test/sslapitest.c:4730: error: BUFFER_OVERRUN_L3
  Offset added: [272, +oo] (⇐ [16, +oo] + [256, +oo]) Size: [1, +oo] by call to `TXT_DB_insert`.
Showing all 24 steps of the trace


test/sslapitest.c:4706:12: Call
4704.           goto end;
4705.   
4706.       gNid = SRP_create_verifier(userid, password, &row[DB_srpsalt],
                   ^
4707.                                  &row[DB_srpverifier], NULL, NULL);
4708.       if (!TEST_ptr(gNid))

crypto/srp/srp_vfy.c:649:10: Call
  647.           goto err;
  648.   
  649.       if (!SRP_create_verifier_BN(user, pass, &s, &v, N_bn, g_bn))
                  ^
  650.           goto err;
  651.   

crypto/srp/srp_vfy.c:722:9: Call
    720.       }
    721.   
    722.       x = SRP_Calc_x(salttmp, user, pass);
                   ^
    723.       if (x == NULL)
    724.           goto err;

crypto/srp/srp_lib.c:136:10: Call
      134.           goto err;
      135.   
      136.       if (!EVP_DigestInit_ex(ctxt, EVP_sha1(), NULL)
                      ^
      137.           || !EVP_DigestUpdate(ctxt, user, strlen(user))
      138.           || !EVP_DigestUpdate(ctxt, ":", 1)

crypto/evp/digest.c:93:20: Call
        91.           } else {
        92.               /* Ask if an ENGINE is reserved for this job */
        93.               impl = ENGINE_get_digest_engine(type->type);
                                 ^
        94.           }
        95.           if (impl != NULL) {

crypto/engine/tb_digest.c:65:12: Call
          63.   ENGINE *ENGINE_get_digest_engine(int nid)
          64.   {
          65.       return engine_table_select(&digest_table, nid);
                           ^
          66.   }
          67.   

crypto/engine/eng_table.c:216:10: Call
            214.        * operations. But don't worry about a fprintf(stderr).
            215.        */
            216.       if (!int_table_check(table, 0))
                            ^
            217.           goto end;
            218.       tmplate.nid = nid;

crypto/engine/eng_table.c:72:15: Call
              70.       if (!create)
              71.           return 0;
              72.       if ((lh = lh_ENGINE_PILE_new(engine_pile_hash, engine_pile_cmp)) == NULL)
                                  ^
              73.           return 0;
              74.       *t = (ENGINE_TABLE *)lh;

crypto/engine/eng_int.h:169:1: Call
                167.   typedef struct st_engine_pile ENGINE_PILE;
                168.   
                169. > DEFINE_LHASH_OF(ENGINE_PILE);
                170.   
                171.   #endif                          /* HEADER_ENGINE_INT_H */

crypto/lhash/lhash.c:64:5: Assignment
                  62.       ret->hash = ((h == NULL) ? (OPENSSL_LH_HASHFUNC)OPENSSL_LH_strhash : h);
                  63.       ret->num_nodes = MIN_NODES / 2;
                  64.       ret->num_alloc_nodes = MIN_NODES;
                            ^
                  65.       ret->pmax = MIN_NODES / 2;
                  66.       ret->up_load = UP_LOAD;

test/sslapitest.c:4730:17: Call
4728.               || !TEST_ptr(row[DB_srptype])
4729.               || !TEST_ptr(row[DB_srpgN])
4730.               || !TEST_true(TXT_DB_insert(db, row)))
                        ^
4731.           goto end;
4732.   

crypto/txt_db/txt_db.c:237:1: Parameter `(*db->index)->num_alloc_nodes`
  235.   }
  236.   
  237. > int TXT_DB_insert(TXT_DB *db, OPENSSL_STRING *row)
  238.   {
  239.       int i;

crypto/txt_db/txt_db.c:260:19: Call
  258.               if ((db->qual[i] != NULL) && (db->qual[i] (row) == 0))
  259.                   continue;
  260.               (void)lh_OPENSSL_STRING_insert(db->index[i], row);
                           ^
  261.               if (lh_OPENSSL_STRING_retrieve(db->index[i], row) == NULL)
  262.                   goto err1;

include/openssl/lhash.h:197:1: Parameter `lh->num_alloc_nodes`
    195.       LHASH_OF(type)
    196.   
    197. > DEFINE_LHASH_OF(OPENSSL_STRING);
    198.   # ifdef _MSC_VER
    199.   /*

include/openssl/lhash.h:197:1: Call
    195.       LHASH_OF(type)
    196.   
    197. > DEFINE_LHASH_OF(OPENSSL_STRING);
    198.   # ifdef _MSC_VER
    199.   /*

crypto/lhash/lhash.c:96:1: Parameter `lh->num_alloc_nodes`
      94.   }
      95.   
      96. > void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data)
      97.   {
      98.       unsigned long hash;

crypto/lhash/lhash.c:103:77: Call
      101.   
      102.       lh->error = 0;
      103.       if ((lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)) && !expand(lh))
                                                                                         ^
      104.           return NULL;        /* 'lh->error++' already done in 'expand' */
      105.   

crypto/lhash/lhash.c:214:1: <Offset trace>
212.   }
213.   
214. > static int expand(OPENSSL_LHASH *lh)
215.   {
216.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:214:1: Parameter `lh->num_alloc_nodes`
        212.   }
        213.   
        214. > static int expand(OPENSSL_LHASH *lh)
        215.   {
        216.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:220:5: Assignment
        218.       unsigned long hash;
        219.   
        220.       nni = lh->num_alloc_nodes;
                   ^
        221.       p = lh->p;
        222.       pmax = lh->pmax;

crypto/lhash/lhash.c:214:1: <Length trace>
212.   }
213.   
214. > static int expand(OPENSSL_LHASH *lh)
215.   {
216.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:214:1: Parameter `lh->num_alloc_nodes`
        212.   }
        213.   
        214. > static int expand(OPENSSL_LHASH *lh)
        215.   {
        216.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:220:5: Assignment
        218.       unsigned long hash;
        219.   
        220.       nni = lh->num_alloc_nodes;
                   ^
        221.       p = lh->p;
        222.       pmax = lh->pmax;

crypto/lhash/lhash.c:231:9: Array access: Offset added: [272, +oo] (⇐ [16, +oo] + [256, +oo]) Size: [1, +oo] by call to `TXT_DB_insert` 
        229.           }
        230.           lh->b = n;
        231.           memset(n + nni, 0, sizeof(*n) * (j - nni));
                       ^
        232.           lh->pmax = nni;
        233.           lh->num_alloc_nodes = j;
