crypto/conf/conf_def.c:254: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, 2147483644] by call to `clear_comments`.
Showing all 11 steps of the trace


crypto/conf/conf_def.c:203:14: Call
201.       again = 0;
202.       for (;;) {
203.           if (!BUF_MEM_grow(buff, bufnum + CONFBUFSIZE)) {
                    ^
204.               CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_BUF_LIB);
205.               goto err;

crypto/buffer/buffer.c:74:1: Parameter `*str->data`
  72.   }
  73.   
  74. > size_t BUF_MEM_grow(BUF_MEM *str, size_t len)
  75.   {
  76.       char *ret;

crypto/conf/conf_def.c:252:9: Assignment
250.               continue;
251.           bufnum = 0;
252.           buf = buff->data;
               ^
253.   
254.           clear_comments(conf, buf);

crypto/conf/conf_def.c:254:9: Call
252.           buf = buff->data;
253.   
254.           clear_comments(conf, buf);
               ^
255.           s = eat_ws(conf, buf);
256.           if (IS_EOF(conf, *s))

crypto/conf/conf_def.c:369:1: Parameter `*p`
  367.   }
  368.   
  369. > static void clear_comments(CONF *conf, char *p)
  370.   {
  371.       for (;;) {

crypto/conf/conf_def.c:392:17: Call
  390.           }
  391.           if (IS_QUOTE(conf, *p)) {
  392.               p = scan_quote(conf, p);
                         ^
  393.               continue;
  394.           }

crypto/conf/conf_def.c:579:1: <Length trace>
577.   }
578.   
579. > static char *scan_quote(CONF *conf, char *p)
580.   {
581.       int q = *p;

crypto/conf/conf_def.c:579:1: Parameter `*p`
    577.   }
    578.   
    579. > static char *scan_quote(CONF *conf, char *p)
    580.   {
    581.       int q = *p;

crypto/conf/conf_def.c:583:5: Assignment
    581.       int q = *p;
    582.   
    583.       p++;
               ^
    584.       while (!(IS_EOF(conf, *p)) && (*p != q)) {
    585.           if (IS_ESC(conf, *p)) {

crypto/conf/conf_def.c:586:13: Assignment
    584.       while (!(IS_EOF(conf, *p)) && (*p != q)) {
    585.           if (IS_ESC(conf, *p)) {
    586.               p++;
                       ^
    587.               if (IS_EOF(conf, *p))
    588.                   return p;

crypto/conf/conf_def.c:587:17: Array access: Offset: [2, +oo] Size: [1, 2147483644] by call to `clear_comments` 
    585.           if (IS_ESC(conf, *p)) {
    586.               p++;
    587.               if (IS_EOF(conf, *p))
                           ^
    588.                   return p;
    589.           }
