apps/srp.c:503: error: BUFFER_OVERRUN_L3
  Offset: [16, +oo] Size: [1, +oo] by call to `update_index`.
Showing all 29 steps of the trace


apps/srp.c:481:22: Call
479.                   if (!
480.                       (gNid =
481.                        srp_create_user(user, &(row[DB_srpverifier]),
                            ^
482.                                        &(row[DB_srpsalt]),
483.                                        gNrow ? gNrow[DB_srpsalt] : gN,

apps/srp.c:215:14: Call
  213.           if (!
  214.               (gNid =
  215.                SRP_create_verifier(user, password, &salt, srp_verifier, N,
                      ^
  216.                                    g))) {
  217.               BIO_printf(bio_err, "Internal error creating SRP verifier\n");

crypto/srp/srp_vfy.c:565:10: Call
    563.       }
    564.   
    565.       if (!SRP_create_verifier_BN(user, pass, &s, &v, N_bn, g_bn))
                    ^
    566.           goto err;
    567.   

crypto/srp/srp_vfy.c:633:9: Call
      631.       }
      632.   
      633.       x = SRP_Calc_x(salttmp, user, pass);
                     ^
      634.   
      635.       *verifier = BN_new();

crypto/srp/srp_lib.c:221:5: Call
        219.           goto err;
        220.   
        221.       EVP_DigestInit_ex(ctxt, EVP_sha1(), NULL);
                   ^
        222.       EVP_DigestUpdate(ctxt, user, strlen(user));
        223.       EVP_DigestUpdate(ctxt, ":", 1);

crypto/evp/digest.c:199:20: Call
          197.           } else
          198.               /* Ask if an ENGINE is reserved for this job */
          199.               impl = ENGINE_get_digest_engine(type->type);
                                    ^
          200.           if (impl) {
          201.               /* There's an ENGINE for this job ... (apparently) */

crypto/engine/tb_digest.c:117:12: Call
            115.   ENGINE *ENGINE_get_digest_engine(int nid)
            116.   {
            117.       return engine_table_select(&digest_table, nid);
                              ^
            118.   }
            119.   

crypto/engine/eng_table.c:256:10: Call
              254.        * operations. But don't worry about a fprintf(stderr).
              255.        */
              256.       if (!int_table_check(table, 0))
                              ^
              257.           goto end;
              258.       tmplate.nid = nid;

crypto/engine/eng_table.c:117:15: Call
                115.       if (!create)
                116.           return 0;
                117.       if ((lh = lh_ENGINE_PILE_new(engine_pile_hash, engine_pile_cmp)) == NULL)
                                     ^
                118.           return 0;
                119.       *t = (ENGINE_TABLE *)lh;

crypto/engine/eng_int.h:218:1: Call
                  216.   typedef struct st_engine_pile ENGINE_PILE;
                  217.   
                  218. > DEFINE_LHASH_OF(ENGINE_PILE);
                  219.   
                  220.   #ifdef  __cplusplus

crypto/lhash/lhash.c:123:5: Assignment
                    121.       ret->hash = ((h == NULL) ? (LHASH_HASH_FN_TYPE)lh_strhash : h);
                    122.       ret->num_nodes = MIN_NODES / 2;
                    123.       ret->num_alloc_nodes = MIN_NODES;
                               ^
                    124.       ret->pmax = MIN_NODES / 2;
                    125.       ret->up_load = UP_LOAD;

apps/srp.c:503:25: Call
501.                       || (userinfo
502.                           && ((row[DB_srpinfo] = OPENSSL_strdup(userinfo)) == NULL))
503.                       || !update_index(db, row)) {
                               ^
504.                       OPENSSL_free(row[DB_srpid]);
505.                       OPENSSL_free(row[DB_srpgN]);

apps/srp.c:138:1: Parameter `(*db->db->index)->num_alloc_nodes`
  136.   }
  137.   
  138. > static int update_index(CA_DB *db, char **row)
  139.   {
  140.       char **irow;

apps/srp.c:150:10: Call
  148.       irow[DB_NUMBER] = NULL;
  149.   
  150.       if (!TXT_DB_insert(db->db, irow)) {
                  ^
  151.           BIO_printf(bio_err, "failed to update srpvfile\n");
  152.           BIO_printf(bio_err, "TXT_DB error number %ld\n", db->db->error);

