apps/x509.c:645: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [0, +oo] by call to `x509_certify`.
Showing all 17 steps of the trace


apps/x509.c:170:6: Call
168.   	CAkeyformat=FORMAT_PEM;
169.   
170.   	ctx=X509_STORE_new();
            ^
171.   	if (ctx == NULL) goto end;
172.   	X509_STORE_set_verify_cb_func(ctx,callb);

crypto/x509/x509_lu.c:202:13: Call
  200.   	if ((ret=(X509_STORE *)Malloc(sizeof(X509_STORE))) == NULL)
  201.   		return(NULL);
  202.   	ret->certs=lh_new(x509_object_hash,x509_object_cmp);
                     ^
  203.   	ret->cache=1;
  204.   	ret->get_cert_methods=sk_X509_LOOKUP_new_null();

crypto/lhash/lhash.c:124:29: Array declaration
    122.   	if ((ret=(LHASH *)Malloc(sizeof(LHASH))) == NULL)
    123.   		goto err0;
    124.   	if ((ret->b=(LHASH_NODE **)Malloc(sizeof(LHASH_NODE *)*MIN_NODES)) == NULL)
                                       ^
    125.   		goto err1;
    126.   	for (i=0; i<MIN_NODES; i++)

crypto/lhash/lhash.c:124:7: Assignment
    122.   	if ((ret=(LHASH *)Malloc(sizeof(LHASH))) == NULL)
    123.   		goto err0;
    124.   	if ((ret->b=(LHASH_NODE **)Malloc(sizeof(LHASH_NODE *)*MIN_NODES)) == NULL)
                 ^
    125.   		goto err1;
    126.   	for (i=0; i<MIN_NODES; i++)

apps/x509.c:645:10: Call
643.   #endif
644.   				
645.   				if (!x509_certify(ctx,CAfile,digest,x,xca,
                ^
646.   					CApkey, CAserial,CA_createserial,days,
647.   					extconf, extsect))

apps/x509.c:735:1: Parameter `*ctx->certs->b`
  733.   	}
  734.   
  735. > static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
  736.   	     X509 *x, X509 *xca, EVP_PKEY *pkey, char *serialfile, int create,
  737.   	     int days, LHASH *conf, char *section)

apps/x509.c:834:7: Call
  832.   	io=NULL;
  833.   	
  834.   	if (!X509_STORE_add_cert(ctx,x)) goto end;
               ^
  835.   
  836.   	/* NOTE: this certificate can/should be self signed, unless it was

crypto/x509/x509_vfy.c:528:19: Call
    526.   	X509_OBJECT_up_ref_count(obj);
    527.   
    528.   	r=(X509_OBJECT *)lh_insert(ctx->certs,(char *)obj);
                             ^
    529.   	if (r != NULL)
    530.   		{ /* oops, put it back */

crypto/lhash/lhash.c:182:1: Parameter `lh->pmax`
      180.   	}
      181.   
      182. > char *lh_insert(LHASH *lh, char *data)
      183.   	{
      184.   	unsigned long hash;

crypto/x509/x509_vfy.c:531:3: Call
    529.   	if (r != NULL)
    530.   		{ /* oops, put it back */
    531.   		lh_delete(ctx->certs,(char *)obj);
             ^
    532.   		X509_OBJECT_free_contents(obj);
    533.   		Free(obj);

crypto/lhash/lhash.c:220:1: Parameter `*lh->b`
      218.   	}
      219.   
      220. > char *lh_delete(LHASH *lh, char *data)
      221.   	{
      222.   	unsigned long hash;

crypto/lhash/lhash.c:246:3: Call
      244.   	if ((lh->num_nodes > MIN_NODES) &&
      245.   		(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))
      246.   		contract(lh);
               ^
      247.   
      248.   	return(ret);

crypto/lhash/lhash.c:355:1: <Offset trace>
353.   	}
354.   
355. > static void contract(LHASH *lh)
356.   	{
357.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:355:1: Parameter `lh->p`
        353.   	}
        354.   
        355. > static void contract(LHASH *lh)
        356.   	{
        357.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:355:1: <Length trace>
353.   	}
354.   
355. > static void contract(LHASH *lh)
356.   	{
357.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:355:1: Parameter `*lh->b`
        353.   	}
        354.   
        355. > static void contract(LHASH *lh)
        356.   	{
        357.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:359:5: Array access: Offset: [-1, +oo] Size: [0, +oo] by call to `x509_certify` 
        357.   	LHASH_NODE **n,*n1,*np;
        358.   
        359.   	np=lh->b[lh->p+lh->pmax-1];
                   ^
        360.   	lh->b[lh->p+lh->pmax-1]=NULL; /* 24/07-92 - eay - weird but :-( */
        361.   	if (lh->p == 0)
