crypto/pem/pem_lib.c:774: error: BUFFER_OVERRUN_L3
  Offset added: [-10, 241] Size: [1, 241].
Showing all 30 steps of the trace


crypto/pem/pem_lib.c:753:15: <Offset trace>
751.   
752.       do {
753.           len = BIO_gets(bp, linebuf, LINESIZE);
                     ^
754.   
755.           if (len <= 0) {

crypto/pem/pem_lib.c:753:15: Call
751.   
752.       do {
753.           len = BIO_gets(bp, linebuf, LINESIZE);
                     ^
754.   
755.           if (len <= 0) {

crypto/bio/bio_lib.c:438:9: Assignment
  436.       if ((b == NULL) || (b->method == NULL) || (b->method->bgets == NULL)) {
  437.           BIOerr(BIO_F_BIO_GETS, BIO_R_UNSUPPORTED_METHOD);
  438.           return (-2);
                 ^
  439.       }
  440.   

crypto/pem/pem_lib.c:753:9: Assignment
751.   
752.       do {
753.           len = BIO_gets(bp, linebuf, LINESIZE);
               ^
754.   
755.           if (len <= 0) {

crypto/pem/pem_lib.c:761:15: Call
759.   
760.           /* Strip trailing garbage and standardize ending. */
761.           len = sanitize_line(linebuf, len, flags & ~PEM_FLAG_ONLY_B64);
                     ^
762.   
763.           /* Allow leading empty or non-matching lines. */

crypto/pem/pem_lib.c:695:1: Parameter `len`
  693.   #define isb64(c) (isalnum(c) || (c) == '+' || (c) == '/' || (c) == '=')
  694.   
  695. > static int sanitize_line(char *linebuf, int len, unsigned int flags)
  696.   {
  697.       int i;

crypto/pem/pem_lib.c:704:9: Assignment
  702.               len--;
  703.           /* Go back to whitespace before applying uniform line ending. */
  704.           len++;
                 ^
  705.       } else if (flags & PEM_FLAG_ONLY_B64) {
  706.           for (i = 0; i < len; ++i) {

crypto/pem/pem_lib.c:723:13: Assignment
  721.       }
  722.       /* The caller allocated LINESIZE+1, so this is safe. */
  723.       linebuf[len++] = '\n';
                     ^
  724.       linebuf[len] = '\0';
  725.       return len;

crypto/pem/pem_lib.c:725:5: Assignment
  723.       linebuf[len++] = '\n';
  724.       linebuf[len] = '\0';
  725.       return len;
             ^
  726.   }
  727.   

crypto/pem/pem_lib.c:761:9: Assignment
759.   
760.           /* Strip trailing garbage and standardize ending. */
761.           len = sanitize_line(linebuf, len, flags & ~PEM_FLAG_ONLY_B64);
               ^
762.   
763.           /* Allow leading empty or non-matching lines. */

crypto/pem/pem_lib.c:768:5: Assignment
766.                || strncmp(linebuf + len - TAILLEN, tailstr, TAILLEN) != 0);
767.       linebuf[len - TAILLEN] = '\0';
768.       len = len - BEGINLEN - TAILLEN + 1;
           ^
769.       *name = pem_malloc(len, flags);
770.       if (*name == NULL) {

crypto/pem/pem_lib.c:753:15: <Length trace>
751.   
752.       do {
753.           len = BIO_gets(bp, linebuf, LINESIZE);
                     ^
754.   
755.           if (len <= 0) {

crypto/pem/pem_lib.c:753:15: Call
751.   
752.       do {
753.           len = BIO_gets(bp, linebuf, LINESIZE);
                     ^
754.   
755.           if (len <= 0) {

crypto/bio/bio_lib.c:438:9: Assignment
  436.       if ((b == NULL) || (b->method == NULL) || (b->method->bgets == NULL)) {
  437.           BIOerr(BIO_F_BIO_GETS, BIO_R_UNSUPPORTED_METHOD);
  438.           return (-2);
                 ^
  439.       }
  440.   

