apps/apps.c:1518: error: BUFFER_OVERRUN_L3
  Offset: 6 Size: [1, +oo] by call to `TXT_DB_read`.
Showing all 11 steps of the trace


apps/apps.c:1518:18: Call
1516.           goto err;
1517.       }
1518.       if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)
                         ^
1519.           goto err;
1520.   

crypto/txt_db/txt_db.c:20:1: <Offset trace>
18.   #define BUFSIZE 512
19.   
20. > TXT_DB *TXT_DB_read(BIO *in, int num)
21.   {
22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:20:1: Parameter `num`
  18.   #define BUFSIZE 512
  19.   
  20. > TXT_DB *TXT_DB_read(BIO *in, int num)
  21.   {
  22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:20:1: <Length trace>
18.   #define BUFSIZE 512
19.   
20. > TXT_DB *TXT_DB_read(BIO *in, int num)
21.   {
22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:20:1: Parameter `num`
  18.   #define BUFSIZE 512
  19.   
  20. > TXT_DB *TXT_DB_read(BIO *in, int num)
  21.   {
  22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:53:5: Assignment
  51.       }
  52.   
  53.       add = (num + 1) * sizeof(char *);
            ^
  54.       buf->data[size - 1] = '\0';
  55.       offset = 0;

crypto/txt_db/txt_db.c:75:22: Call
  73.           else {
  74.               buf->data[offset - 1] = '\0'; /* blat the '\n' */
  75.               if ((p = OPENSSL_malloc(add + offset)) == NULL)
                             ^
  76.                   goto err;
  77.               offset = 0;

crypto/mem.c:166:9: Assignment
    164.   
    165.       if (num == 0)
    166.           return NULL;
                   ^
    167.   
    168.       FAILTEST();

crypto/txt_db/txt_db.c:75:18: Assignment
  73.           else {
  74.               buf->data[offset - 1] = '\0'; /* blat the '\n' */
  75.               if ((p = OPENSSL_malloc(add + offset)) == NULL)
                         ^
  76.                   goto err;
  77.               offset = 0;

crypto/txt_db/txt_db.c:79:9: Assignment
  77.               offset = 0;
  78.           }
  79.           pp = (char **)p;
                ^
  80.           p += add;
  81.           n = 0;

crypto/txt_db/txt_db.c:111:9: Array access: Offset: 6 Size: [1, +oo] by call to `TXT_DB_read` 
  109.               goto err;
  110.           }
  111.           pp[n] = p;
                 ^
  112.           if (!sk_OPENSSL_PSTRING_push(ret->data, pp)) {
  113.               OPENSSL_free(pp);
