crypto/srp/srp_vfy.c:365: error: BUFFER_OVERRUN_L3
  Offset: 6 Size: [1, +oo] by call to `TXT_DB_read`.
Showing all 11 steps of the trace


crypto/srp/srp_vfy.c:365:18: Call
363.       error_code = SRP_ERR_VBASE_INCOMPLETE_FILE;
364.   
365.       if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)
                        ^
366.           goto err;
367.   

crypto/txt_db/txt_db.c:20:1: <Offset trace>
18.   #define BUFSIZE 512
19.   
20. > TXT_DB *TXT_DB_read(BIO *in, int num)
21.   {
22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:20:1: Parameter `num`
  18.   #define BUFSIZE 512
  19.   
  20. > TXT_DB *TXT_DB_read(BIO *in, int num)
  21.   {
  22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:20:1: <Length trace>
18.   #define BUFSIZE 512
19.   
20. > TXT_DB *TXT_DB_read(BIO *in, int num)
21.   {
22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:20:1: Parameter `num`
  18.   #define BUFSIZE 512
  19.   
  20. > TXT_DB *TXT_DB_read(BIO *in, int num)
  21.   {
  22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:53:5: Assignment
  51.       }
  52.   
  53.       add = (num + 1) * sizeof(char *);
            ^
  54.       buf->data[size - 1] = '\0';
  55.       offset = 0;

crypto/txt_db/txt_db.c:75:22: Call
  73.           else {
  74.               buf->data[offset - 1] = '\0'; /* blat the '\n' */
  75.               if ((p = OPENSSL_malloc(add + offset)) == NULL)
                             ^
  76.                   goto err;
  77.               offset = 0;

crypto/mem.c:165:9: Assignment
    163.   
    164.       if (num <= 0)
    165.           return NULL;
                   ^
    166.   
    167.       FAILTEST();

crypto/txt_db/txt_db.c:75:18: Assignment
  73.           else {
  74.               buf->data[offset - 1] = '\0'; /* blat the '\n' */
  75.               if ((p = OPENSSL_malloc(add + offset)) == NULL)
                         ^
  76.                   goto err;
  77.               offset = 0;

crypto/txt_db/txt_db.c:79:9: Assignment
  77.               offset = 0;
  78.           }
  79.           pp = (char **)p;
                ^
  80.           p += add;
  81.           n = 0;

crypto/txt_db/txt_db.c:110:9: Array access: Offset: 6 Size: [1, +oo] by call to `TXT_DB_read` 
  108.               goto err;
  109.           }
  110.           pp[n] = p;
                 ^
  111.           if (!sk_OPENSSL_PSTRING_push(ret->data, pp))
  112.               goto err;
