ssl/ssl_cert.c:930: error: INTEGER_OVERFLOW_L2
  ([2, max(2147483644, `s->init_buf->max`)] - [1, 2147483644]):unsigned64 by call to `ssl_add_cert_to_buf`.
Showing all 13 steps of the trace


ssl/ssl_cert.c:857:1: Parameter `s->init_buf->max`
855.   
856.   /* Add certificate chain to internal SSL BUF_MEM structure */
857. > int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l)
858.   {
859.       BUF_MEM *buf = s->init_buf;

ssl/ssl_cert.c:867:10: Call
865.   
866.       /* TLSv1 sends a chain with nothing in it, instead of an alert */
867.       if (!BUF_MEM_grow_clean(buf, 10)) {
                ^
868.           SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, ERR_R_BUF_LIB);
869.           return 0;

crypto/buffer/buffer.c:157:1: Parameter `len`
  155.   }
  156.   
  157. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
  158.   {
  159.       char *ret;

ssl/ssl_cert.c:930:18: Call
928.               x = sk_X509_value(chain, i);
929.   
930.               if (!ssl_add_cert_to_buf(buf, l, x)) {
                        ^
931.                   X509_STORE_CTX_free(xs_ctx);
932.                   return 0;

ssl/ssl_cert.c:833:1: Parameter `buf->max`
  831.   /* Add a certificate to a BUF_MEM structure */
  832.   
  833. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
  834.   {
  835.       int n;

ssl/ssl_cert.c:839:19: Call
  837.   
  838.       n = i2d_X509(x, NULL);
  839.       if (n < 0 || !BUF_MEM_grow_clean(buf, (int)(n + (*l) + 3))) {
                           ^
  840.           SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);
  841.           return 0;

crypto/buffer/buffer.c:157:1: Parameter `len`
    155.   }
    156.   
    157. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
    158.   {
    159.       char *ret;

crypto/buffer/buffer.c:181:15: Call
    179.           ret = sec_alloc_realloc(str, n);
    180.       else
    181.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                         ^
    182.       if (ret == NULL) {
    183.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:184:1: <LHS trace>
182.   }
183.   
184. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
185.                              const char *file, int line)
186.   {

crypto/mem.c:184:1: Parameter `num`
      182.   }
      183.   
      184. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
      185.                              const char *file, int line)
      186.   {

crypto/mem.c:184:1: <RHS trace>
182.   }
183.   
184. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
185.                              const char *file, int line)
186.   {

crypto/mem.c:184:1: Parameter `num`
      182.   }
      183.   
      184. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
      185.                              const char *file, int line)
      186.   {

crypto/mem.c:199:9: Binary operation: ([2, max(2147483644, s->init_buf->max)] - [1, 2147483644]):unsigned64 by call to `ssl_add_cert_to_buf` 
      197.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
      198.       if (num < old_len) {
      199.           memset((char*)str + num, 0, old_len - num);
                     ^
      200.           return str;
      201.       }

