crypto/srp/srp_vfy.c:387: error: BUFFER_OVERRUN_L2
  Offset: [-oo, 2147483646] Size: 2500 by call to `SRP_gN_place_bn`.
Showing all 14 steps of the trace


crypto/srp/srp_vfy.c:368:18: Call
366.       error_code = SRP_ERR_VBASE_INCOMPLETE_FILE;
367.   
368.       if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)
                        ^
369.           goto err;
370.   

crypto/txt_db/txt_db.c:55:5: Assignment
  53.       add = (num + 1) * sizeof(char *);
  54.       buf->data[size - 1] = '\0';
  55.       offset = 0;
            ^
  56.       for (;;) {
  57.           if (offset != 0) {

crypto/srp/srp_vfy.c:387:29: Call
385.   
386.               if ((gN->id = OPENSSL_strdup(pp[DB_srpid])) == NULL
387.                   || (gN->N = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpverifier]))
                                   ^
388.                           == NULL
389.                   || (gN->g = SRP_gN_place_bn(vb->gN_cache, pp[DB_srpsalt]))

crypto/srp/srp_vfy.c:318:1: Parameter `ch->strlen`
  316.   }
  317.   
  318. > static BIGNUM *SRP_gN_place_bn(STACK_OF(SRP_gN_cache) *gN_cache, char *ch)
  319.   {
  320.       int i;

crypto/srp/srp_vfy.c:331:31: Call
  329.       }
  330.       {                           /* it is the first time that we find it */
  331.           SRP_gN_cache *newgN = SRP_gN_new_init(ch);
                                       ^
  332.           if (newgN) {
  333.               if (sk_SRP_gN_cache_insert(gN_cache, newgN, 0) > 0)

crypto/srp/srp_vfy.c:269:1: Array declaration
    267.   }
    268.   
    269. > static SRP_gN_cache *SRP_gN_new_init(const char *ch)
    270.   {
    271.       unsigned char tmp[MAX_LEN];

crypto/srp/srp_vfy.c:278:11: Call
    276.           return NULL;
    277.   
    278.       len = t_fromb64(tmp, sizeof(tmp), ch);
                     ^
    279.       if (len < 0)
    280.           goto err;

crypto/srp/srp_vfy.c:33:1: <Offset trace>
31.    * Convert a base64 string into raw byte array representation.
32.    */
33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
34.   {
35.       char *loc;

crypto/srp/srp_vfy.c:33:1: Parameter `alen`
      31.    * Convert a base64 string into raw byte array representation.
      32.    */
      33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
      34.   {
      35.       char *loc;

crypto/srp/srp_vfy.c:60:5: Assignment
      58.       if (i == 0)
      59.           return 0;
      60.       size = i;
                ^
      61.       i = size - 1;
      62.       j = size;

crypto/srp/srp_vfy.c:62:5: Assignment
      60.       size = i;
      61.       i = size - 1;
      62.       j = size;
                ^
      63.       while (1) {
      64.           a[j] = a[i];

crypto/srp/srp_vfy.c:33:1: <Length trace>
31.    * Convert a base64 string into raw byte array representation.
32.    */
33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
34.   {
35.       char *loc;

crypto/srp/srp_vfy.c:33:1: Parameter `*a`
      31.    * Convert a base64 string into raw byte array representation.
      32.    */
      33. > static int t_fromb64(unsigned char *a, size_t alen, const char *src)
      34.   {
      35.       char *loc;

crypto/srp/srp_vfy.c:64:9: Array access: Offset: [-oo, 2147483646] Size: 2500 by call to `SRP_gN_place_bn` 
      62.       j = size;
      63.       while (1) {
      64.           a[j] = a[i];
                    ^
      65.           if (--i < 0)
      66.               break;
