crypto/conf/conf.c:312: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `sk_delete_ptr`.
Showing all 16 steps of the trace


crypto/conf/conf.c:141:5: Call
139.   		ret=h;
140.   
141.   	sv=new_section(ret,section);
           ^
142.   	if (sv == NULL)
143.   		{

crypto/conf/conf.c:671:10: Call
  669.   	CONF_VALUE *v=NULL,*vv;
  670.   
  671.   	if ((sk=sk_new_null()) == NULL)
                  ^
  672.   		goto err;
  673.   	if ((v=(CONF_VALUE *)Malloc(sizeof(CONF_VALUE))) == NULL)

crypto/stack/stack.c:125:2: Assignment
    123.   	ret->comp=c;
    124.   	ret->num_alloc=MIN_NODES;
    125.   	ret->num=0;
            ^
    126.   	ret->sorted=0;
    127.   	return(ret);

crypto/conf/conf.c:304:9: Call
302.   				}
303.   			v->section=tv->section;	
304.   			if (!sk_push(ts,(char *)v))
               ^
305.   				{
306.   				CONFerr(CONF_F_CONF_LOAD,ERR_R_MALLOC_FAILURE);

crypto/stack/stack.c:233:1: Parameter `st->num`
  231.   	}
  232.   
  233. > int sk_push(STACK *st, char *data)
  234.   	{
  235.   	return(sk_insert(st,data,st->num));

crypto/stack/stack.c:235:9: Call
  233.   int sk_push(STACK *st, char *data)
  234.   	{
  235.   	return(sk_insert(st,data,st->num));
                 ^
  236.   	}
  237.   

crypto/stack/stack.c:134:1: Parameter `st->num`
    132.   	}
    133.   
    134. > int sk_insert(STACK *st, char *data, int loc)
    135.   	{
    136.   	char **s;

crypto/conf/conf.c:312:5: Call
310.   			if (vv != NULL)
311.   				{
312.   				sk_delete_ptr(ts,(char *)vv);
           ^
313.   				Free(vv->name);
314.   				Free(vv->value);

crypto/stack/stack.c:172:1: Parameter `*st->data`
  170.   	}
  171.   
  172. > char *sk_delete_ptr(STACK *st, char *p)
  173.   	{
  174.   	int i;

crypto/stack/stack.c:178:11: Call
  176.   	for (i=0; i<st->num; i++)
  177.   		if (st->data[i] == p)
  178.   			return(sk_delete(st,i));
                   ^
  179.   	return(NULL);
  180.   	}

crypto/stack/stack.c:182:1: <Offset trace>
180.   	}
181.   
182. > char *sk_delete(STACK *st, int loc)
183.   	{
184.   	char *ret;

crypto/stack/stack.c:182:1: Parameter `loc`
    180.   	}
    181.   
    182. > char *sk_delete(STACK *st, int loc)
    183.   	{
    184.   	char *ret;

crypto/stack/stack.c:193:3: Assignment
    191.   	if (loc != st->num-1)
    192.   		{
    193.   		j=st->num-1;
             ^
    194.   		for (i=loc; i<j; i++)
    195.   			st->data[i]=st->data[i+1];

crypto/stack/stack.c:182:1: <Length trace>
180.   	}
181.   
182. > char *sk_delete(STACK *st, int loc)
183.   	{
184.   	char *ret;

crypto/stack/stack.c:182:1: Parameter `*st->data`
    180.   	}
    181.   
    182. > char *sk_delete(STACK *st, int loc)
    183.   	{
    184.   	char *ret;

crypto/stack/stack.c:195:16: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `sk_delete_ptr` 
    193.   		j=st->num-1;
    194.   		for (i=loc; i<j; i++)
    195.   			st->data[i]=st->data[i+1];
                          ^
    196.   		/* In theory memcpy is not safe for this
    197.   		 * memcpy( &(st->data[loc]),
