apps/srp.c:453: error: BUFFER_OVERRUN_L3
  Offset: [16, +oo] Size: [1, +oo] by call to `update_index`.
Showing all 29 steps of the trace


apps/srp.c:431:22: Call
429.                   if (!
430.                       (gNid =
431.                        srp_create_user(user, &(row[DB_srpverifier]),
                            ^
432.                                        &(row[DB_srpsalt]),
433.                                        gNrow ? gNrow[DB_srpsalt] : gN,

apps/srp.c:166:14: Call
  164.           if (!
  165.               (gNid =
  166.                SRP_create_verifier(user, password, &salt, srp_verifier, N,
                      ^
  167.                                    g))) {
  168.               BIO_printf(bio_err, "Internal error creating SRP verifier\n");

crypto/srp/srp_vfy.c:571:10: Call
    569.       }
    570.   
    571.       if (!SRP_create_verifier_BN(user, pass, &s, &v, N_bn, g_bn))
                    ^
    572.           goto err;
    573.   

crypto/srp/srp_vfy.c:637:9: Call
      635.       }
      636.   
      637.       x = SRP_Calc_x(salttmp, user, pass);
                     ^
      638.   
      639.       *verifier = BN_new();

crypto/srp/srp_lib.c:181:10: Call
        179.           goto err;
        180.   
        181.       if (!EVP_DigestInit_ex(ctxt, EVP_sha1(), NULL)
                        ^
        182.           || !EVP_DigestUpdate(ctxt, user, strlen(user))
        183.           || !EVP_DigestUpdate(ctxt, ":", 1)

crypto/evp/digest.c:88:20: Call
          86.           } else {
          87.               /* Ask if an ENGINE is reserved for this job */
          88.               impl = ENGINE_get_digest_engine(type->type);
                                   ^
          89.           }
          90.           if (impl != NULL) {

crypto/engine/tb_digest.c:65:12: Call
            63.   ENGINE *ENGINE_get_digest_engine(int nid)
            64.   {
            65.       return engine_table_select(&digest_table, nid);
                             ^
            66.   }
            67.   

crypto/engine/eng_table.c:211:10: Call
              209.        * operations. But don't worry about a fprintf(stderr).
              210.        */
              211.       if (!int_table_check(table, 0))
                              ^
              212.           goto end;
              213.       tmplate.nid = nid;

crypto/engine/eng_table.c:72:15: Call
                70.       if (!create)
                71.           return 0;
                72.       if ((lh = lh_ENGINE_PILE_new(engine_pile_hash, engine_pile_cmp)) == NULL)
                                    ^
                73.           return 0;
                74.       *t = (ENGINE_TABLE *)lh;

crypto/engine/eng_int.h:176:1: Call
                  174.   typedef struct st_engine_pile ENGINE_PILE;
                  175.   
                  176. > DEFINE_LHASH_OF(ENGINE_PILE);
                  177.   
                  178.   #ifdef  __cplusplus

crypto/lhash/lhash.c:38:5: Assignment
                    36.       ret->hash = ((h == NULL) ? (OPENSSL_LH_HASHFUNC)OPENSSL_LH_strhash : h);
                    37.       ret->num_nodes = MIN_NODES / 2;
                    38.       ret->num_alloc_nodes = MIN_NODES;
                              ^
                    39.       ret->pmax = MIN_NODES / 2;
                    40.       ret->up_load = UP_LOAD;

apps/srp.c:453:25: Call
451.                       || (userinfo
452.                           && ((row[DB_srpinfo] = OPENSSL_strdup(userinfo)) == NULL))
453.                       || !update_index(db, row)) {
                               ^
454.                       OPENSSL_free(row[DB_srpid]);
455.                       OPENSSL_free(row[DB_srpgN]);

apps/srp.c:89:1: Parameter `(*db->db->index)->num_alloc_nodes`
  87.   }
  88.   
  89. > static int update_index(CA_DB *db, char **row)
  90.   {
  91.       char **irow;

