crypto/srp/srp_vfy.c:384: error: BUFFER_OVERRUN_L2
  Offset: [-oo, 2147483648] Size: 2500 by call to `SRP_gN_place_bn`.
Showing all 14 steps of the trace


crypto/srp/srp_vfy.c:365:18: Call
363.       error_code = SRP_ERR_VBASE_INCOMPLETE_FILE;
364.   
365.       if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)
                        ^
366.           goto err;
367.   

crypto/txt_db/txt_db.c:55:5: Assignment
  53.       add = (num + 1) * sizeof(char *);
  54.       buf->data[size - 1] = '\0';
  55.       offset = 0;
            ^
  56.       for (;;) {
  57.           if (offset != 0) {

crypto/srp/srp_vfy.c:384:29: Call
382.   
383.               if ((gN->id = OPENSSL_strdup(pp[DB_srpid])) == NULL
384.                   || (gN->N = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpverifier]))
                                   ^
385.                           == NULL
386.                   || (gN->g = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpsalt]))

crypto/srp/srp_vfy.c:315:1: Parameter `ch->strlen`
  313.   }
  314.   
  315. > static BIGNUM *SRP_gN_place_bn(STACK_OF(SRP_gN_cache) *gN_cache, char *ch)
  316.   {
  317.       int i;

crypto/srp/srp_vfy.c:328:31: Call
  326.       }
  327.       {                           /* it is the first time that we find it */
  328.           SRP_gN_cache *newgN = SRP_gN_new_init(ch);
                                       ^
  329.           if (newgN) {
  330.               if (sk_SRP_gN_cache_insert(gN_cache, newgN, 0) > 0)

crypto/srp/srp_vfy.c:266:1: Array declaration
    264.   }
    265.   
    266. > static SRP_gN_cache *SRP_gN_new_init(const char *ch)
    267.   {
    268.       unsigned char tmp[MAX_LEN];

crypto/srp/srp_vfy.c:275:11: Call
    273.           return NULL;
    274.   
    275.       len = t_fromb64(tmp, sizeof(tmp), ch);
                     ^
    276.       if (len < 0)
    277.           goto err;

crypto/srp/srp_vfy.c:33:1: <Offset trace>
31.    * Convert a base64 string into raw byte array representation.
32.    */
33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
34.   {
35.       char *loc;

crypto/srp/srp_vfy.c:33:1: Parameter `alen`
      31.    * Convert a base64 string into raw byte array representation.
      32.    */
      33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
      34.   {
      35.       char *loc;

crypto/srp/srp_vfy.c:57:5: Assignment
      55.       if (i == 0)
      56.           return 0;
      57.       size = i;
                ^
      58.       i = size - 1;
      59.       j = size;

crypto/srp/srp_vfy.c:59:5: Assignment
      57.       size = i;
      58.       i = size - 1;
      59.       j = size;
                ^
      60.       while (1) {
      61.           a[j] = a[i];

crypto/srp/srp_vfy.c:33:1: <Length trace>
31.    * Convert a base64 string into raw byte array representation.
32.    */
33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
34.   {
35.       char *loc;

crypto/srp/srp_vfy.c:33:1: Parameter `*a`
      31.    * Convert a base64 string into raw byte array representation.
      32.    */
      33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
      34.   {
      35.       char *loc;

crypto/srp/srp_vfy.c:80:12: Array access: Offset: [-oo, 2147483648] Size: 2500 by call to `SRP_gN_place_bn` 
      78.               break;
      79.       }
      80.       while (a[j] == 0 && j <= size)
                       ^
      81.           ++j;
      82.       i = 0;
