crypto/conf/conf_def.c:297: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, 2147483644] by call to `clear_comments`.
Showing all 11 steps of the trace


crypto/conf/conf_def.c:246:14: Call
244.       again = 0;
245.       for (;;) {
246.           if (!BUF_MEM_grow(buff, bufnum + CONFBUFSIZE)) {
                    ^
247.               CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_BUF_LIB);
248.               goto err;

crypto/buffer/buffer.c:122:1: Parameter `*str->data`
  120.   }
  121.   
  122. > size_t BUF_MEM_grow(BUF_MEM *str, size_t len)
  123.   {
  124.       char *ret;

crypto/conf/conf_def.c:295:9: Assignment
293.               continue;
294.           bufnum = 0;
295.           buf = buff->data;
               ^
296.   
297.           clear_comments(conf, buf);

crypto/conf/conf_def.c:297:9: Call
295.           buf = buff->data;
296.   
297.           clear_comments(conf, buf);
               ^
298.           s = eat_ws(conf, buf);
299.           if (IS_EOF(conf, *s))

crypto/conf/conf_def.c:413:1: Parameter `*p`
  411.   }
  412.   
  413. > static void clear_comments(CONF *conf, char *p)
  414.   {
  415.       for (;;) {

crypto/conf/conf_def.c:436:17: Call
  434.           }
  435.           if (IS_QUOTE(conf, *p)) {
  436.               p = scan_quote(conf, p);
                         ^
  437.               continue;
  438.           }

crypto/conf/conf_def.c:617:1: <Length trace>
615.   }
616.   
617. > static char *scan_quote(CONF *conf, char *p)
618.   {
619.       int q = *p;

crypto/conf/conf_def.c:617:1: Parameter `*p`
    615.   }
    616.   
    617. > static char *scan_quote(CONF *conf, char *p)
    618.   {
    619.       int q = *p;

crypto/conf/conf_def.c:621:5: Assignment
    619.       int q = *p;
    620.   
    621.       p++;
               ^
    622.       while (!(IS_EOF(conf, *p)) && (*p != q)) {
    623.           if (IS_ESC(conf, *p)) {

crypto/conf/conf_def.c:624:13: Assignment
    622.       while (!(IS_EOF(conf, *p)) && (*p != q)) {
    623.           if (IS_ESC(conf, *p)) {
    624.               p++;
                       ^
    625.               if (IS_EOF(conf, *p))
    626.                   return (p);

crypto/conf/conf_def.c:625:17: Array access: Offset: [2, +oo] Size: [1, 2147483644] by call to `clear_comments` 
    623.           if (IS_ESC(conf, *p)) {
    624.               p++;
    625.               if (IS_EOF(conf, *p))
                           ^
    626.                   return (p);
    627.           }
