crypto/bio/bss_acpt.c:318: error: BUFFER_OVERRUN_L3
  Offset added: [1, +oo] Size: [0, +oo] by call to `acpt_state`.
Showing all 17 steps of the trace


crypto/bio/bss_acpt.c:309:1: Parameter `b->ptr->addr`
307.   }
308.   
309. > static int acpt_write(BIO *b, const char *in, int inl)
310.   {
311.       int ret;

crypto/bio/bss_acpt.c:318:15: Call
316.   
317.       while (b->next_bio == NULL) {
318.           ret = acpt_state(b, data);
                     ^
319.           if (ret <= 0)
320.               return (ret);

crypto/bio/bss_acpt.c:189:1: Parameter `*c->addr`
  187.   }
  188.   
  189. > static int acpt_state(BIO *b, BIO_ACCEPT *c)
  190.   {
  191.       BIO *bio = NULL, *dbio;

crypto/bio/bss_acpt.c:226:13: Call
  224.           BIO_clear_retry_flags(b);
  225.           b->retry_reason = 0;
  226.           i = BIO_accept(c->accept_sock, &(c->addr));
                     ^
  227.   
  228.           /* -2 return means we should retry */

crypto/bio/b_sock.c:583:1: Parameter `**addr`
    581.   }
    582.   
    583. > int BIO_accept(int sock, char **addr)
    584.   {
    585.       int ret = (int)INVALID_SOCKET;

crypto/bio/b_sock.c:698:5: Call
    696.           *addr = p;
    697.       }
    698.       BIO_snprintf(*addr, 24, "%d.%d.%d.%d:%d",
               ^
    699.                    (unsigned char)(l >> 24L) & 0xff,
    700.                    (unsigned char)(l >> 16L) & 0xff,

crypto/bio/b_print.c:786:1: Parameter `*buf`
      784.    * function should be renamed, but to what?)
      785.    */
      786. > int BIO_snprintf(char *buf, size_t n, const char *format, ...)
      787.   {
      788.       va_list args;

crypto/bio/b_print.c:793:11: Call
      791.       va_start(args, format);
      792.   
      793.       ret = BIO_vsnprintf(buf, n, format, args);
                       ^
      794.   
      795.       va_end(args);

crypto/bio/b_print.c:799:1: Parameter `*buf`
        797.   }
        798.   
        799. > int BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)
        800.   {
        801.       size_t retlen;

crypto/bio/b_print.c:804:5: Call
        802.       int truncated;
        803.   
        804.       _dopr(&buf, NULL, &n, &retlen, &truncated, format, args);
                   ^
        805.   
        806.       if (truncated)

crypto/bio/b_print.c:168:1: Parameter `*maxlen`
          166.   #define OSSL_MAX(p,q) ((p >= q) ? p : q)
          167.   
          168. > static void
          169.   _dopr(char **sbuffer,
          170.         char **buffer,

crypto/bio/b_print.c:199:17: Call
          197.                   state = DP_S_FLAGS;
          198.               else
          199.                   doapr_outch(sbuffer, buffer, &currlen, maxlen, ch);
                                 ^
          200.               ch = *format++;
          201.               break;

crypto/bio/b_print.c:700:1: <Offset trace>
698.   }
699.   
700. > static void
701.   doapr_outch(char **sbuffer,
702.               char **buffer, size_t *currlen, size_t *maxlen, int c)

crypto/bio/b_print.c:700:1: Parameter `*maxlen`
            698.   }
            699.   
            700. > static void
            701.   doapr_outch(char **sbuffer,
            702.               char **buffer, size_t *currlen, size_t *maxlen, int c)

crypto/bio/b_print.c:700:1: <Length trace>
698.   }
699.   
700. > static void
701.   doapr_outch(char **sbuffer,
702.               char **buffer, size_t *currlen, size_t *maxlen, int c)

crypto/bio/b_print.c:700:1: Parameter `**sbuffer`
            698.   }
            699.   
            700. > static void
            701.   doapr_outch(char **sbuffer,
            702.               char **buffer, size_t *currlen, size_t *maxlen, int c)

crypto/bio/b_print.c:720:17: Array access: Offset added: [1, +oo] Size: [0, +oo] by call to `acpt_state` 
            718.               if (*currlen > 0) {
            719.                   assert(*sbuffer != NULL);
            720.                   memcpy(*buffer, *sbuffer, *currlen);
                                   ^
            721.               }
            722.               *sbuffer = NULL;
