crypto/srp/srp_vfy.c:571: error: BUFFER_OVERRUN_L3
  Offset: [-2, +oo] Size: 2500 by call to `t_tob64`.
Showing all 7 steps of the trace


crypto/srp/srp_vfy.c:521:1: Array declaration
519.    * create a verifier (*salt,*verifier,g and N are in base64)
520.    */
521. > char *SRP_create_verifier(const char *user, const char *pass, char **salt,
522.                             char **verifier, const char *N, const char *g)
523.   {

crypto/srp/srp_vfy.c:571:5: Call
569.       if (((vf = OPENSSL_malloc(vfsize)) == NULL))
570.           goto err;
571.       t_tob64(vf, tmp, BN_num_bytes(v));
           ^
572.   
573.       if (*salt == NULL) {

crypto/srp/srp_vfy.c:138:1: <Offset trace>
136.    * Convert a raw byte string into a null-terminated base64 ASCII string.
137.    */
138. > static char *t_tob64(char *dst, const unsigned char *src, int size)
139.   {
140.       int c, pos = size % 3;

crypto/srp/srp_vfy.c:138:1: Parameter `size`
  136.    * Convert a raw byte string into a null-terminated base64 ASCII string.
  137.    */
  138. > static char *t_tob64(char *dst, const unsigned char *src, int size)
  139.   {
  140.       int c, pos = size % 3;

crypto/srp/srp_vfy.c:138:1: <Length trace>
136.    * Convert a raw byte string into a null-terminated base64 ASCII string.
137.    */
138. > static char *t_tob64(char *dst, const unsigned char *src, int size)
139.   {
140.       int c, pos = size % 3;

crypto/srp/srp_vfy.c:138:1: Parameter `*src`
  136.    * Convert a raw byte string into a null-terminated base64 ASCII string.
  137.    */
  138. > static char *t_tob64(char *dst, const unsigned char *src, int size)
  139.   {
  140.       int c, pos = size % 3;

crypto/srp/srp_vfy.c:178:18: Array access: Offset: [-2, +oo] Size: 2500 by call to `t_tob64` 
  176.               break;
  177.           else {
  178.               b0 = src[pos++];
                          ^
  179.               b1 = src[pos++];
  180.               b2 = src[pos++];
