crypto/txt_db/txt_db.c:110: error: BUFFER_OVERRUN_S2
  Offset: [max(1, `num`), `num`] Size: [1, +oo].
Showing all 10 steps of the trace


crypto/txt_db/txt_db.c:20:1: <Offset trace>
18.   #define BUFSIZE 512
19.   
20. > TXT_DB *TXT_DB_read(BIO *in, int num)
21.   {
22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:20:1: Parameter `num`
18.   #define BUFSIZE 512
19.   
20. > TXT_DB *TXT_DB_read(BIO *in, int num)
21.   {
22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:20:1: <Length trace>
18.   #define BUFSIZE 512
19.   
20. > TXT_DB *TXT_DB_read(BIO *in, int num)
21.   {
22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:20:1: Parameter `num`
18.   #define BUFSIZE 512
19.   
20. > TXT_DB *TXT_DB_read(BIO *in, int num)
21.   {
22.       TXT_DB *ret = NULL;

crypto/txt_db/txt_db.c:53:5: Assignment
51.       }
52.   
53.       add = (num + 1) * sizeof(char *);
          ^
54.       buf->data[size - 1] = '\0';
55.       offset = 0;

crypto/txt_db/txt_db.c:75:22: Call
73.           else {
74.               buf->data[offset - 1] = '\0'; /* blat the '\n' */
75.               if ((p = OPENSSL_malloc(add + offset)) == NULL)
                           ^
76.                   goto err;
77.               offset = 0;

crypto/mem.c:165:9: Assignment
  163.   
  164.       if (num <= 0)
  165.           return NULL;
                 ^
  166.   
  167.       FAILTEST();

crypto/txt_db/txt_db.c:75:18: Assignment
73.           else {
74.               buf->data[offset - 1] = '\0'; /* blat the '\n' */
75.               if ((p = OPENSSL_malloc(add + offset)) == NULL)
                       ^
76.                   goto err;
77.               offset = 0;

crypto/txt_db/txt_db.c:79:9: Assignment
77.               offset = 0;
78.           }
79.           pp = (char **)p;
              ^
80.           p += add;
81.           n = 0;

crypto/txt_db/txt_db.c:110:9: Array access: Offset: [max(1, num), num] Size: [1, +oo]
108.               goto err;
109.           }
110.           pp[n] = p;
               ^
111.           if (!sk_OPENSSL_PSTRING_push(ret->data, pp))
112.               goto err;
