crypto/srp/srp_vfy.c:411: error: BUFFER_OVERRUN_L2
  Offset: [-oo, 2147483648] Size: 2500 by call to `SRP_user_pwd_set_sv`.
Showing all 12 steps of the trace


crypto/srp/srp_vfy.c:365:18: Call
363.       error_code = SRP_ERR_VBASE_INCOMPLETE_FILE;
364.   
365.       if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)
                        ^
366.           goto err;
367.   

crypto/txt_db/txt_db.c:55:5: Assignment
  53.       add = (num + 1) * sizeof(char *);
  54.       buf->data[size - 1] = '\0';
  55.       offset = 0;
            ^
  56.       for (;;) {
  57.           if (offset != 0) {

crypto/srp/srp_vfy.c:411:22: Call
409.   
410.                   error_code = SRP_ERR_VBASE_BN_LIB;
411.                   if (!SRP_user_pwd_set_sv
                            ^
412.                       (user_pwd, pp[DB_srpsalt], pp[DB_srpverifier]))
413.                       goto err;

crypto/srp/srp_vfy.c:181:1: Array declaration
  179.   }
  180.   
  181. > static int SRP_user_pwd_set_sv(SRP_user_pwd *vinfo, const char *s,
  182.                                  const char *v)
  183.   {

crypto/srp/srp_vfy.c:190:11: Call
  188.       vinfo->s = NULL;
  189.   
  190.       len = t_fromb64(tmp, sizeof(tmp), v);
                   ^
  191.       if (len < 0)
  192.           return 0;

crypto/srp/srp_vfy.c:33:1: <Offset trace>
31.    * Convert a base64 string into raw byte array representation.
32.    */
33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
34.   {
35.       char *loc;

crypto/srp/srp_vfy.c:33:1: Parameter `alen`
    31.    * Convert a base64 string into raw byte array representation.
    32.    */
    33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
    34.   {
    35.       char *loc;

crypto/srp/srp_vfy.c:57:5: Assignment
    55.       if (i == 0)
    56.           return 0;
    57.       size = i;
              ^
    58.       i = size - 1;
    59.       j = size;

crypto/srp/srp_vfy.c:59:5: Assignment
    57.       size = i;
    58.       i = size - 1;
    59.       j = size;
              ^
    60.       while (1) {
    61.           a[j] = a[i];

crypto/srp/srp_vfy.c:33:1: <Length trace>
31.    * Convert a base64 string into raw byte array representation.
32.    */
33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
34.   {
35.       char *loc;

crypto/srp/srp_vfy.c:33:1: Parameter `*a`
    31.    * Convert a base64 string into raw byte array representation.
    32.    */
    33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
    34.   {
    35.       char *loc;

crypto/srp/srp_vfy.c:80:12: Array access: Offset: [-oo, 2147483648] Size: 2500 by call to `SRP_user_pwd_set_sv` 
    78.               break;
    79.       }
    80.       while (a[j] == 0 && j <= size)
                     ^
    81.           ++j;
    82.       i = 0;
