apps/ciphers.c:240: error: BUFFER_OVERRUN_L3
  Offset added: [1, +oo] Size: [0, +oo] by call to `SSL_CIPHER_description`.
Showing all 15 steps of the trace


apps/ciphers.c:106:1: Array declaration
104.   #endif
105.   
106. > int ciphers_main(int argc, char **argv)
107.   {
108.       SSL_CTX *ctx = NULL;

apps/ciphers.c:240:31: Call
238.               }
239.   #endif
240.               BIO_puts(bio_out, SSL_CIPHER_description(c, buf, sizeof buf));
                                     ^
241.           }
242.       }

ssl/ssl_ciph.c:1580:1: Parameter `*buf`
  1578.   }
  1579.   
  1580. > char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
  1581.   {
  1582.       const char *ver;

ssl/ssl_ciph.c:1779:5: Call
  1777.           return ("Buffer too small");
  1778.   
  1779.       BIO_snprintf(buf, len, format, cipher->name, ver, kx, au, enc, mac);
              ^
  1780.   
  1781.       return (buf);

crypto/bio/b_print.c:786:1: Parameter `*buf`
    784.    * function should be renamed, but to what?)
    785.    */
    786. > int BIO_snprintf(char *buf, size_t n, const char *format, ...)
    787.   {
    788.       va_list args;

crypto/bio/b_print.c:793:11: Call
    791.       va_start(args, format);
    792.   
    793.       ret = BIO_vsnprintf(buf, n, format, args);
                     ^
    794.   
    795.       va_end(args);

crypto/bio/b_print.c:799:1: Parameter `*buf`
      797.   }
      798.   
      799. > int BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)
      800.   {
      801.       size_t retlen;

crypto/bio/b_print.c:804:5: Call
      802.       int truncated;
      803.   
      804.       _dopr(&buf, NULL, &n, &retlen, &truncated, format, args);
                 ^
      805.   
      806.       if (truncated)

crypto/bio/b_print.c:168:1: Parameter `*maxlen`
        166.   #define OSSL_MAX(p,q) ((p >= q) ? p : q)
        167.   
        168. > static void
        169.   _dopr(char **sbuffer,
        170.         char **buffer,

crypto/bio/b_print.c:199:17: Call
        197.                   state = DP_S_FLAGS;
        198.               else
        199.                   doapr_outch(sbuffer, buffer, &currlen, maxlen, ch);
                               ^
        200.               ch = *format++;
        201.               break;

crypto/bio/b_print.c:700:1: <Offset trace>
698.   }
699.   
700. > static void
701.   doapr_outch(char **sbuffer,
702.               char **buffer, size_t *currlen, size_t *maxlen, int c)

crypto/bio/b_print.c:700:1: Parameter `*maxlen`
          698.   }
          699.   
          700. > static void
          701.   doapr_outch(char **sbuffer,
          702.               char **buffer, size_t *currlen, size_t *maxlen, int c)

crypto/bio/b_print.c:700:1: <Length trace>
698.   }
699.   
700. > static void
701.   doapr_outch(char **sbuffer,
702.               char **buffer, size_t *currlen, size_t *maxlen, int c)

crypto/bio/b_print.c:700:1: Parameter `**sbuffer`
          698.   }
          699.   
          700. > static void
          701.   doapr_outch(char **sbuffer,
          702.               char **buffer, size_t *currlen, size_t *maxlen, int c)

crypto/bio/b_print.c:720:17: Array access: Offset added: [1, +oo] Size: [0, +oo] by call to `SSL_CIPHER_description` 
          718.               if (*currlen > 0) {
          719.                   assert(*sbuffer != NULL);
          720.                   memcpy(*buffer, *sbuffer, *currlen);
                                 ^
          721.               }
          722.               *sbuffer = NULL;