crypto/txt_db/txt_db.c:277:1: Parameter `(*db->index)->num_alloc_nodes`
    275.   }
    276.   
    277. > int TXT_DB_insert(TXT_DB *db, OPENSSL_STRING *row)
    278.   {
    279.       int i;

crypto/txt_db/txt_db.c:305:19: Call
    303.               if ((db->qual[i] != NULL) && (db->qual[i] (row) == 0))
    304.                   continue;
    305.               (void)lh_OPENSSL_STRING_insert(db->index[i], row);
                             ^
    306.           }
    307.       }

include/openssl/lhash.h:269:1: Parameter `lh->num_alloc_nodes`
      267.     lh_doall_arg(CHECKED_LHASH_OF(type, lh), fn, CHECKED_PTR_OF(arg_type, arg))
      268.   
      269. > DEFINE_LHASH_OF(OPENSSL_STRING);
      270.   DEFINE_LHASH_OF(OPENSSL_CSTRING);
      271.   

include/openssl/lhash.h:269:1: Call
      267.     lh_doall_arg(CHECKED_LHASH_OF(type, lh), fn, CHECKED_PTR_OF(arg_type, arg))
      268.   
      269. > DEFINE_LHASH_OF(OPENSSL_STRING);
      270.   DEFINE_LHASH_OF(OPENSSL_CSTRING);
      271.   

crypto/lhash/lhash.c:155:1: Parameter `lh->num_alloc_nodes`
        153.   }
        154.   
        155. > void *lh_insert(_LHASH *lh, void *data)
        156.   {
        157.       unsigned long hash;

crypto/lhash/lhash.c:163:9: Call
        161.       lh->error = 0;
        162.       if (lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes))
        163.           expand(lh);
                       ^
        164.   
        165.       rn = getrn(lh, data, &hash);

crypto/lhash/lhash.c:278:1: <Offset trace>
276.   }
277.   
278. > static void expand(_LHASH *lh)
279.   {
280.       LHASH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:278:1: Parameter `lh->num_alloc_nodes`
          276.   }
          277.   
          278. > static void expand(_LHASH *lh)
          279.   {
          280.       LHASH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:304:9: Assignment
          302.   
          303.       if ((lh->p) >= lh->pmax) {
          304.           j = (int)lh->num_alloc_nodes * 2;
                         ^
          305.           n = OPENSSL_realloc(lh->b, (int)(sizeof(LHASH_NODE *) * j));
          306.           if (n == NULL) {

crypto/lhash/lhash.c:278:1: <Length trace>
276.   }
277.   
278. > static void expand(_LHASH *lh)
279.   {
280.       LHASH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:278:1: Parameter `*lh->b`
          276.   }
          277.   
          278. > static void expand(_LHASH *lh)
          279.   {
          280.       LHASH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:305:13: Call
          303.       if ((lh->p) >= lh->pmax) {
          304.           j = (int)lh->num_alloc_nodes * 2;
          305.           n = OPENSSL_realloc(lh->b, (int)(sizeof(LHASH_NODE *) * j));
                             ^
          306.           if (n == NULL) {
          307.               /* fputs("realloc error in lhash",stderr); */

crypto/mem.c:178:9: Assignment
            176.       if (num == 0) {
            177.           CRYPTO_free(str, file, line);
            178.           return NULL;
                           ^
            179.       }
            180.   

crypto/lhash/lhash.c:305:9: Assignment
          303.       if ((lh->p) >= lh->pmax) {
          304.           j = (int)lh->num_alloc_nodes * 2;
          305.           n = OPENSSL_realloc(lh->b, (int)(sizeof(LHASH_NODE *) * j));
                         ^
          306.           if (n == NULL) {
          307.               /* fputs("realloc error in lhash",stderr); */

crypto/lhash/lhash.c:313:13: Array access: Offset: [16, +oo] Size: [1, +oo] by call to `update_index` 
          311.           }
          312.           for (i = (int)lh->num_alloc_nodes; i < j; i++) /* 26/02/92 eay */
          313.               n[i] = NULL;        /* 02/03/92 eay */
                             ^
          314.           lh->pmax = lh->num_alloc_nodes;
          315.           lh->num_alloc_nodes = j;
