apps/s_client.c:349: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [0, +oo] by call to `SSL_new`.
Showing all 21 steps of the trace


apps/s_client.c:315:6: Call
313.   
314.   	SSLeay_add_ssl_algorithms();
315.   	ctx=SSL_CTX_new(meth);
            ^
316.   	if (ctx == NULL)
317.   		{

ssl/ssl_lib.c:955:16: Call
  953.   	ret->client_cert_cb=NULL;
  954.   
  955.   	ret->sessions=lh_new(SSL_SESSION_hash,SSL_SESSION_cmp);
                        ^
  956.   	if (ret->sessions == NULL) goto err;
  957.   	ret->cert_store=X509_STORE_new();

crypto/lhash/lhash.c:135:29: Array declaration
    133.   	if ((ret=(LHASH *)Malloc(sizeof(LHASH))) == NULL)
    134.   		goto err0;
    135.   	if ((ret->b=(LHASH_NODE **)Malloc(sizeof(LHASH_NODE *)*MIN_NODES)) == NULL)
                                       ^
    136.   		goto err1;
    137.   	for (i=0; i<MIN_NODES; i++)

crypto/lhash/lhash.c:135:7: Assignment
    133.   	if ((ret=(LHASH *)Malloc(sizeof(LHASH))) == NULL)
    134.   		goto err0;
    135.   	if ((ret->b=(LHASH_NODE **)Malloc(sizeof(LHASH_NODE *)*MIN_NODES)) == NULL)
                 ^
    136.   		goto err1;
    137.   	for (i=0; i<MIN_NODES; i++)

apps/s_client.c:349:13: Call
347.   	SSL_load_error_strings();
348.   
349.   	con=(SSL *)SSL_new(ctx);
                   ^
350.   /*	SSL_set_cipher_list(con,"RC4-MD5"); */
351.   

ssl/ssl_lib.c:162:1: Parameter `*ctx->sessions->b`
  160.   	}
  161.   
  162. > SSL *SSL_new(SSL_CTX *ctx)
  163.   	{
  164.   	SSL *s;

ssl/ssl_lib.c:209:2: Call
  207.   	s->server=(ctx->method->ssl_accept == ssl_undefined_function)?0:1;
  208.   	s->options=ctx->options;
  209.   	SSL_clear(s);
          ^
  210.   
  211.   	CRYPTO_new_ex_data(ssl_meth,(char *)s,&s->ex_data);

ssl/ssl_lib.c:82:1: Parameter `*s->ctx->sessions->b`
    80.   	};
    81.   
    82. > int SSL_clear(SSL *s)
    83.   	{
    84.   	int state;

ssl/ssl_lib.c:121:6: Call
    119.   	ssl_clear_cipher_ctx(s);
    120.   
    121.   	if (ssl_clear_bad_session(s))
                ^
    122.   		{
    123.   		SSL_SESSION_free(s->session);

ssl/ssl_sess.c:520:1: Parameter `*s->ctx->sessions->b`
      518.   	}
      519.   
      520. > int ssl_clear_bad_session(SSL *s)
      521.   	{
      522.   	if (	(s->session != NULL) &&

ssl/ssl_sess.c:526:3: Call
      524.   		!(SSL_in_init(s) || SSL_in_before(s)))
      525.   		{
      526.   		SSL_CTX_remove_session(s->ctx,s->session);
               ^
      527.   		return(1);
      528.   		}

ssl/ssl_sess.c:325:1: Parameter `*ctx->sessions->b`
        323.   	}
        324.   
        325. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
        326.   	{
        327.   	SSL_SESSION *r;

ssl/ssl_sess.c:333:20: Call
        331.   		{
        332.   		CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
        333.   		r=(SSL_SESSION *)lh_delete(ctx->sessions,(char *)c);
                                  ^
        334.   		if (r != NULL)
        335.   			{

crypto/lhash/lhash.c:231:1: Parameter `*lh->b`
          229.   	}
          230.   
          231. > char *lh_delete(LHASH *lh, char *data)
          232.   	{
          233.   	unsigned long hash;

crypto/lhash/lhash.c:257:3: Call
          255.   	if ((lh->num_nodes > MIN_NODES) &&
          256.   		(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))
          257.   		contract(lh);
                   ^
          258.   
          259.   	return(ret);

crypto/lhash/lhash.c:366:1: <Offset trace>
364.   	}
365.   
366. > static void contract(LHASH *lh)
367.   	{
368.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:366:1: Parameter `lh->p`
            364.   	}
            365.   
            366. > static void contract(LHASH *lh)
            367.   	{
            368.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:389:3: Assignment
            387.   		}
            388.   	else
            389.   		lh->p--;
                     ^
            390.   
            391.   	lh->num_nodes--;

crypto/lhash/lhash.c:366:1: <Length trace>
364.   	}
365.   
366. > static void contract(LHASH *lh)
367.   	{
368.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:366:1: Parameter `*lh->b`
            364.   	}
            365.   
            366. > static void contract(LHASH *lh)
            367.   	{
            368.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:394:5: Array access: Offset: [-1, +oo] Size: [0, +oo] by call to `SSL_new` 
            392.   	lh->num_contracts++;
            393.   
            394.   	n1=lh->b[(int)lh->p];
                       ^
            395.   	if (n1 == NULL)
            396.   		lh->b[(int)lh->p]=np;
