apps/x509.c:616: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [0, +oo] by call to `x509_certify`.
Showing all 17 steps of the trace


apps/x509.c:175:6: Call
173.   	CAkeyformat=FORMAT_PEM;
174.   
175.   	ctx=X509_STORE_new();
            ^
176.   	if (ctx == NULL) goto end;
177.   	X509_STORE_set_verify_cb_func(ctx,callb);

crypto/x509/x509_lu.c:202:13: Call
  200.   	if ((ret=(X509_STORE *)Malloc(sizeof(X509_STORE))) == NULL)
  201.   		return(NULL);
  202.   	ret->certs=lh_new(x509_object_hash,x509_object_cmp);
                     ^
  203.   	ret->cache=1;
  204.   	ret->get_cert_methods=sk_new_null();

crypto/lhash/lhash.c:135:29: Array declaration
    133.   	if ((ret=(LHASH *)Malloc(sizeof(LHASH))) == NULL)
    134.   		goto err0;
    135.   	if ((ret->b=(LHASH_NODE **)Malloc(sizeof(LHASH_NODE *)*MIN_NODES)) == NULL)
                                       ^
    136.   		goto err1;
    137.   	for (i=0; i<MIN_NODES; i++)

crypto/lhash/lhash.c:135:7: Assignment
    133.   	if ((ret=(LHASH *)Malloc(sizeof(LHASH))) == NULL)
    134.   		goto err0;
    135.   	if ((ret->b=(LHASH_NODE **)Malloc(sizeof(LHASH_NODE *)*MIN_NODES)) == NULL)
                 ^
    136.   		goto err1;
    137.   	for (i=0; i<MIN_NODES; i++)

apps/x509.c:616:10: Call
614.   #endif
615.   				
616.   				if (!x509_certify(ctx,CAfile,digest,x,xca,
                ^
617.   					CApkey,
618.   					CAserial,CA_createserial,days))

apps/x509.c:705:1: Parameter `*ctx->certs->b`
  703.   	}
  704.   
  705. > static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
  706.   	     X509 *x, X509 *xca, EVP_PKEY *pkey, char *serialfile, int create,
  707.   	     int days)

apps/x509.c:804:7: Call
  802.   	io=NULL;
  803.   	
  804.   	if (!X509_STORE_add_cert(ctx,x)) goto end;
               ^
  805.   
  806.   	/* NOTE: this certificate can/should be self signed, unless it was

crypto/x509/x509_vfy.c:530:19: Call
    528.   	X509_OBJECT_up_ref_count(obj);
    529.   
    530.   	r=(X509_OBJECT *)lh_insert(ctx->certs,(char *)obj);
                             ^
    531.   	if (r != NULL)
    532.   		{ /* oops, put it back */

crypto/lhash/lhash.c:193:1: Parameter `lh->pmax`
      191.   	}
      192.   
      193. > char *lh_insert(LHASH *lh, char *data)
      194.   	{
      195.   	unsigned long hash;

crypto/x509/x509_vfy.c:533:3: Call
    531.   	if (r != NULL)
    532.   		{ /* oops, put it back */
    533.   		lh_delete(ctx->certs,(char *)obj);
             ^
    534.   		X509_OBJECT_free_contents(obj);
    535.   		Free(obj);

crypto/lhash/lhash.c:231:1: Parameter `*lh->b`
      229.   	}
      230.   
      231. > char *lh_delete(LHASH *lh, char *data)
      232.   	{
      233.   	unsigned long hash;

crypto/lhash/lhash.c:257:3: Call
      255.   	if ((lh->num_nodes > MIN_NODES) &&
      256.   		(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))
      257.   		contract(lh);
               ^
      258.   
      259.   	return(ret);

crypto/lhash/lhash.c:366:1: <Offset trace>
364.   	}
365.   
366. > static void contract(LHASH *lh)
367.   	{
368.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:366:1: Parameter `lh->p`
        364.   	}
        365.   
        366. > static void contract(LHASH *lh)
        367.   	{
        368.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:366:1: <Length trace>
364.   	}
365.   
366. > static void contract(LHASH *lh)
367.   	{
368.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:366:1: Parameter `*lh->b`
        364.   	}
        365.   
        366. > static void contract(LHASH *lh)
        367.   	{
        368.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:370:5: Array access: Offset: [-1, +oo] Size: [0, +oo] by call to `x509_certify` 
        368.   	LHASH_NODE **n,*n1,*np;
        369.   
        370.   	np=lh->b[lh->p+lh->pmax-1];
                   ^
        371.   	lh->b[lh->p+lh->pmax-1]=NULL; /* 24/07-92 - eay - weird but :-( */
        372.   	if (lh->p == 0)
