test/sslapitest.c:3864: error: BUFFER_OVERRUN_L3
  Offset added: [272, +oo] (⇐ [16, +oo] + [256, +oo]) Size: [1, +oo] by call to `TXT_DB_insert`.
Showing all 24 steps of the trace


test/sslapitest.c:3840:12: Call
3838.           goto end;
3839.   
3840.       gNid = SRP_create_verifier(userid, password, &row[DB_srpsalt],
                   ^
3841.                                  &row[DB_srpverifier], NULL, NULL);
3842.       if (!TEST_ptr(gNid))

crypto/srp/srp_vfy.c:621:10: Call
  619.       }
  620.   
  621.       if (!SRP_create_verifier_BN(user, pass, &s, &v, N_bn, g_bn))
                  ^
  622.           goto err;
  623.   

crypto/srp/srp_vfy.c:687:9: Call
    685.       }
    686.   
    687.       x = SRP_Calc_x(salttmp, user, pass);
                   ^
    688.   
    689.       *verifier = BN_new();

crypto/srp/srp_lib.c:135:10: Call
      133.           goto err;
      134.   
      135.       if (!EVP_DigestInit_ex(ctxt, EVP_sha1(), NULL)
                      ^
      136.           || !EVP_DigestUpdate(ctxt, user, strlen(user))
      137.           || !EVP_DigestUpdate(ctxt, ":", 1)

crypto/evp/digest.c:88:20: Call
        86.           } else {
        87.               /* Ask if an ENGINE is reserved for this job */
        88.               impl = ENGINE_get_digest_engine(type->type);
                                 ^
        89.           }
        90.           if (impl != NULL) {

crypto/engine/tb_digest.c:65:12: Call
          63.   ENGINE *ENGINE_get_digest_engine(int nid)
          64.   {
          65.       return engine_table_select(&digest_table, nid);
                           ^
          66.   }
          67.   

crypto/engine/eng_table.c:216:10: Call
            214.        * operations. But don't worry about a fprintf(stderr).
            215.        */
            216.       if (!int_table_check(table, 0))
                            ^
            217.           goto end;
            218.       tmplate.nid = nid;

crypto/engine/eng_table.c:72:15: Call
              70.       if (!create)
              71.           return 0;
              72.       if ((lh = lh_ENGINE_PILE_new(engine_pile_hash, engine_pile_cmp)) == NULL)
                                  ^
              73.           return 0;
              74.       *t = (ENGINE_TABLE *)lh;

crypto/engine/eng_int.h:173:1: Call
                171.   typedef struct st_engine_pile ENGINE_PILE;
                172.   
                173. > DEFINE_LHASH_OF(ENGINE_PILE);
                174.   
                175.   #ifdef  __cplusplus

crypto/lhash/lhash.c:55:5: Assignment
                  53.       ret->hash = ((h == NULL) ? (OPENSSL_LH_HASHFUNC)OPENSSL_LH_strhash : h);
                  54.       ret->num_nodes = MIN_NODES / 2;
                  55.       ret->num_alloc_nodes = MIN_NODES;
                            ^
                  56.       ret->pmax = MIN_NODES / 2;
                  57.       ret->up_load = UP_LOAD;

test/sslapitest.c:3864:17: Call
3862.               || !TEST_ptr(row[DB_srptype])
3863.               || !TEST_ptr(row[DB_srpgN])
3864.               || !TEST_true(TXT_DB_insert(db, row)))
                        ^
3865.           goto end;
3866.   

crypto/txt_db/txt_db.c:237:1: Parameter `(*db->index)->num_alloc_nodes`
  235.   }
  236.   
  237. > int TXT_DB_insert(TXT_DB *db, OPENSSL_STRING *row)
  238.   {
  239.       int i;

crypto/txt_db/txt_db.c:260:19: Call
  258.               if ((db->qual[i] != NULL) && (db->qual[i] (row) == 0))
  259.                   continue;
  260.               (void)lh_OPENSSL_STRING_insert(db->index[i], row);
                           ^
  261.               if (lh_OPENSSL_STRING_retrieve(db->index[i], row) == NULL)
  262.                   goto err1;

include/openssl/lhash.h:197:1: Parameter `lh->num_alloc_nodes`
    195.       LHASH_OF(type)
    196.   
    197. > DEFINE_LHASH_OF(OPENSSL_STRING);
    198.   # ifdef _MSC_VER
    199.   /*

include/openssl/lhash.h:197:1: Call
    195.       LHASH_OF(type)
    196.   
    197. > DEFINE_LHASH_OF(OPENSSL_STRING);
    198.   # ifdef _MSC_VER
    199.   /*

crypto/lhash/lhash.c:87:1: Parameter `lh->num_alloc_nodes`
      85.   }
      86.   
      87. > void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data)
      88.   {
      89.       unsigned long hash;

crypto/lhash/lhash.c:94:77: Call
      92.   
      93.       lh->error = 0;
      94.       if ((lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)) && !expand(lh))
                                                                                        ^
      95.           return NULL;        /* 'lh->error++' already done in 'expand' */
      96.   

crypto/lhash/lhash.c:203:1: <Offset trace>
201.   }
202.   
203. > static int expand(OPENSSL_LHASH *lh)
204.   {
205.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:203:1: Parameter `lh->num_alloc_nodes`
        201.   }
        202.   
        203. > static int expand(OPENSSL_LHASH *lh)
        204.   {
        205.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:209:5: Assignment
        207.       unsigned long hash;
        208.   
        209.       nni = lh->num_alloc_nodes;
                   ^
        210.       p = lh->p;
        211.       pmax = lh->pmax;

crypto/lhash/lhash.c:203:1: <Length trace>
201.   }
202.   
203. > static int expand(OPENSSL_LHASH *lh)
204.   {
205.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:203:1: Parameter `lh->num_alloc_nodes`
        201.   }
        202.   
        203. > static int expand(OPENSSL_LHASH *lh)
        204.   {
        205.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:209:5: Assignment
        207.       unsigned long hash;
        208.   
        209.       nni = lh->num_alloc_nodes;
                   ^
        210.       p = lh->p;
        211.       pmax = lh->pmax;

crypto/lhash/lhash.c:220:9: Array access: Offset added: [272, +oo] (⇐ [16, +oo] + [256, +oo]) Size: [1, +oo] by call to `TXT_DB_insert` 
        218.           }
        219.           lh->b = n;
        220.           memset(n + nni, 0, sizeof(*n) * (j - nni));
                       ^
        221.           lh->pmax = nni;
        222.           lh->num_alloc_nodes = j;
