apps/s_server.c:1624: error: BUFFER_OVERRUN_L3
  Offset: [1, 65535] Size: [1, +oo] by call to `next_protos_parse`.
Showing all 17 steps of the trace


apps/s_server.c:1592:18: Call
1590.           }
1591.   
1592.           s_cert = load_cert(s_cert_file, s_cert_format,
                         ^
1593.                              "server certificate file");
1594.   

apps/apps.c:626:9: Call
  624.       if (format == FORMAT_HTTP) {
  625.   #if !defined(OPENSSL_NO_OCSP) && !defined(OPENSSL_NO_SOCK)
  626.           load_cert_crl_http(file, &x, NULL);
                 ^
  627.   #endif
  628.           return x;

apps/apps.c:578:10: Call
    576.       OCSP_REQ_CTX *rctx = NULL;
    577.       int use_ssl, rv = 0;
    578.       if (!OCSP_parse_url(url, &host, &port, &path, &use_ssl))
                    ^
    579.           goto err;
    580.       if (use_ssl) {

crypto/ocsp/ocsp_lib.c:139:5: Assignment
      137.           goto parse_err;
      138.   
      139.       *(p++) = '\0';
                 ^
      140.   
      141.       if (strcmp(buf, "http") == 0) {

apps/s_server.c:1624:27: Call
1622.   #if !defined(OPENSSL_NO_NEXTPROTONEG)
1623.       if (next_proto_neg_in) {
1624.           next_proto.data = next_protos_parse(&next_proto.len, next_proto_neg_in);
                                  ^
1625.           if (next_proto.data == NULL)
1626.               goto end;

apps/apps.c:1919:10: <Offset trace>
1917.   
1918.       out = app_malloc(strlen(in) + 1, "NPN buffer");
1919.       for (i = 0; i <= len; ++i) {
                 ^
1920.           if (i == len || in[i] == ',') {
1921.               if (i - start > 255) {

apps/apps.c:1919:10: Assignment
  1917.   
  1918.       out = app_malloc(strlen(in) + 1, "NPN buffer");
  1919.       for (i = 0; i <= len; ++i) {
                   ^
  1920.           if (i == len || in[i] == ',') {
  1921.               if (i - start > 255) {

apps/apps.c:1908:1: <Length trace>
1906.    *   returns: a malloc'd buffer or NULL on failure.
1907.    */
1908. > unsigned char *next_protos_parse(size_t *outlen, const char *in)
1909.   {
1910.       size_t len;

apps/apps.c:1908:1: Parameter `in->strlen`
  1906.    *   returns: a malloc'd buffer or NULL on failure.
  1907.    */
  1908. > unsigned char *next_protos_parse(size_t *outlen, const char *in)
  1909.   {
  1910.       size_t len;

apps/apps.c:1918:11: Call
  1916.           return NULL;
  1917.   
  1918.       out = app_malloc(strlen(in) + 1, "NPN buffer");
                    ^
  1919.       for (i = 0; i <= len; ++i) {
  1920.           if (i == len || in[i] == ',') {

apps/apps.c:935:1: Parameter `sz`
    933.   }
    934.   
    935. > void* app_malloc(int sz, const char *what)
    936.   {
    937.       void *vp = OPENSSL_malloc(sz);

apps/apps.c:937:16: Call
    935.   void* app_malloc(int sz, const char *what)
    936.   {
    937.       void *vp = OPENSSL_malloc(sz);
                          ^
    938.   
    939.       if (vp == NULL) {

crypto/mem.c:166:9: Assignment
      164.   
      165.       if (num == 0)
      166.           return NULL;
                     ^
      167.   
      168.       FAILTEST();

apps/apps.c:937:5: Assignment
    935.   void* app_malloc(int sz, const char *what)
    936.   {
    937.       void *vp = OPENSSL_malloc(sz);
               ^
    938.   
    939.       if (vp == NULL) {

apps/apps.c:945:5: Assignment
    943.           exit(1);
    944.       }
    945.       return vp;
               ^
    946.   }
    947.   

apps/apps.c:1918:5: Assignment
  1916.           return NULL;
  1917.   
  1918.       out = app_malloc(strlen(in) + 1, "NPN buffer");
              ^
  1919.       for (i = 0; i <= len; ++i) {
  1920.           if (i == len || in[i] == ',') {

apps/apps.c:1928:13: Array access: Offset: [1, 65535] Size: [1, +oo] by call to `next_protos_parse` 
  1926.               start = i + 1;
  1927.           } else {
  1928.               out[i + 1] = in[i];
                      ^
  1929.           }
  1930.       }