apps/srp.c:101:10: Call
  99.       irow[DB_NUMBER] = NULL;
  100.   
  101.       if (!TXT_DB_insert(db->db, irow)) {
                  ^
  102.           BIO_printf(bio_err, "failed to update srpvfile\n");
  103.           BIO_printf(bio_err, "TXT_DB error number %ld\n", db->db->error);

crypto/txt_db/txt_db.c:229:1: Parameter `(*db->index)->num_alloc_nodes`
    227.   }
    228.   
    229. > int TXT_DB_insert(TXT_DB *db, OPENSSL_STRING *row)
    230.   {
    231.       int i;

crypto/txt_db/txt_db.c:257:19: Call
    255.               if ((db->qual[i] != NULL) && (db->qual[i] (row) == 0))
    256.                   continue;
    257.               (void)lh_OPENSSL_STRING_insert(db->index[i], row);
                             ^
    258.           }
    259.       }

include/openssl/lhash.h:197:1: Parameter `lh->num_alloc_nodes`
      195.       LHASH_OF(type)
      196.   
      197. > DEFINE_LHASH_OF(OPENSSL_STRING);
      198.   DEFINE_LHASH_OF(OPENSSL_CSTRING);
      199.   

include/openssl/lhash.h:197:1: Call
      195.       LHASH_OF(type)
      196.   
      197. > DEFINE_LHASH_OF(OPENSSL_STRING);
      198.   DEFINE_LHASH_OF(OPENSSL_CSTRING);
      199.   

crypto/lhash/lhash.c:70:1: Parameter `lh->num_alloc_nodes`
        68.   }
        69.   
        70. > void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data)
        71.   {
        72.       unsigned long hash;

crypto/lhash/lhash.c:77:77: Call
        75.   
        76.       lh->error = 0;
        77.       if ((lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)) && !expand(lh))
                                                                                          ^
        78.           return NULL;        /* 'lh->error++' already done in 'expand' */
        79.   

crypto/lhash/lhash.c:187:1: <Offset trace>
185.   }
186.   
187. > static int expand(OPENSSL_LHASH *lh)
188.   {
189.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:187:1: Parameter `lh->num_alloc_nodes`
          185.   }
          186.   
          187. > static int expand(OPENSSL_LHASH *lh)
          188.   {
          189.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:213:9: Assignment
          211.   
          212.       if ((lh->p) >= lh->pmax) {
          213.           j = (int)lh->num_alloc_nodes * 2;
                         ^
          214.           n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));
          215.           if (n == NULL) {

crypto/lhash/lhash.c:187:1: <Length trace>
185.   }
186.   
187. > static int expand(OPENSSL_LHASH *lh)
188.   {
189.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:187:1: Parameter `*lh->b`
          185.   }
          186.   
          187. > static int expand(OPENSSL_LHASH *lh)
          188.   {
          189.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:214:13: Call
          212.       if ((lh->p) >= lh->pmax) {
          213.           j = (int)lh->num_alloc_nodes * 2;
          214.           n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));
                             ^
          215.           if (n == NULL) {
          216.               /* fputs("realloc error in lhash",stderr); */

crypto/mem.c:117:9: Assignment
            115.       if (num == 0) {
            116.           CRYPTO_free(str, file, line);
            117.           return NULL;
                           ^
            118.       }
            119.   

crypto/lhash/lhash.c:214:9: Assignment
          212.       if ((lh->p) >= lh->pmax) {
          213.           j = (int)lh->num_alloc_nodes * 2;
          214.           n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));
                         ^
          215.           if (n == NULL) {
          216.               /* fputs("realloc error in lhash",stderr); */

crypto/lhash/lhash.c:222:13: Array access: Offset: [16, +oo] Size: [1, +oo] by call to `update_index` 
          220.           }
          221.           for (i = (int)lh->num_alloc_nodes; i < j; i++) /* 26/02/92 eay */
          222.               n[i] = NULL;        /* 02/03/92 eay */
                             ^
          223.           lh->pmax = lh->num_alloc_nodes;
          224.           lh->num_alloc_nodes = j;
