apps/s_client.c:1287: error: BUFFER_OVERRUN_L3
  Offset: [1, 65535] Size: [1, +oo] by call to `next_protos_parse`.
Showing all 15 steps of the trace


apps/s_client.c:890:17: Call
888.   
889.       prog = opt_init(argc, argv, s_client_options);
890.       while ((o = opt_next()) != OPT_EOF) {
                       ^
891.           switch (o) {
892.           case OPT_EOF:

apps/opt.c:589:9: Assignment
  587.       /* If we have --flag=foo, snip it off */
  588.       if ((arg = strchr(p, '=')) != NULL)
  589.           *arg++ = '\0';
                 ^
  590.       for (o = opts; o->name; ++o) {
  591.           /* If not this option, move on to the next one. */

apps/s_client.c:1287:13: Call
1285.       if (next_proto_neg_in) {
1286.           next_proto.data =
1287.               next_protos_parse(&next_proto.len, next_proto_neg_in);
                    ^
1288.           if (next_proto.data == NULL) {
1289.               BIO_printf(bio_err, "Error parsing -nextprotoneg argument\n");

apps/apps.c:2219:10: <Offset trace>
2217.   
2218.       out = app_malloc(strlen(in) + 1, "NPN buffer");
2219.       for (i = 0; i <= len; ++i) {
                 ^
2220.           if (i == len || in[i] == ',') {
2221.               if (i - start > 255) {

apps/apps.c:2219:10: Assignment
  2217.   
  2218.       out = app_malloc(strlen(in) + 1, "NPN buffer");
  2219.       for (i = 0; i <= len; ++i) {
                   ^
  2220.           if (i == len || in[i] == ',') {
  2221.               if (i - start > 255) {

apps/apps.c:2208:1: <Length trace>
2206.    *   returns: a malloced buffer or NULL on failure.
2207.    */
2208. > unsigned char *next_protos_parse(unsigned short *outlen, const char *in)
2209.   {
2210.       size_t len;

apps/apps.c:2208:1: Parameter `in->strlen`
  2206.    *   returns: a malloced buffer or NULL on failure.
  2207.    */
  2208. > unsigned char *next_protos_parse(unsigned short *outlen, const char *in)
  2209.   {
  2210.       size_t len;

apps/apps.c:2218:11: Call
  2216.           return NULL;
  2217.   
  2218.       out = app_malloc(strlen(in) + 1, "NPN buffer");
                    ^
  2219.       for (i = 0; i <= len; ++i) {
  2220.           if (i == len || in[i] == ',') {

apps/apps.c:976:1: Parameter `sz`
    974.   }
    975.   
    976. > void* app_malloc(int sz, const char *what)
    977.   {
    978.       void *vp = OPENSSL_malloc(sz);

apps/apps.c:978:16: Call
    976.   void* app_malloc(int sz, const char *what)
    977.   {
    978.       void *vp = OPENSSL_malloc(sz);
                          ^
    979.   
    980.       if (vp == NULL) {

crypto/mem.c:125:9: Assignment
      123.   
      124.       if (num <= 0)
      125.           return NULL;
                     ^
      126.   
      127.       allow_customize = 0;

apps/apps.c:978:5: Assignment
    976.   void* app_malloc(int sz, const char *what)
    977.   {
    978.       void *vp = OPENSSL_malloc(sz);
               ^
    979.   
    980.       if (vp == NULL) {

apps/apps.c:986:5: Assignment
    984.           exit(1);
    985.       }
    986.       return vp;
               ^
    987.   }
    988.   

apps/apps.c:2218:5: Assignment
  2216.           return NULL;
  2217.   
  2218.       out = app_malloc(strlen(in) + 1, "NPN buffer");
              ^
  2219.       for (i = 0; i <= len; ++i) {
  2220.           if (i == len || in[i] == ',') {

apps/apps.c:2228:13: Array access: Offset: [1, 65535] Size: [1, +oo] by call to `next_protos_parse` 
  2226.               start = i + 1;
  2227.           } else
  2228.               out[i + 1] = in[i];
                      ^
  2229.       }
  2230.   
