crypto/txt_db/txt_db.c:159: error: BUFFER_OVERRUN_S2
  Offset: [max(1, `num`), `num`] Size: [1, +oo].
Showing all 10 steps of the trace


crypto/txt_db/txt_db.c:69:1: <Offset trace>
67.   #define BUFSIZE 512
68.   
69. > TXT_DB *TXT_DB_read(BIO *in, int num)
70.   {
71.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:69:1: Parameter `num`
67.   #define BUFSIZE 512
68.   
69. > TXT_DB *TXT_DB_read(BIO *in, int num)
70.   {
71.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:69:1: <Length trace>
67.   #define BUFSIZE 512
68.   
69. > TXT_DB *TXT_DB_read(BIO *in, int num)
70.   {
71.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:69:1: Parameter `num`
67.   #define BUFSIZE 512
68.   
69. > TXT_DB *TXT_DB_read(BIO *in, int num)
70.   {
71.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:102:5: Assignment
100.       }
101.   
102.       add = (num + 1) * sizeof(char *);
           ^
103.       buf->data[size - 1] = '\0';
104.       offset = 0;

crypto/txt_db/txt_db.c:124:22: Call
122.           else {
123.               buf->data[offset - 1] = '\0'; /* blat the '\n' */
124.               if ((p = OPENSSL_malloc(add + offset)) == NULL)
                            ^
125.                   goto err;
126.               offset = 0;

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/txt_db/txt_db.c:124:18: Assignment
122.           else {
123.               buf->data[offset - 1] = '\0'; /* blat the '\n' */
124.               if ((p = OPENSSL_malloc(add + offset)) == NULL)
                        ^
125.                   goto err;
126.               offset = 0;

crypto/txt_db/txt_db.c:128:9: Assignment
126.               offset = 0;
127.           }
128.           pp = (char **)p;
               ^
129.           p += add;
130.           n = 0;

crypto/txt_db/txt_db.c:159:9: Array access: Offset: [max(1, num), num] Size: [1, +oo]
157.               goto err;
158.           }
159.           pp[n] = p;
               ^
160.           if (!sk_OPENSSL_PSTRING_push(ret->data, pp))
161.               goto err;
