apps/s_server.c:1521: error: BUFFER_OVERRUN_L3
  Offset: [1, 65535] Size: [1, +oo] by call to `next_protos_parse`.
Showing all 18 steps of the trace


apps/s_server.c:1495:23: Call
1493.           }
1494.           if (s_chain_file) {
1495.               s_chain = load_certs(s_chain_file, FORMAT_PEM,
                              ^
1496.                                    NULL, e, "server certificate chain");
1497.               if (!s_chain)

apps/apps.c:995:10: Call
  993.   {
  994.       STACK_OF(X509) *certs;
  995.       if (!load_certs_crls(file, format, pass, e, desc, &certs, NULL))
                  ^
  996.           return NULL;
  997.       return certs;

apps/apps.c:918:11: Call
    916.           return 0;
    917.   
    918.       xis = PEM_X509_INFO_read_bio(bio, NULL,
                     ^
    919.                                    (pem_password_cb *)password_callback,
    920.                                    &cb_data);

crypto/pem/pem_info.c:118:13: Call
      116.           raw = 0;
      117.           ptype = 0;
      118.           i = PEM_read_bio(bp, &name, &header, &data, &len);
                         ^
      119.           if (i == 0) {
      120.               error = ERR_GET_REASON(ERR_peek_last_error());

crypto/pem/pem_lib.c:722:13: Assignment
        720.               }
        721.               memcpy(nameB->data, &(buf[11]), i - 6);
        722.               nameB->data[i - 6] = '\0';
                           ^
        723.               break;
        724.           }

apps/s_server.c:1521:27: Call
1519.       if (next_proto_neg_in) {
1520.           unsigned short len;
1521.           next_proto.data = next_protos_parse(&len, next_proto_neg_in);
                                  ^
1522.           if (next_proto.data == NULL)
1523.               goto end;

apps/apps.c:2219:10: <Offset trace>
2217.   
2218.       out = app_malloc(strlen(in) + 1, "NPN buffer");
2219.       for (i = 0; i <= len; ++i) {
                 ^
2220.           if (i == len || in[i] == ',') {
2221.               if (i - start > 255) {

apps/apps.c:2219:10: Assignment
  2217.   
  2218.       out = app_malloc(strlen(in) + 1, "NPN buffer");
  2219.       for (i = 0; i <= len; ++i) {
                   ^
  2220.           if (i == len || in[i] == ',') {
  2221.               if (i - start > 255) {

apps/apps.c:2208:1: <Length trace>
2206.    *   returns: a malloced buffer or NULL on failure.
2207.    */
2208. > unsigned char *next_protos_parse(unsigned short *outlen, const char *in)
2209.   {
2210.       size_t len;

apps/apps.c:2208:1: Parameter `in->strlen`
  2206.    *   returns: a malloced buffer or NULL on failure.
  2207.    */
  2208. > unsigned char *next_protos_parse(unsigned short *outlen, const char *in)
  2209.   {
  2210.       size_t len;

apps/apps.c:2218:11: Call
  2216.           return NULL;
  2217.   
  2218.       out = app_malloc(strlen(in) + 1, "NPN buffer");
                    ^
  2219.       for (i = 0; i <= len; ++i) {
  2220.           if (i == len || in[i] == ',') {

apps/apps.c:976:1: Parameter `sz`
    974.   }
    975.   
    976. > void* app_malloc(int sz, const char *what)
    977.   {
    978.       void *vp = OPENSSL_malloc(sz);

apps/apps.c:978:16: Call
    976.   void* app_malloc(int sz, const char *what)
    977.   {
    978.       void *vp = OPENSSL_malloc(sz);
                          ^
    979.   
    980.       if (vp == NULL) {

crypto/mem.c:125:9: Assignment
      123.   
      124.       if (num <= 0)
      125.           return NULL;
                     ^
      126.   
      127.       allow_customize = 0;

apps/apps.c:978:5: Assignment
    976.   void* app_malloc(int sz, const char *what)
    977.   {
    978.       void *vp = OPENSSL_malloc(sz);
               ^
    979.   
    980.       if (vp == NULL) {

apps/apps.c:986:5: Assignment
    984.           exit(1);
    985.       }
    986.       return vp;
               ^
    987.   }
    988.   

apps/apps.c:2218:5: Assignment
  2216.           return NULL;
  2217.   
  2218.       out = app_malloc(strlen(in) + 1, "NPN buffer");
              ^
  2219.       for (i = 0; i <= len; ++i) {
  2220.           if (i == len || in[i] == ',') {

apps/apps.c:2228:13: Array access: Offset: [1, 65535] Size: [1, +oo] by call to `next_protos_parse` 
  2226.               start = i + 1;
  2227.           } else
  2228.               out[i + 1] = in[i];
                      ^
  2229.       }
  2230.   
