crypto/property/property_string.c:34: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `OPENSSL_LH_delete`.
Showing all 10 steps of the trace


crypto/property/property_string.c:34:1: Parameter `lh->pmax`
32.   } PROPERTY_STRING;
33.   
34. > DEFINE_LHASH_OF(PROPERTY_STRING);
35.   typedef LHASH_OF(PROPERTY_STRING) PROP_TABLE;
36.   

crypto/property/property_string.c:34:1: Call
32.   } PROPERTY_STRING;
33.   
34. > DEFINE_LHASH_OF(PROPERTY_STRING);
35.   typedef LHASH_OF(PROPERTY_STRING) PROP_TABLE;
36.   

crypto/lhash/lhash.c:136:1: Parameter `lh->pmax`
  134.   }
  135.   
  136. > void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
  137.   {
  138.       unsigned long hash;

crypto/lhash/lhash.c:159:9: Call
  157.       if ((lh->num_nodes > MIN_NODES) &&
  158.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
  159.           contract(lh);
                 ^
  160.   
  161.       return ret;

crypto/lhash/lhash.c:268:1: <Offset trace>
266.   }
267.   
268. > static void contract(OPENSSL_LHASH *lh)
269.   {
270.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:268:1: Parameter `lh->p`
    266.   }
    267.   
    268. > static void contract(OPENSSL_LHASH *lh)
    269.   {
    270.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:288:9: Assignment
    286.           lh->b = n;
    287.       } else
    288.           lh->p--;
                   ^
    289.   
    290.       lh->num_nodes--;

crypto/lhash/lhash.c:268:1: <Length trace>
266.   }
267.   
268. > static void contract(OPENSSL_LHASH *lh)
269.   {
270.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:268:1: Parameter `*lh->b`
    266.   }
    267.   
    268. > static void contract(OPENSSL_LHASH *lh)
    269.   {
    270.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:293:10: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `OPENSSL_LH_delete` 
    291.       lh->num_contracts++;
    292.   
    293.       n1 = lh->b[(int)lh->p];
                    ^
    294.       if (n1 == NULL)
    295.           lh->b[(int)lh->p] = np;
