ssl/ssl_cert.c:648: error: BUFFER_OVERRUN_L3
  Offset added: [272, +oo] (⇐ [16, +oo] + [256, +oo]) Size: [1, +oo] by call to `lh_X509_NAME_insert`.
Showing all 15 steps of the trace


ssl/ssl_cert.c:617:38: Call
615.       X509_NAME *xn = NULL;
616.       STACK_OF(X509_NAME) *ret = NULL;
617.       LHASH_OF(X509_NAME) *name_hash = lh_X509_NAME_new(xname_hash, xname_cmp);
                                            ^
618.   
619.       if ((name_hash == NULL) || (in == NULL)) {

ssl/ssl_locl.h:734:1: Call
  732.   DEFINE_LHASH_OF(SSL_SESSION);
  733.   /* Needed in ssl_cert.c */
  734. > DEFINE_LHASH_OF(X509_NAME);
  735.   
  736.   # define TLSEXT_KEYNAME_LENGTH  16

crypto/lhash/lhash.c:55:5: Assignment
    53.       ret->hash = ((h == NULL) ? (OPENSSL_LH_HASHFUNC)OPENSSL_LH_strhash : h);
    54.       ret->num_nodes = MIN_NODES / 2;
    55.       ret->num_alloc_nodes = MIN_NODES;
              ^
    56.       ret->pmax = MIN_NODES / 2;
    57.       ret->up_load = UP_LOAD;

ssl/ssl_cert.c:648:13: Call
646.               xn = NULL;
647.           } else {
648.               lh_X509_NAME_insert(name_hash, xn);
                   ^
649.               if (!sk_X509_NAME_push(ret, xn))
650.                   goto err;

ssl/ssl_locl.h:734:1: Parameter `lh->num_alloc_nodes`
  732.   DEFINE_LHASH_OF(SSL_SESSION);
  733.   /* Needed in ssl_cert.c */
  734. > DEFINE_LHASH_OF(X509_NAME);
  735.   
  736.   # define TLSEXT_KEYNAME_LENGTH  16

ssl/ssl_locl.h:734:1: Call
  732.   DEFINE_LHASH_OF(SSL_SESSION);
  733.   /* Needed in ssl_cert.c */
  734. > DEFINE_LHASH_OF(X509_NAME);
  735.   
  736.   # define TLSEXT_KEYNAME_LENGTH  16

crypto/lhash/lhash.c:87:1: Parameter `lh->num_alloc_nodes`
    85.   }
    86.   
    87. > void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data)
    88.   {
    89.       unsigned long hash;

crypto/lhash/lhash.c:94:77: Call
    92.   
    93.       lh->error = 0;
    94.       if ((lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)) && !expand(lh))
                                                                                      ^
    95.           return NULL;        /* 'lh->error++' already done in 'expand' */
    96.   

crypto/lhash/lhash.c:203:1: <Offset trace>
201.   }
202.   
203. > static int expand(OPENSSL_LHASH *lh)
204.   {
205.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:203:1: Parameter `lh->num_alloc_nodes`
      201.   }
      202.   
      203. > static int expand(OPENSSL_LHASH *lh)
      204.   {
      205.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:209:5: Assignment
      207.       unsigned long hash;
      208.   
      209.       nni = lh->num_alloc_nodes;
                 ^
      210.       p = lh->p;
      211.       pmax = lh->pmax;

crypto/lhash/lhash.c:203:1: <Length trace>
201.   }
202.   
203. > static int expand(OPENSSL_LHASH *lh)
204.   {
205.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:203:1: Parameter `lh->num_alloc_nodes`
      201.   }
      202.   
      203. > static int expand(OPENSSL_LHASH *lh)
      204.   {
      205.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:209:5: Assignment
      207.       unsigned long hash;
      208.   
      209.       nni = lh->num_alloc_nodes;
                 ^
      210.       p = lh->p;
      211.       pmax = lh->pmax;

crypto/lhash/lhash.c:220:9: Array access: Offset added: [272, +oo] (⇐ [16, +oo] + [256, +oo]) Size: [1, +oo] by call to `lh_X509_NAME_insert` 
      218.           }
      219.           lh->b = n;
      220.           memset(n + nni, 0, sizeof(*n) * (j - nni));
                     ^
      221.           lh->pmax = nni;
      222.           lh->num_alloc_nodes = j;
