crypto/srp/srp_vfy.c:414: error: BUFFER_OVERRUN_L2
  Offset: [-oo, 2147483646] Size: 2500 by call to `SRP_user_pwd_set_sv`.
Showing all 12 steps of the trace


crypto/srp/srp_vfy.c:368:18: Call
366.       error_code = SRP_ERR_VBASE_INCOMPLETE_FILE;
367.   
368.       if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)
                        ^
369.           goto err;
370.   

crypto/txt_db/txt_db.c:55:5: Assignment
  53.       add = (num + 1) * sizeof(char *);
  54.       buf->data[size - 1] = '\0';
  55.       offset = 0;
            ^
  56.       for (;;) {
  57.           if (offset != 0) {

crypto/srp/srp_vfy.c:414:22: Call
412.   
413.                   error_code = SRP_ERR_VBASE_BN_LIB;
414.                   if (!SRP_user_pwd_set_sv
                            ^
415.                       (user_pwd, pp[DB_srpsalt], pp[DB_srpverifier]))
416.                       goto err;

crypto/srp/srp_vfy.c:184:1: Array declaration
  182.   }
  183.   
  184. > static int SRP_user_pwd_set_sv(SRP_user_pwd *vinfo, const char *s,
  185.                                  const char *v)
  186.   {

crypto/srp/srp_vfy.c:193:11: Call
  191.       vinfo->s = NULL;
  192.   
  193.       len = t_fromb64(tmp, sizeof(tmp), v);
                   ^
  194.       if (len < 0)
  195.           return 0;

crypto/srp/srp_vfy.c:33:1: <Offset trace>
31.    * Convert a base64 string into raw byte array representation.
32.    */
33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
34.   {
35.       char *loc;

crypto/srp/srp_vfy.c:33:1: Parameter `alen`
    31.    * Convert a base64 string into raw byte array representation.
    32.    */
    33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
    34.   {
    35.       char *loc;

crypto/srp/srp_vfy.c:60:5: Assignment
    58.       if (i == 0)
    59.           return 0;
    60.       size = i;
              ^
    61.       i = size - 1;
    62.       j = size;

crypto/srp/srp_vfy.c:62:5: Assignment
    60.       size = i;
    61.       i = size - 1;
    62.       j = size;
              ^
    63.       while (1) {
    64.           a[j] = a[i];

crypto/srp/srp_vfy.c:33:1: <Length trace>
31.    * Convert a base64 string into raw byte array representation.
32.    */
33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
34.   {
35.       char *loc;

crypto/srp/srp_vfy.c:33:1: Parameter `*a`
    31.    * Convert a base64 string into raw byte array representation.
    32.    */
    33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
    34.   {
    35.       char *loc;

crypto/srp/srp_vfy.c:64:9: Array access: Offset: [-oo, 2147483646] Size: 2500 by call to `SRP_user_pwd_set_sv` 
    62.       j = size;
    63.       while (1) {
    64.           a[j] = a[i];
                  ^
    65.           if (--i < 0)
    66.               break;