crypto/pem/pem_lib.c:753:9: Assignment
751.   
752.       do {
753.           len = BIO_gets(bp, linebuf, LINESIZE);
               ^
754.   
755.           if (len <= 0) {

crypto/pem/pem_lib.c:761:15: Call
759.   
760.           /* Strip trailing garbage and standardize ending. */
761.           len = sanitize_line(linebuf, len, flags & ~PEM_FLAG_ONLY_B64);
                     ^
762.   
763.           /* Allow leading empty or non-matching lines. */

crypto/pem/pem_lib.c:695:1: Parameter `len`
  693.   #define isb64(c) (isalnum(c) || (c) == '+' || (c) == '/' || (c) == '=')
  694.   
  695. > static int sanitize_line(char *linebuf, int len, unsigned int flags)
  696.   {
  697.       int i;

crypto/pem/pem_lib.c:704:9: Assignment
  702.               len--;
  703.           /* Go back to whitespace before applying uniform line ending. */
  704.           len++;
                 ^
  705.       } else if (flags & PEM_FLAG_ONLY_B64) {
  706.           for (i = 0; i < len; ++i) {

crypto/pem/pem_lib.c:723:13: Assignment
  721.       }
  722.       /* The caller allocated LINESIZE+1, so this is safe. */
  723.       linebuf[len++] = '\n';
                     ^
  724.       linebuf[len] = '\0';
  725.       return len;

crypto/pem/pem_lib.c:725:5: Assignment
  723.       linebuf[len++] = '\n';
  724.       linebuf[len] = '\0';
  725.       return len;
             ^
  726.   }
  727.   

crypto/pem/pem_lib.c:761:9: Assignment
759.   
760.           /* Strip trailing garbage and standardize ending. */
761.           len = sanitize_line(linebuf, len, flags & ~PEM_FLAG_ONLY_B64);
               ^
762.   
763.           /* Allow leading empty or non-matching lines. */

crypto/pem/pem_lib.c:768:5: Assignment
766.                || strncmp(linebuf + len - TAILLEN, tailstr, TAILLEN) != 0);
767.       linebuf[len - TAILLEN] = '\0';
768.       len = len - BEGINLEN - TAILLEN + 1;
           ^
769.       *name = pem_malloc(len, flags);
770.       if (*name == NULL) {

crypto/pem/pem_lib.c:769:13: Call
767.       linebuf[len - TAILLEN] = '\0';
768.       len = len - BEGINLEN - TAILLEN + 1;
769.       *name = pem_malloc(len, flags);
                   ^
770.       if (*name == NULL) {
771.           PEMerr(PEM_F_GET_NAME, ERR_R_MALLOC_FAILURE);

crypto/pem/pem_lib.c:239:1: Parameter `num`
  237.   }
  238.   
  239. > static void *pem_malloc(int num, unsigned int flags)
  240.   {
  241.       return (flags & PEM_FLAG_SECURE) ? OPENSSL_secure_malloc(num)

crypto/pem/pem_lib.c:242:40: Call
  240.   {
  241.       return (flags & PEM_FLAG_SECURE) ? OPENSSL_secure_malloc(num)
  242.                                        : OPENSSL_malloc(num);
                                                ^
  243.   }
  244.   

crypto/mem.c:166:9: Assignment
    164.   
    165.       if (num == 0)
    166.           return NULL;
                   ^
    167.   
    168.       FAILTEST();

crypto/pem/pem_lib.c:241:12: Assignment
  239.   static void *pem_malloc(int num, unsigned int flags)
  240.   {
  241.       return (flags & PEM_FLAG_SECURE) ? OPENSSL_secure_malloc(num)
                    ^
  242.                                        : OPENSSL_malloc(num);
  243.   }

crypto/pem/pem_lib.c:241:5: Assignment
  239.   static void *pem_malloc(int num, unsigned int flags)
  240.   {
  241.       return (flags & PEM_FLAG_SECURE) ? OPENSSL_secure_malloc(num)
             ^
  242.                                        : OPENSSL_malloc(num);
  243.   }

crypto/pem/pem_lib.c:769:5: Assignment
767.       linebuf[len - TAILLEN] = '\0';
768.       len = len - BEGINLEN - TAILLEN + 1;
769.       *name = pem_malloc(len, flags);
           ^
770.       if (*name == NULL) {
771.           PEMerr(PEM_F_GET_NAME, ERR_R_MALLOC_FAILURE);

crypto/pem/pem_lib.c:774:5: Array access: Offset added: [-10, 241] Size: [1, 241]
772.           goto err;
773.       }
774.       memcpy(*name, linebuf + BEGINLEN, len);
           ^
775.       ret = 1;
776.   
