crypto/txt_db/txt_db.c:171: error: BUFFER_OVERRUN_L3
  Offset: [16, +oo] Size: [1, +oo] by call to `lh_OPENSSL_STRING_insert`.
Showing all 16 steps of the trace


crypto/txt_db/txt_db.c:162:44: Call
160.       }
161.       /* FIXME: we lose type checking at this point */
162.       if ((idx = (LHASH_OF(OPENSSL_STRING) *)OPENSSL_LH_new(hash, cmp)) == NULL) {
                                                  ^
163.           db->error = DB_ERROR_MALLOC;
164.           return 0;

crypto/lhash/lhash.c:38:5: Assignment
  36.       ret->hash = ((h == NULL) ? (OPENSSL_LH_HASHFUNC)OPENSSL_LH_strhash : h);
  37.       ret->num_nodes = MIN_NODES / 2;
  38.       ret->num_alloc_nodes = MIN_NODES;
            ^
  39.       ret->pmax = MIN_NODES / 2;
  40.       ret->up_load = UP_LOAD;

crypto/txt_db/txt_db.c:171:18: Call
169.           if ((qual != NULL) && (qual(r) == 0))
170.               continue;
171.           if ((k = lh_OPENSSL_STRING_insert(idx, r)) != NULL) {
                        ^
172.               db->error = DB_ERROR_INDEX_CLASH;
173.               db->arg1 = sk_OPENSSL_PSTRING_find(db->data, k);

include/openssl/lhash.h:197:1: Parameter `lh->num_alloc_nodes`
  195.       LHASH_OF(type)
  196.   
  197. > DEFINE_LHASH_OF(OPENSSL_STRING);
  198.   # ifdef _MSC_VER
  199.   /*

include/openssl/lhash.h:197:1: Call
  195.       LHASH_OF(type)
  196.   
  197. > DEFINE_LHASH_OF(OPENSSL_STRING);
  198.   # ifdef _MSC_VER
  199.   /*

crypto/lhash/lhash.c:70:1: Parameter `lh->num_alloc_nodes`
    68.   }
    69.   
    70. > void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data)
    71.   {
    72.       unsigned long hash;

crypto/lhash/lhash.c:77:77: Call
    75.   
    76.       lh->error = 0;
    77.       if ((lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)) && !expand(lh))
                                                                                      ^
    78.           return NULL;        /* 'lh->error++' already done in 'expand' */
    79.   

crypto/lhash/lhash.c:186:1: <Offset trace>
184.   }
185.   
186. > static int expand(OPENSSL_LHASH *lh)
187.   {
188.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:186:1: Parameter `lh->num_alloc_nodes`
      184.   }
      185.   
      186. > static int expand(OPENSSL_LHASH *lh)
      187.   {
      188.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:212:9: Assignment
      210.   
      211.       if ((lh->p) >= lh->pmax) {
      212.           j = (int)lh->num_alloc_nodes * 2;
                     ^
      213.           n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));
      214.           if (n == NULL) {

crypto/lhash/lhash.c:186:1: <Length trace>
184.   }
185.   
186. > static int expand(OPENSSL_LHASH *lh)
187.   {
188.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:186:1: Parameter `*lh->b`
      184.   }
      185.   
      186. > static int expand(OPENSSL_LHASH *lh)
      187.   {
      188.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:213:13: Call
      211.       if ((lh->p) >= lh->pmax) {
      212.           j = (int)lh->num_alloc_nodes * 2;
      213.           n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));
                         ^
      214.           if (n == NULL) {
      215.               lh->error++;

crypto/mem.c:240:9: Assignment
        238.       if (num == 0) {
        239.           CRYPTO_free(str, file, line);
        240.           return NULL;
                       ^
        241.       }
        242.   

crypto/lhash/lhash.c:213:9: Assignment
      211.       if ((lh->p) >= lh->pmax) {
      212.           j = (int)lh->num_alloc_nodes * 2;
      213.           n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));
                     ^
      214.           if (n == NULL) {
      215.               lh->error++;

crypto/lhash/lhash.c:221:13: Array access: Offset: [16, +oo] Size: [1, +oo] by call to `lh_OPENSSL_STRING_insert` 
      219.           }
      220.           for (i = (int)lh->num_alloc_nodes; i < j; i++) /* 26/02/92 eay */
      221.               n[i] = NULL;        /* 02/03/92 eay */
                         ^
      222.           lh->pmax = lh->num_alloc_nodes;
      223.           lh->num_alloc_nodes = j;
