crypto/txt_db/txt_db.c:111: error: BUFFER_OVERRUN_S2
  Offset: [max(1, `num`), `num`] Size: [1, +oo].
Showing all 10 steps of the trace


crypto/txt_db/txt_db.c:20:1: <Offset trace>
18.   #define BUFSIZE 512
19.   
20. > TXT_DB *TXT_DB_read(BIO *in, int num)
21.   {
22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:20:1: Parameter `num`
18.   #define BUFSIZE 512
19.   
20. > TXT_DB *TXT_DB_read(BIO *in, int num)
21.   {
22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:20:1: <Length trace>
18.   #define BUFSIZE 512
19.   
20. > TXT_DB *TXT_DB_read(BIO *in, int num)
21.   {
22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:20:1: Parameter `num`
18.   #define BUFSIZE 512
19.   
20. > TXT_DB *TXT_DB_read(BIO *in, int num)
21.   {
22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:53:5: Assignment
51.       }
52.   
53.       add = (num + 1) * sizeof(char *);
          ^
54.       buf->data[size - 1] = '\0';
55.       offset = 0;

crypto/txt_db/txt_db.c:75:22: Call
73.           else {
74.               buf->data[offset - 1] = '\0'; /* blat the '\n' */
75.               if ((p = OPENSSL_malloc(add + offset)) == NULL)
                           ^
76.                   goto err;
77.               offset = 0;

crypto/mem.c:166:9: Assignment
  164.   
  165.       if (num == 0)
  166.           return NULL;
                 ^
  167.   
  168.       FAILTEST();

crypto/txt_db/txt_db.c:75:18: Assignment
73.           else {
74.               buf->data[offset - 1] = '\0'; /* blat the '\n' */
75.               if ((p = OPENSSL_malloc(add + offset)) == NULL)
                       ^
76.                   goto err;
77.               offset = 0;

crypto/txt_db/txt_db.c:79:9: Assignment
77.               offset = 0;
78.           }
79.           pp = (char **)p;
              ^
80.           p += add;
81.           n = 0;

crypto/txt_db/txt_db.c:111:9: Array access: Offset: [max(1, num), num] Size: [1, +oo]
109.               goto err;
110.           }
111.           pp[n] = p;
               ^
112.           if (!sk_OPENSSL_PSTRING_push(ret->data, pp)) {
113.               OPENSSL_free(pp);
