ssl/ssl_locl.h:721: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `OPENSSL_LH_delete`.
Showing all 10 steps of the trace


ssl/ssl_locl.h:721:1: Parameter `lh->pmax`
719.   } TLSEXT_INDEX;
720.   
721. > DEFINE_LHASH_OF(SSL_SESSION);
722.   /* Needed in ssl_cert.c */
723.   DEFINE_LHASH_OF(X509_NAME);

ssl/ssl_locl.h:721:1: Call
719.   } TLSEXT_INDEX;
720.   
721. > DEFINE_LHASH_OF(SSL_SESSION);
722.   /* Needed in ssl_cert.c */
723.   DEFINE_LHASH_OF(X509_NAME);

crypto/lhash/lhash.c:103:1: Parameter `lh->pmax`
  101.   }
  102.   
  103. > void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
  104.   {
  105.       unsigned long hash;

crypto/lhash/lhash.c:126:9: Call
  124.       if ((lh->num_nodes > MIN_NODES) &&
  125.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
  126.           contract(lh);
                 ^
  127.   
  128.       return (ret);

crypto/lhash/lhash.c:232:1: <Offset trace>
230.   }
231.   
232. > static void contract(OPENSSL_LHASH *lh)
233.   {
234.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:232:1: Parameter `lh->p`
    230.   }
    231.   
    232. > static void contract(OPENSSL_LHASH *lh)
    233.   {
    234.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:252:9: Assignment
    250.           lh->b = n;
    251.       } else
    252.           lh->p--;
                   ^
    253.   
    254.       lh->num_nodes--;

crypto/lhash/lhash.c:232:1: <Length trace>
230.   }
231.   
232. > static void contract(OPENSSL_LHASH *lh)
233.   {
234.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:232:1: Parameter `*lh->b`
    230.   }
    231.   
    232. > static void contract(OPENSSL_LHASH *lh)
    233.   {
    234.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:257:10: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `OPENSSL_LH_delete` 
    255.       lh->num_contracts++;
    256.   
    257.       n1 = lh->b[(int)lh->p];
                    ^
    258.       if (n1 == NULL)
    259.           lh->b[(int)lh->p] = np;
