crypto/err/err.c:295: error: BUFFER_OVERRUN_L3
  Offset: [16, +oo] Size: [1, +oo] by call to `lh_ERR_STRING_DATA_insert`.
Showing all 17 steps of the trace


crypto/err/err.c:289:26: Call
287.       CRYPTO_THREAD_write_lock(err_string_lock);
288.       if (int_error_hash == NULL)
289.           int_error_hash = lh_ERR_STRING_DATA_new(err_string_data_hash,
                                ^
290.                                                   err_string_data_cmp);
291.       if (int_error_hash != NULL) {

include/openssl/err.h:206:1: Call
  204.   } ERR_STRING_DATA;
  205.   
  206. > DEFINE_LHASH_OF(ERR_STRING_DATA);
  207.   
  208.   void ERR_put_error(int lib, int func, int reason, const char *file, int line);

crypto/lhash/lhash.c:40:5: Assignment
    38.       ret->hash = ((h == NULL) ? (OPENSSL_LH_HASHFUNC)OPENSSL_LH_strhash : h);
    39.       ret->num_nodes = MIN_NODES / 2;
    40.       ret->num_alloc_nodes = MIN_NODES;
              ^
    41.       ret->pmax = MIN_NODES / 2;
    42.       ret->up_load = UP_LOAD;

crypto/err/err.c:295:19: Call
293.               if (lib)
294.                   str->error |= ERR_PACK(lib, 0, 0);
295.               (void)lh_ERR_STRING_DATA_insert(int_error_hash, str);
                         ^
296.           }
297.       }

include/openssl/err.h:206:1: Parameter `lh->num_alloc_nodes`
  204.   } ERR_STRING_DATA;
  205.   
  206. > DEFINE_LHASH_OF(ERR_STRING_DATA);
  207.   
  208.   void ERR_put_error(int lib, int func, int reason, const char *file, int line);

include/openssl/err.h:206:1: Call
  204.   } ERR_STRING_DATA;
  205.   
  206. > DEFINE_LHASH_OF(ERR_STRING_DATA);
  207.   
  208.   void ERR_put_error(int lib, int func, int reason, const char *file, int line);

crypto/lhash/lhash.c:73:1: Parameter `lh->num_alloc_nodes`
    71.   }
    72.   
    73. > void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data)
    74.   {
    75.       unsigned long hash;

crypto/lhash/lhash.c:80:77: Call
    78.   
    79.       lh->error = 0;
    80.       if ((lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)) && !expand(lh))
                                                                                      ^
    81.           return NULL;        /* 'lh->error++' already done in 'expand' */
    82.   

crypto/lhash/lhash.c:191:1: <Offset trace>
189.   }
190.   
191. > static int expand(OPENSSL_LHASH *lh)
192.   {
193.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:191:1: Parameter `lh->num_alloc_nodes`
      189.   }
      190.   
      191. > static int expand(OPENSSL_LHASH *lh)
      192.   {
      193.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:217:9: Assignment
      215.   
      216.       if ((lh->p) >= lh->pmax) {
      217.           j = (int)lh->num_alloc_nodes * 2;
                     ^
      218.           n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));
      219.           if (n == NULL) {

crypto/lhash/lhash.c:191:1: <Length trace>
189.   }
190.   
191. > static int expand(OPENSSL_LHASH *lh)
192.   {
193.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:191:1: Parameter `*lh->b`
      189.   }
      190.   
      191. > static int expand(OPENSSL_LHASH *lh)
      192.   {
      193.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:218:13: Call
      216.       if ((lh->p) >= lh->pmax) {
      217.           j = (int)lh->num_alloc_nodes * 2;
      218.           n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));
                         ^
      219.           if (n == NULL) {
      220.               lh->error++;

crypto/mem.c:207:9: Assignment
        205.       if (num == 0) {
        206.           CRYPTO_free(str, file, line);
        207.           return NULL;
                       ^
        208.       }
        209.   

crypto/lhash/lhash.c:218:9: Assignment
      216.       if ((lh->p) >= lh->pmax) {
      217.           j = (int)lh->num_alloc_nodes * 2;
      218.           n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));
                     ^
      219.           if (n == NULL) {
      220.               lh->error++;

crypto/lhash/lhash.c:226:13: Array access: Offset: [16, +oo] Size: [1, +oo] by call to `lh_ERR_STRING_DATA_insert` 
      224.           }
      225.           for (i = (int)lh->num_alloc_nodes; i < j; i++) /* 26/02/92 eay */
      226.               n[i] = NULL;        /* 02/03/92 eay */
                         ^
      227.           lh->pmax = lh->num_alloc_nodes;
      228.           lh->num_alloc_nodes = j;
