apps/s_client.c:1472: error: BUFFER_OVERRUN_L3
  Offset: [1, 65535] Size: [1, +oo] by call to `next_protos_parse`.
Showing all 15 steps of the trace


apps/s_client.c:966:17: Call
964.   
965.       prog = opt_init(argc, argv, s_client_options);
966.       while ((o = opt_next()) != OPT_EOF) {
                       ^
967.           switch (o) {
968.           case OPT_EOF:

apps/opt.c:659:9: Assignment
  657.       /* If we have --flag=foo, snip it off */
  658.       if ((arg = strchr(p, '=')) != NULL)
  659.           *arg++ = '\0';
                 ^
  660.       for (o = opts; o->name; ++o) {
  661.           /* If not this option, move on to the next one. */

apps/s_client.c:1472:13: Call
1470.       if (next_proto_neg_in) {
1471.           next_proto.data =
1472.               next_protos_parse(&next_proto.len, next_proto_neg_in);
                    ^
1473.           if (next_proto.data == NULL) {
1474.               BIO_printf(bio_err, "Error parsing -nextprotoneg argument\n");

apps/apps.c:1974:10: <Offset trace>
1972.   
1973.       out = app_malloc(strlen(in) + 1, "NPN buffer");
1974.       for (i = 0; i <= len; ++i) {
                 ^
1975.           if (i == len || in[i] == ',') {
1976.               if (i - start > 255) {

apps/apps.c:1974:10: Assignment
  1972.   
  1973.       out = app_malloc(strlen(in) + 1, "NPN buffer");
  1974.       for (i = 0; i <= len; ++i) {
                   ^
  1975.           if (i == len || in[i] == ',') {
  1976.               if (i - start > 255) {

apps/apps.c:1963:1: <Length trace>
1961.    *   returns: a malloced buffer or NULL on failure.
1962.    */
1963. > unsigned char *next_protos_parse(size_t *outlen, const char *in)
1964.   {
1965.       size_t len;

apps/apps.c:1963:1: Parameter `in->strlen`
  1961.    *   returns: a malloced buffer or NULL on failure.
  1962.    */
  1963. > unsigned char *next_protos_parse(size_t *outlen, const char *in)
  1964.   {
  1965.       size_t len;

apps/apps.c:1973:11: Call
  1971.           return NULL;
  1972.   
  1973.       out = app_malloc(strlen(in) + 1, "NPN buffer");
                    ^
  1974.       for (i = 0; i <= len; ++i) {
  1975.           if (i == len || in[i] == ',') {

apps/apps.c:1006:1: Parameter `sz`
    1004.   }
    1005.   
    1006. > void* app_malloc(int sz, const char *what)
    1007.   {
    1008.       void *vp = OPENSSL_malloc(sz);

apps/apps.c:1008:16: Call
    1006.   void* app_malloc(int sz, const char *what)
    1007.   {
    1008.       void *vp = OPENSSL_malloc(sz);
                           ^
    1009.   
    1010.       if (vp == NULL) {

crypto/mem.c:127:9: Assignment
      125.   
      126.       if (num <= 0)
      127.           return NULL;
                     ^
      128.   
      129.       allow_customize = 0;

apps/apps.c:1008:5: Assignment
    1006.   void* app_malloc(int sz, const char *what)
    1007.   {
    1008.       void *vp = OPENSSL_malloc(sz);
                ^
    1009.   
    1010.       if (vp == NULL) {

apps/apps.c:1016:5: Assignment
    1014.           exit(1);
    1015.       }
    1016.       return vp;
                ^
    1017.   }
    1018.   

apps/apps.c:1973:5: Assignment
  1971.           return NULL;
  1972.   
  1973.       out = app_malloc(strlen(in) + 1, "NPN buffer");
              ^
  1974.       for (i = 0; i <= len; ++i) {
  1975.           if (i == len || in[i] == ',') {

apps/apps.c:1983:13: Array access: Offset: [1, 65535] Size: [1, +oo] by call to `next_protos_parse` 
  1981.               start = i + 1;
  1982.           } else
  1983.               out[i + 1] = in[i];
                      ^
  1984.       }
  1985.   
