apps/s_server.c:1633: error: BUFFER_OVERRUN_L3
  Offset: [1, 65535] Size: [1, +oo] by call to `next_protos_parse`.
Showing all 17 steps of the trace


apps/s_server.c:1600:18: Call
1598.           }
1599.   
1600.           s_cert = load_cert(s_cert_file, s_cert_format,
                         ^
1601.                              "server certificate file");
1602.   

apps/apps.c:709:9: Call
  707.       if (format == FORMAT_HTTP) {
  708.   #if !defined(OPENSSL_NO_OCSP) && !defined(OPENSSL_NO_SOCK)
  709.           load_cert_crl_http(file, &x, NULL);
                 ^
  710.   #endif
  711.           return x;

apps/apps.c:660:10: Call
    658.       OCSP_REQ_CTX *rctx = NULL;
    659.       int use_ssl, rv = 0;
    660.       if (!OCSP_parse_url(url, &host, &port, &path, &use_ssl))
                    ^
    661.           goto err;
    662.       if (use_ssl) {

crypto/ocsp/ocsp_lib.c:195:5: Assignment
      193.           goto parse_err;
      194.   
      195.       *(p++) = '\0';
                 ^
      196.   
      197.       if (strcmp(buf, "http") == 0) {

apps/s_server.c:1633:27: Call
1631.       if (next_proto_neg_in) {
1632.           size_t len;
1633.           next_proto.data = next_protos_parse(&len, next_proto_neg_in);
                                  ^
1634.           if (next_proto.data == NULL)
1635.               goto end;

apps/apps.c:1984:10: <Offset trace>
1982.   
1983.       out = app_malloc(strlen(in) + 1, "NPN buffer");
1984.       for (i = 0; i <= len; ++i) {
                 ^
1985.           if (i == len || in[i] == ',') {
1986.               if (i - start > 255) {

apps/apps.c:1984:10: Assignment
  1982.   
  1983.       out = app_malloc(strlen(in) + 1, "NPN buffer");
  1984.       for (i = 0; i <= len; ++i) {
                   ^
  1985.           if (i == len || in[i] == ',') {
  1986.               if (i - start > 255) {

apps/apps.c:1973:1: <Length trace>
1971.    *   returns: a malloc'd buffer or NULL on failure.
1972.    */
1973. > unsigned char *next_protos_parse(size_t *outlen, const char *in)
1974.   {
1975.       size_t len;

apps/apps.c:1973:1: Parameter `in->strlen`
  1971.    *   returns: a malloc'd buffer or NULL on failure.
  1972.    */
  1973. > unsigned char *next_protos_parse(size_t *outlen, const char *in)
  1974.   {
  1975.       size_t len;

apps/apps.c:1983:11: Call
  1981.           return NULL;
  1982.   
  1983.       out = app_malloc(strlen(in) + 1, "NPN buffer");
                    ^
  1984.       for (i = 0; i <= len; ++i) {
  1985.           if (i == len || in[i] == ',') {

apps/apps.c:1016:1: Parameter `sz`
    1014.   }
    1015.   
    1016. > void* app_malloc(int sz, const char *what)
    1017.   {
    1018.       void *vp = OPENSSL_malloc(sz);

apps/apps.c:1018:16: Call
    1016.   void* app_malloc(int sz, const char *what)
    1017.   {
    1018.       void *vp = OPENSSL_malloc(sz);
                           ^
    1019.   
    1020.       if (vp == NULL) {

crypto/mem.c:127:9: Assignment
      125.   
      126.       if (num <= 0)
      127.           return NULL;
                     ^
      128.   
      129.       allow_customize = 0;

apps/apps.c:1018:5: Assignment
    1016.   void* app_malloc(int sz, const char *what)
    1017.   {
    1018.       void *vp = OPENSSL_malloc(sz);
                ^
    1019.   
    1020.       if (vp == NULL) {

apps/apps.c:1026:5: Assignment
    1024.           exit(1);
    1025.       }
    1026.       return vp;
                ^
    1027.   }
    1028.   

apps/apps.c:1983:5: Assignment
  1981.           return NULL;
  1982.   
  1983.       out = app_malloc(strlen(in) + 1, "NPN buffer");
              ^
  1984.       for (i = 0; i <= len; ++i) {
  1985.           if (i == len || in[i] == ',') {

apps/apps.c:1993:13: Array access: Offset: [1, 65535] Size: [1, +oo] by call to `next_protos_parse` 
  1991.               start = i + 1;
  1992.           } else
  1993.               out[i + 1] = in[i];
                      ^
  1994.       }
  1995.   
