apps/apps.c:1575: error: BUFFER_OVERRUN_L3
  Offset: 6 Size: [1, +oo] by call to `TXT_DB_read`.
Showing all 11 steps of the trace


apps/apps.c:1575:18: Call
1573.           goto err;
1574.       }
1575.       if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)
                         ^
1576.           goto err;
1577.   

crypto/txt_db/txt_db.c:69:1: <Offset trace>
67.   #define BUFSIZE 512
68.   
69. > TXT_DB *TXT_DB_read(BIO *in, int num)
70.   {
71.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:69:1: Parameter `num`
  67.   #define BUFSIZE 512
  68.   
  69. > TXT_DB *TXT_DB_read(BIO *in, int num)
  70.   {
  71.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:69:1: <Length trace>
67.   #define BUFSIZE 512
68.   
69. > TXT_DB *TXT_DB_read(BIO *in, int num)
70.   {
71.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:69:1: Parameter `num`
  67.   #define BUFSIZE 512
  68.   
  69. > TXT_DB *TXT_DB_read(BIO *in, int num)
  70.   {
  71.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:102:5: Assignment
  100.       }
  101.   
  102.       add = (num + 1) * sizeof(char *);
             ^
  103.       buf->data[size - 1] = '\0';
  104.       offset = 0;

crypto/txt_db/txt_db.c:124:22: Call
  122.           else {
  123.               buf->data[offset - 1] = '\0'; /* blat the '\n' */
  124.               if ((p = OPENSSL_malloc(add + offset)) == NULL)
                              ^
  125.                   goto err;
  126.               offset = 0;

crypto/mem.c:125:9: Assignment
    123.   
    124.       if (num <= 0)
    125.           return NULL;
                   ^
    126.   
    127.       allow_customize = 0;

crypto/txt_db/txt_db.c:124:18: Assignment
  122.           else {
  123.               buf->data[offset - 1] = '\0'; /* blat the '\n' */
  124.               if ((p = OPENSSL_malloc(add + offset)) == NULL)
                          ^
  125.                   goto err;
  126.               offset = 0;

crypto/txt_db/txt_db.c:128:9: Assignment
  126.               offset = 0;
  127.           }
  128.           pp = (char **)p;
                 ^
  129.           p += add;
  130.           n = 0;

crypto/txt_db/txt_db.c:159:9: Array access: Offset: 6 Size: [1, +oo] by call to `TXT_DB_read` 
  157.               goto err;
  158.           }
  159.           pp[n] = p;
                 ^
  160.           if (!sk_OPENSSL_PSTRING_push(ret->data, pp))
  161.               goto err;
