test/packettest.c:296: error: BUFFER_OVERRUN_L2
  Offset added: [0, 2147483646] Size: 640 by call to `PACKET_strndup`.
Showing all 14 steps of the trace


test/packettest.c:285:1: Array declaration
283.   }
284.   
285. > static int test_PACKET_strndup()
286.   {
287.       char buf[10], buf2[10];

test/packettest.c:295:17: Call
293.       buf2[5] = '\0';
294.   
295.       if (       !PACKET_buf_init(&pkt, (unsigned char*)buf, 10)
                       ^
296.               || !PACKET_strndup(&pkt, &data)
297.               ||  strlen(data) != 10

ssl/packet_locl.h:110:8: Parameter `*pkt->curr`
  108.    * is being used.
  109.    */
  110.   __owur static inline int PACKET_buf_init(PACKET *pkt, unsigned char *buf,
                ^
  111.                                            size_t len)
  112.   {

test/packettest.c:296:17: Call
294.   
295.       if (       !PACKET_buf_init(&pkt, (unsigned char*)buf, 10)
296.               || !PACKET_strndup(&pkt, &data)
                       ^
297.               ||  strlen(data) != 10
298.               ||  strncmp(data, buf, 10)

ssl/packet_locl.h:430:8: Parameter `*pkt->curr`
  428.    * with a given PACKET).
  429.    */
  430.   __owur static inline int PACKET_strndup(const PACKET *pkt, char **data)
                ^
  431.   {
  432.       OPENSSL_free(*data);

ssl/packet_locl.h:435:13: Call
  433.   
  434.       /* This will succeed on an empty packet, unless pkt->curr == NULL. */
  435.       *data = BUF_strndup((const char*)pkt->curr, PACKET_remaining(pkt));
                     ^
  436.       return (*data != NULL);
  437.   }

crypto/buffer/buf_str.c:87:11: <Offset trace>
85.           return NULL;
86.   
87.       siz = BUF_strnlen(str, siz);
                ^
88.   
89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:87:11: Call
    85.           return NULL;
    86.   
    87.       siz = BUF_strnlen(str, siz);
                    ^
    88.   
    89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:64:1: Parameter `*str`
      62.   #include <openssl/buffer.h>
      63.   
      64. > size_t BUF_strnlen(const char *str, size_t maxlen)
      65.   {
      66.       const char *p;

crypto/buffer/buf_str.c:70:5: Assignment
      68.       for (p = str; maxlen-- != 0 && *p != '\0'; ++p) ;
      69.   
      70.       return p - str;
                ^
      71.   }
      72.   

crypto/buffer/buf_str.c:87:5: Assignment
    85.           return NULL;
    86.   
    87.       siz = BUF_strnlen(str, siz);
              ^
    88.   
    89.       if (siz >= INT_MAX)

crypto/buffer/buf_str.c:80:1: <Length trace>
78.   }
79.   
80. > char *BUF_strndup(const char *str, size_t siz)
81.   {
82.       char *ret;

crypto/buffer/buf_str.c:80:1: Parameter `*str`
    78.   }
    79.   
    80. > char *BUF_strndup(const char *str, size_t siz)
    81.   {
    82.       char *ret;

crypto/buffer/buf_str.c:98:5: Array access: Offset added: [0, 2147483646] Size: 640 by call to `PACKET_strndup` 
    96.       }
    97.   
    98.       memcpy(ret, str, siz);
               ^
    99.       ret[siz] = '\0';
    100.   
