htons(port);\n\tif (strcmp(h,"*") == 0)\n\t\tserver.sin_addr.s_addr=INADDR_ANY;\n\telse\n\t\t{\n\t\tif (!BIO_get_host_ip(h,&(ip[0]))) return(INVALID_SOCKET);\n\t\tl=(unsigned long)\n\t\t\t((unsigned long)ip[0]<<24L)|\n\t\t\t((unsigned long)ip[1]<<16L)|\n\t\t\t((unsigned long)ip[2]<< 8L)|\n\t\t\t((unsigned long)ip[3]);\n\t\tserver.sin_addr.s_addr=htonl(l);\n\t\t}\nagain:\n\ts=socket(AF_INET,SOCK_STREAM,SOCKET_PROTOCOL);\n\tif (s == INVALID_SOCKET)\n\t\t{\n\t\tSYSerr(SYS_F_SOCKET,get_last_socket_error());\n\t\tERR_add_error_data(3,"port=\'",host,"\'");\n\t\tBIOerr(BIO_F_BIO_GET_ACCEPT_SOCKET,BIO_R_UNABLE_TO_CREATE_SOCKET);\n\t\tgoto err;\n\t\t}\n#ifdef SO_REUSEADDR\n\tif (bind_mode == BIO_BIND_REUSEADDR)\n\t\t{\n\t\tint i=1;\n\t\tret=setsockopt(s,SOL_SOCKET,SO_REUSEADDR,(char *)&i,sizeof(i));\n\t\tbind_mode=BIO_BIND_NORMAL;\n\t\t}\n#endif\n\tif (bind(s,(struct sockaddr *)&server,sizeof(server)) == -1)\n\t\t{\n#ifdef SO_REUSEADDR\n\t\terr_num=get_last_socket_error();\n\t\tif ((bind_mode == BIO_BIND_REUSEADDR_IF_UNUSED) &&\n\t\t\t(err_num == EADDRINUSE))\n\t\t\t{\n\t\t\tmemcpy((char *)&client,(char *)&server,sizeof(server));\n\t\t\tif (strcmp(h,"*") == 0)\n\t\t\t\tclient.sin_addr.s_addr=htonl(0x7F000001);\n\t\t\tcs=socket(AF_INET,SOCK_STREAM,SOCKET_PROTOCOL);\n\t\t\tif (cs != INVALID_SOCKET)\n\t\t\t\t{\n\t\t\t\tint ii;\n\t\t\t\tii=connect(cs,(struct sockaddr *)&client,\n\t\t\t\t\tsizeof(client));\n\t\t\t\tclosesocket(cs);\n\t\t\t\tif (ii == INVALID_SOCKET)\n\t\t\t\t\t{\n\t\t\t\t\tbind_mode=BIO_BIND_REUSEADDR;\n\t\t\t\t\tclosesocket(s);\n\t\t\t\t\tgoto again;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n#endif\n\t\tSYSerr(SYS_F_BIND,err_num);\n\t\tERR_add_error_data(3,"port=\'",host,"\'");\n\t\tBIOerr(BIO_F_BIO_GET_ACCEPT_SOCKET,BIO_R_UNABLE_TO_BIND_SOCKET);\n\t\tgoto err;\n\t\t}\n\tif (listen(s,MAX_LISTEN) == -1)\n\t\t{\n\t\tSYSerr(SYS_F_BIND,get_last_socket_error());\n\t\tERR_add_error_data(3,"port=\'",host,"\'");\n\t\tBIOerr(BIO_F_BIO_GET_ACCEPT_SOCKET,BIO_R_UNABLE_TO_LISTEN_SOCKET);\n\t\tgoto err;\n\t\t}\n\tret=1;\nerr:\n\tif (str != NULL) Free(str);\n\tif ((ret == 0) && (s != INVALID_SOCKET))\n\t\t{\n\t\tclosesocket(s);\n\t\ts= INVALID_SOCKET;\n\t\t}\n\treturn(s);\n\t}', 'int BIO_get_host_ip(const char *str, unsigned char *ip)\n\t{\n\tint i;\n\tstruct hostent *he;\n\ti=get_ip(str,ip);\n\tif (i > 0) return(1);\n\tif (i < 0)\n\t\t{\n\t\tBIOerr(BIO_F_BIO_GET_HOST_IP,BIO_R_INVALID_IP_ADDRESS);\n\t\tERR_add_error_data(2,"host=",str);\n\t\treturn(0);\n\t\t}\n\telse\n\t\t{\n\t\tif (!BIO_sock_init()) return(0);\n\t\the=BIO_gethostbyname(str);\n\t\tif (he == NULL)\n\t\t\t{\n\t\t\tBIOerr(BIO_F_BIO_GET_HOST_IP,BIO_R_BAD_HOSTNAME_LOOKUP);\n\t\t\tERR_add_error_data(2,"host=",str);\n\t\t\treturn(0);\n\t\t\t}\n\t\tif ((short)he->h_addrtype != AF_INET)\n\t\t\t{\n\t\t\tBIOerr(BIO_F_BIO_GET_HOST_IP,BIO_R_GETHOSTBYNAME_ADDR_IS_NOT_AF_INET);\n\t\t\tERR_add_error_data(2,"host=",str);\n\t\t\treturn(0);\n\t\t\t}\n\t\tfor (i=0; i<4; i++)\n\t\t\tip[i]=he->h_addr_list[0][i];\n\t\t}\n\treturn(1);\n\t}', 'struct hostent *BIO_gethostbyname(const char *name)\n\t{\n\tstruct hostent *ret;\n\tint i,lowi=0,j;\n\tunsigned long low= (unsigned long)-1;\n\tCRYPTO_w_lock(CRYPTO_LOCK_BIO_GETHOSTBYNAME);\n\tj=strlen(name);\n\tif (j < 128)\n\t\t{\n\t\tfor (i=0; i<GHBN_NUM; i++)\n\t\t\t{\n\t\t\tif (low > ghbn_cache[i].order)\n\t\t\t\t{\n\t\t\t\tlow=ghbn_cache[i].order;\n\t\t\t\tlowi=i;\n\t\t\t\t}\n\t\t\tif (ghbn_cache[i].order > 0)\n\t\t\t\t{\n\t\t\t\tif (strncmp(name,ghbn_cache[i].name,128) == 0)\n\t\t\t\t\tbreak;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\telse\n\t\ti=GHBN_NUM;\n\tif (i == GHBN_NUM)\n\t\t{\n\t\tBIO_ghbn_miss++;\n\t\tret=gethostbyname(name);\n\t\tif (ret == NULL) return(NULL);\n\t\tif (j > 128) return(ret);\n\t\tif (ghbn_cache[lowi].ent != NULL)\n\t\t\tghbn_free(ghbn_cache[lowi].ent);\n\t\tstrncpy(ghbn_cache[lowi].name,name,128);\n\t\tghbn_cache[lowi].ent=ghbn_dup(ret);\n\t\tghbn_cache[lowi].order=BIO_ghbn_miss+BIO_ghbn_hits;\n\t\t}\n\telse\n\t\t{\n\t\tBIO_ghbn_hits++;\n\t\tret= ghbn_cache[i].ent;\n\t\tghbn_cache[i].order=BIO_ghbn_miss+BIO_ghbn_hits;\n\t\t}\n\tCRYPTO_w_unlock(CRYPTO_LOCK_BIO_GETHOSTBYNAME);\n\treturn(ret);\n\t}']