void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
                           const char *file, int line)
{
    void *ret = NULL;
    if (str == NULL)
        return CRYPTO_malloc(num, file, line);
    if (num == 0) {
        CRYPTO_clear_free(str, old_len, file, line);
        return NULL;
    }
    if (num < old_len) {
        memset((char*)str + num, 0, old_len - num);
        return str;
    }
    ret = CRYPTO_malloc(num, file, line);
    if (ret != NULL) {
        memcpy(ret, str, old_len);
        CRYPTO_clear_free(str, old_len, file, line);
    }
    return ret;
}
['int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l)\n{\n    BUF_MEM *buf = s->init_buf;\n    int i, chain_count;\n    X509 *x;\n    STACK_OF(X509) *extra_certs;\n    STACK_OF(X509) *chain = NULL;\n    X509_STORE *chain_store;\n    if (!BUF_MEM_grow_clean(buf, 10)) {\n        SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, ERR_R_BUF_LIB);\n        return 0;\n    }\n    if (!cpk || !cpk->x509)\n        return 1;\n    x = cpk->x509;\n    if (cpk->chain)\n        extra_certs = cpk->chain;\n    else\n        extra_certs = s->ctx->extra_certs;\n    if ((s->mode & SSL_MODE_NO_AUTO_CHAIN) || extra_certs)\n        chain_store = NULL;\n    else if (s->cert->chain_store)\n        chain_store = s->cert->chain_store;\n    else\n        chain_store = s->ctx->cert_store;\n    if (chain_store) {\n        X509_STORE_CTX* xs_ctx = X509_STORE_CTX_new();\n        if (xs_ctx == NULL) {\n            SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, ERR_R_MALLOC_FAILURE);\n            return (0);\n        }\n        if (!X509_STORE_CTX_init(xs_ctx, chain_store, x, NULL)) {\n            X509_STORE_CTX_free(xs_ctx);\n            SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, ERR_R_X509_LIB);\n            return (0);\n        }\n        (void) X509_verify_cert(xs_ctx);\n        ERR_clear_error();\n        chain =  X509_STORE_CTX_get0_chain(xs_ctx);\n        i = ssl_security_cert_chain(s, chain, NULL, 0);\n        if (i != 1) {\n#if 0\n            SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, SSL_R_EE_KEY_TOO_SMALL);\n            SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, SSL_R_CA_KEY_TOO_SMALL);\n            SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, SSL_R_CA_MD_TOO_WEAK);\n#endif\n            X509_STORE_CTX_free(xs_ctx);\n            SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, i);\n            return 0;\n        }\n        chain_count = sk_X509_num(chain);\n        for (i = 0; i < chain_count; i++) {\n            x = sk_X509_value(chain, i);\n            if (!ssl_add_cert_to_buf(buf, l, x)) {\n                X509_STORE_CTX_free(xs_ctx);\n                return 0;\n            }\n        }\n        X509_STORE_CTX_free(xs_ctx);\n    } else {\n        i = ssl_security_cert_chain(s, extra_certs, x, 0);\n        if (i != 1) {\n            SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, i);\n            return 0;\n        }\n        if (!ssl_add_cert_to_buf(buf, l, x))\n            return 0;\n        for (i = 0; i < sk_X509_num(extra_certs); i++) {\n            x = sk_X509_value(extra_certs, i);\n            if (!ssl_add_cert_to_buf(buf, l, x))\n                return 0;\n        }\n    }\n    return 1;\n}', 'size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)\n{\n    char *ret;\n    size_t n;\n    if (str->length >= len) {\n        memset(&str->data[len], 0, str->length - len);\n        str->length = len;\n        return (len);\n    }\n    if (str->max >= len) {\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n        return (len);\n    }\n    if (len > LIMIT_BEFORE_EXPANSION) {\n        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    n = (len + 3) / 3 * 4;\n    if ((str->flags & BUF_MEM_FLAG_SECURE))\n        ret = sec_alloc_realloc(str, n);\n    else\n        ret = OPENSSL_clear_realloc(str->data, str->max, n);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);\n        len = 0;\n    } else {\n        str->data = ret;\n        str->max = n;\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n    }\n    return (len);\n}', 'static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)\n{\n    int n;\n    unsigned char *p;\n    n = i2d_X509(x, NULL);\n    if (n < 0 || !BUF_MEM_grow_clean(buf, (int)(n + (*l) + 3))) {\n        SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);\n        return 0;\n    }\n    p = (unsigned char *)&(buf->data[*l]);\n    l2n3(n, p);\n    n = i2d_X509(x, &p);\n    if (n < 0) {\n        SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);\n        return 0;\n    }\n    *l += n + 3;\n    return 1;\n}', 'void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,\n                           const char *file, int line)\n{\n    void *ret = NULL;\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_clear_free(str, old_len, file, line);\n        return NULL;\n    }\n    if (num < old_len) {\n        memset((char*)str + num, 0, old_len - num);\n        return str;\n    }\n    ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL) {\n        memcpy(ret, str, old_len);\n        CRYPTO_clear_free(str, old_len, file, line);\n    }\n    return ret;\n}']