apps/s_client.c:347: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [0, +oo] by call to `SSL_new`.
Showing all 23 steps of the trace


apps/s_client.c:313:6: Call
311.   
312.   	SSLeay_add_ssl_algorithms();
313.   	ctx=SSL_CTX_new(meth);
            ^
314.   	if (ctx == NULL)
315.   		{

ssl/ssl_lib.c:988:16: Call
  986.   	ret->client_cert_cb=NULL;
  987.   
  988.   	ret->sessions=lh_new(SSL_SESSION_hash,SSL_SESSION_cmp);
                        ^
  989.   	if (ret->sessions == NULL) goto err;
  990.   	ret->cert_store=X509_STORE_new();

crypto/lhash/lhash.c:124:29: Array declaration
    122.   	if ((ret=(LHASH *)Malloc(sizeof(LHASH))) == NULL)
    123.   		goto err0;
    124.   	if ((ret->b=(LHASH_NODE **)Malloc(sizeof(LHASH_NODE *)*MIN_NODES)) == NULL)
                                       ^
    125.   		goto err1;
    126.   	for (i=0; i<MIN_NODES; i++)

crypto/lhash/lhash.c:124:7: Assignment
    122.   	if ((ret=(LHASH *)Malloc(sizeof(LHASH))) == NULL)
    123.   		goto err0;
    124.   	if ((ret->b=(LHASH_NODE **)Malloc(sizeof(LHASH_NODE *)*MIN_NODES)) == NULL)
                 ^
    125.   		goto err1;
    126.   	for (i=0; i<MIN_NODES; i++)

apps/s_client.c:347:13: Call
345.   	SSL_load_error_strings();
346.   
347.   	con=(SSL *)SSL_new(ctx);
                   ^
348.   /*	SSL_set_cipher_list(con,"RC4-MD5"); */
349.   

ssl/ssl_lib.c:162:1: Parameter `*ctx->sessions->b`
  160.   	}
  161.   
  162. > SSL *SSL_new(SSL_CTX *ctx)
  163.   	{
  164.   	SSL *s;

ssl/ssl_lib.c:212:2: Call
  210.   	s->server=(ctx->method->ssl_accept == ssl_undefined_function)?0:1;
  211.   	s->options=ctx->options;
  212.   	SSL_clear(s);
          ^
  213.   
  214.   	CRYPTO_new_ex_data(ssl_meth,(char *)s,&s->ex_data);

ssl/ssl_lib.c:82:1: Parameter `*s->ctx->sessions->b`
    80.   	};
    81.   
    82. > int SSL_clear(SSL *s)
    83.   	{
    84.   	int state;

ssl/ssl_lib.c:121:6: Call
    119.   	ssl_clear_cipher_ctx(s);
    120.   
    121.   	if (ssl_clear_bad_session(s))
                ^
    122.   		{
    123.   		SSL_SESSION_free(s->session);

ssl/ssl_sess.c:520:1: Parameter `*s->ctx->sessions->b`
      518.   	}
      519.   
      520. > int ssl_clear_bad_session(SSL *s)
      521.   	{
      522.   	if (	(s->session != NULL) &&

ssl/ssl_sess.c:526:3: Call
      524.   		!(SSL_in_init(s) || SSL_in_before(s)))
      525.   		{
      526.   		SSL_CTX_remove_session(s->ctx,s->session);
               ^
      527.   		return(1);
      528.   		}

ssl/ssl_sess.c:320:1: Parameter `*ctx->sessions->b`
        318.   	}
        319.   
        320. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
        321.   {
        322.   	return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:322:9: Call
        320.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
        321.   {
        322.   	return remove_session_lock(ctx, c, 1);
                       ^
        323.   }
        324.   

ssl/ssl_sess.c:325:1: Parameter `*ctx->sessions->b`
          323.   }
          324.   
          325. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
          326.   	{
          327.   	SSL_SESSION *r;

ssl/ssl_sess.c:333:20: Call
          331.   		{
          332.   		if(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
          333.   		r=(SSL_SESSION *)lh_delete(ctx->sessions,(char *)c);
                                    ^
          334.   		if (r != NULL)
          335.   			{

crypto/lhash/lhash.c:220:1: Parameter `*lh->b`
            218.   	}
            219.   
            220. > char *lh_delete(LHASH *lh, char *data)
            221.   	{
            222.   	unsigned long hash;

crypto/lhash/lhash.c:246:3: Call
            244.   	if ((lh->num_nodes > MIN_NODES) &&
            245.   		(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))
            246.   		contract(lh);
                     ^
            247.   
            248.   	return(ret);

crypto/lhash/lhash.c:355:1: <Offset trace>
353.   	}
354.   
355. > static void contract(LHASH *lh)
356.   	{
357.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:355:1: Parameter `lh->p`
              353.   	}
              354.   
              355. > static void contract(LHASH *lh)
              356.   	{
              357.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:378:3: Assignment
              376.   		}
              377.   	else
              378.   		lh->p--;
                       ^
              379.   
              380.   	lh->num_nodes--;

crypto/lhash/lhash.c:355:1: <Length trace>
353.   	}
354.   
355. > static void contract(LHASH *lh)
356.   	{
357.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:355:1: Parameter `*lh->b`
              353.   	}
              354.   
              355. > static void contract(LHASH *lh)
              356.   	{
              357.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:383:5: Array access: Offset: [-1, +oo] Size: [0, +oo] by call to `SSL_new` 
              381.   	lh->num_contracts++;
              382.   
              383.   	n1=lh->b[(int)lh->p];
                         ^
              384.   	if (n1 == NULL)
              385.   		lh->b[(int)lh->p]=np;
