test/sslapitest.c:4157: error: BUFFER_OVERRUN_L3
  Offset added: [272, +oo] (⇐ [16, +oo] + [256, +oo]) Size: [1, +oo] by call to `TXT_DB_insert`.
Showing all 24 steps of the trace


test/sslapitest.c:4133:12: Call
4131.           goto end;
4132.   
4133.       gNid = SRP_create_verifier(userid, password, &row[DB_srpsalt],
                   ^
4134.                                  &row[DB_srpverifier], NULL, NULL);
4135.       if (!TEST_ptr(gNid))

crypto/srp/srp_vfy.c:627:10: Call
  625.       }
  626.   
  627.       if (!SRP_create_verifier_BN(user, pass, &s, &v, N_bn, g_bn))
                  ^
  628.           goto err;
  629.   

crypto/srp/srp_vfy.c:693:9: Call
    691.       }
    692.   
    693.       x = SRP_Calc_x(salttmp, user, pass);
                   ^
    694.   
    695.       *verifier = BN_new();

crypto/srp/srp_lib.c:135:10: Call
      133.           goto err;
      134.   
      135.       if (!EVP_DigestInit_ex(ctxt, EVP_sha1(), NULL)
                      ^
      136.           || !EVP_DigestUpdate(ctxt, user, strlen(user))
      137.           || !EVP_DigestUpdate(ctxt, ":", 1)

crypto/evp/digest.c:88:20: Call
        86.           } else {
        87.               /* Ask if an ENGINE is reserved for this job */
        88.               impl = ENGINE_get_digest_engine(type->type);
                                 ^
        89.           }
        90.           if (impl != NULL) {

crypto/engine/tb_digest.c:65:12: Call
          63.   ENGINE *ENGINE_get_digest_engine(int nid)
          64.   {
          65.       return engine_table_select(&digest_table, nid);
                           ^
          66.   }
          67.   

crypto/engine/eng_table.c:216:10: Call
            214.        * operations. But don't worry about a fprintf(stderr).
            215.        */
            216.       if (!int_table_check(table, 0))
                            ^
            217.           goto end;
            218.       tmplate.nid = nid;

crypto/engine/eng_table.c:72:15: Call
              70.       if (!create)
              71.           return 0;
              72.       if ((lh = lh_ENGINE_PILE_new(engine_pile_hash, engine_pile_cmp)) == NULL)
                                  ^
              73.           return 0;
              74.       *t = (ENGINE_TABLE *)lh;

crypto/engine/eng_int.h:169:1: Call
                167.   typedef struct st_engine_pile ENGINE_PILE;
                168.   
                169. > DEFINE_LHASH_OF(ENGINE_PILE);
                170.   
                171.   #endif                          /* HEADER_ENGINE_INT_H */

crypto/lhash/lhash.c:62:5: Assignment
                  60.       ret->hash = ((h == NULL) ? (OPENSSL_LH_HASHFUNC)OPENSSL_LH_strhash : h);
                  61.       ret->num_nodes = MIN_NODES / 2;
                  62.       ret->num_alloc_nodes = MIN_NODES;
                            ^
                  63.       ret->pmax = MIN_NODES / 2;
                  64.       ret->up_load = UP_LOAD;

test/sslapitest.c:4157:17: Call
4155.               || !TEST_ptr(row[DB_srptype])
4156.               || !TEST_ptr(row[DB_srpgN])
4157.               || !TEST_true(TXT_DB_insert(db, row)))
                        ^
4158.           goto end;
4159.   

crypto/txt_db/txt_db.c:237:1: Parameter `(*db->index)->num_alloc_nodes`
  235.   }
  236.   
  237. > int TXT_DB_insert(TXT_DB *db, OPENSSL_STRING *row)
  238.   {
  239.       int i;

crypto/txt_db/txt_db.c:260:19: Call
  258.               if ((db->qual[i] != NULL) && (db->qual[i] (row) == 0))
  259.                   continue;
  260.               (void)lh_OPENSSL_STRING_insert(db->index[i], row);
                           ^
  261.               if (lh_OPENSSL_STRING_retrieve(db->index[i], row) == NULL)
  262.                   goto err1;

include/openssl/lhash.h:197:1: Parameter `lh->num_alloc_nodes`
    195.       LHASH_OF(type)
    196.   
    197. > DEFINE_LHASH_OF(OPENSSL_STRING);
    198.   # ifdef _MSC_VER
    199.   /*

include/openssl/lhash.h:197:1: Call
    195.       LHASH_OF(type)
    196.   
    197. > DEFINE_LHASH_OF(OPENSSL_STRING);
    198.   # ifdef _MSC_VER
    199.   /*

crypto/lhash/lhash.c:94:1: Parameter `lh->num_alloc_nodes`
      92.   }
      93.   
      94. > void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data)
      95.   {
      96.       unsigned long hash;

crypto/lhash/lhash.c:101:77: Call
      99.   
      100.       lh->error = 0;
      101.       if ((lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)) && !expand(lh))
                                                                                         ^
      102.           return NULL;        /* 'lh->error++' already done in 'expand' */
      103.   

crypto/lhash/lhash.c:210:1: <Offset trace>
208.   }
209.   
210. > static int expand(OPENSSL_LHASH *lh)
211.   {
212.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:210:1: Parameter `lh->num_alloc_nodes`
        208.   }
        209.   
        210. > static int expand(OPENSSL_LHASH *lh)
        211.   {
        212.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:216:5: Assignment
        214.       unsigned long hash;
        215.   
        216.       nni = lh->num_alloc_nodes;
                   ^
        217.       p = lh->p;
        218.       pmax = lh->pmax;

crypto/lhash/lhash.c:210:1: <Length trace>
208.   }
209.   
210. > static int expand(OPENSSL_LHASH *lh)
211.   {
212.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:210:1: Parameter `lh->num_alloc_nodes`
        208.   }
        209.   
        210. > static int expand(OPENSSL_LHASH *lh)
        211.   {
        212.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:216:5: Assignment
        214.       unsigned long hash;
        215.   
        216.       nni = lh->num_alloc_nodes;
                   ^
        217.       p = lh->p;
        218.       pmax = lh->pmax;

crypto/lhash/lhash.c:227:9: Array access: Offset added: [272, +oo] (⇐ [16, +oo] + [256, +oo]) Size: [1, +oo] by call to `TXT_DB_insert` 
        225.           }
        226.           lh->b = n;
        227.           memset(n + nni, 0, sizeof(*n) * (j - nni));
                       ^
        228.           lh->pmax = nni;
        229.           lh->num_alloc_nodes = j;
