crypto/ocsp/ocsp_ht.c:540: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, 4096] by call to `OCSP_sendreq_nbio`.
Showing all 18 steps of the trace


crypto/ocsp/ocsp_ht.c:534:11: Call
532.       int rv;
533.   
534.       ctx = OCSP_sendreq_new(b, path, req, -1);
                 ^
535.   
536.       if (ctx == NULL)

crypto/ocsp/ocsp_ht.c:229:1: Parameter `maxline`
  227.   }
  228.   
  229. > OCSP_REQ_CTX *OCSP_sendreq_new(BIO *io, const char *path, OCSP_REQUEST *req,
  230.                                  int maxline)
  231.   {

crypto/ocsp/ocsp_ht.c:234:12: Call
  232.   
  233.       OCSP_REQ_CTX *rctx = NULL;
  234.       rctx = OCSP_REQ_CTX_new(io, maxline);
                    ^
  235.       if (rctx == NULL)
  236.           return NULL;

crypto/ocsp/ocsp_ht.c:127:9: Assignment
    125.           rctx->iobuflen = maxline;
    126.       else
    127.           rctx->iobuflen = OCSP_MAX_LINE_LEN;
                   ^
    128.       rctx->iobuf = OPENSSL_malloc(rctx->iobuflen);
    129.       if (rctx->iobuf == NULL || rctx->mem == NULL) {

crypto/ocsp/ocsp_ht.c:128:19: Call
    126.       else
    127.           rctx->iobuflen = OCSP_MAX_LINE_LEN;
    128.       rctx->iobuf = OPENSSL_malloc(rctx->iobuflen);
                             ^
    129.       if (rctx->iobuf == NULL || rctx->mem == NULL) {
    130.           OCSP_REQ_CTX_free(rctx);

crypto/mem.c:125:9: Assignment
      123.   
      124.       if (num <= 0)
      125.           return NULL;
                     ^
      126.   
      127.       allow_customize = 0;

crypto/ocsp/ocsp_ht.c:128:5: Assignment
    126.       else
    127.           rctx->iobuflen = OCSP_MAX_LINE_LEN;
    128.       rctx->iobuf = OPENSSL_malloc(rctx->iobuflen);
               ^
    129.       if (rctx->iobuf == NULL || rctx->mem == NULL) {
    130.           OCSP_REQ_CTX_free(rctx);

crypto/ocsp/ocsp_ht.c:540:14: Call
538.   
539.       do {
540.           rv = OCSP_sendreq_nbio(&resp, ctx);
                    ^
541.       } while ((rv == -1) && BIO_should_retry(b));
542.   

crypto/ocsp/ocsp_ht.c:519:1: Parameter `*rctx->iobuf`
  517.   }
  518.   
  519. > int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx)
  520.   {
  521.       return OCSP_REQ_CTX_nbio_d2i(rctx,

crypto/ocsp/ocsp_ht.c:521:12: Call
  519.   int OCSP_sendreq_nbio(OCSP_RESPONSE **presp, OCSP_REQ_CTX *rctx)
  520.   {
  521.       return OCSP_REQ_CTX_nbio_d2i(rctx,
                    ^
  522.                                    (ASN1_VALUE **)presp,
  523.                                    ASN1_ITEM_rptr(OCSP_RESPONSE));

crypto/ocsp/ocsp_ht.c:172:1: Parameter `*rctx->iobuf`
    170.   }
    171.   
    172. > int OCSP_REQ_CTX_nbio_d2i(OCSP_REQ_CTX *rctx,
    173.                             ASN1_VALUE **pval, const ASN1_ITEM *it)
    174.   {

crypto/ocsp/ocsp_ht.c:178:10: Call
    176.       const unsigned char *p;
    177.   
    178.       rv = OCSP_REQ_CTX_nbio(rctx);
                    ^
    179.       if (rv != 1)
    180.           return rv;

crypto/ocsp/ocsp_ht.c:322:1: <Length trace>
320.   }
321.   
322. > int OCSP_REQ_CTX_nbio(OCSP_REQ_CTX *rctx)
323.   {
324.       int i, n;

crypto/ocsp/ocsp_ht.c:322:1: Parameter `*rctx->iobuf`
      320.   }
      321.   
      322. > int OCSP_REQ_CTX_nbio(OCSP_REQ_CTX *rctx)
      323.   {
      324.       int i, n;

crypto/ocsp/ocsp_ht.c:439:18: Assignment
      437.           } else {
      438.               /* Look for blank line: end of headers */
      439.               for (p = rctx->iobuf; *p; p++) {
                              ^
      440.                   if ((*p != '\r') && (*p != '\n'))
      441.                       break;

crypto/ocsp/ocsp_ht.c:463:14: Assignment
      461.   
      462.           /* Check it is an ASN1 SEQUENCE */
      463.           if (*p++ != (V_ASN1_SEQUENCE | V_ASN1_CONSTRUCTED)) {
                          ^
      464.               rctx->state = OHS_ERROR;
      465.               return 0;

crypto/ocsp/ocsp_ht.c:482:13: Assignment
      480.                   return 0;
      481.               }
      482.               p++;
                         ^
      483.               rctx->asn1_len = 0;
      484.               for (i = 0; i < n; i++) {

crypto/ocsp/ocsp_ht.c:486:35: Array access: Offset: [2, +oo] Size: [1, 4096] by call to `OCSP_sendreq_nbio` 
      484.               for (i = 0; i < n; i++) {
      485.                   rctx->asn1_len <<= 8;
      486.                   rctx->asn1_len |= *p++;
                                               ^
      487.               }
      488.   
