crypto/o_str.c:214: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo].
Showing all 9 steps of the trace


crypto/o_str.c:194:1: <Length trace>
192.    * on EBCDIC machines)
193.    */
194. > char *OPENSSL_buf2hexstr(const unsigned char *buffer, long len)
195.   {
196.       const static char hexdig[] = "0123456789ABCDEF";

crypto/o_str.c:194:1: Parameter `len`
192.    * on EBCDIC machines)
193.    */
194. > char *OPENSSL_buf2hexstr(const unsigned char *buffer, long len)
195.   {
196.       const static char hexdig[] = "0123456789ABCDEF";

crypto/o_str.c:206:16: Call
204.       }
205.   
206.       if ((tmp = OPENSSL_malloc(len * 3)) == NULL) {
                      ^
207.           CRYPTOerr(CRYPTO_F_OPENSSL_BUF2HEXSTR, ERR_R_MALLOC_FAILURE);
208.           return NULL;

crypto/mem.c:165:9: Assignment
  163.   
  164.       if (num <= 0)
  165.           return NULL;
                 ^
  166.   
  167.       FAILTEST();

crypto/o_str.c:206:10: Assignment
204.       }
205.   
206.       if ((tmp = OPENSSL_malloc(len * 3)) == NULL) {
                ^
207.           CRYPTOerr(CRYPTO_F_OPENSSL_BUF2HEXSTR, ERR_R_MALLOC_FAILURE);
208.           return NULL;

crypto/o_str.c:210:5: Assignment
208.           return NULL;
209.       }
210.       q = tmp;
           ^
211.       for (i = 0, p = buffer; i < len; i++, p++) {
212.           *q++ = hexdig[(*p >> 4) & 0xf];

crypto/o_str.c:212:10: Assignment
210.       q = tmp;
211.       for (i = 0, p = buffer; i < len; i++, p++) {
212.           *q++ = hexdig[(*p >> 4) & 0xf];
                ^
213.           *q++ = hexdig[*p & 0xf];
214.           *q++ = ':';

crypto/o_str.c:213:10: Assignment
211.       for (i = 0, p = buffer; i < len; i++, p++) {
212.           *q++ = hexdig[(*p >> 4) & 0xf];
213.           *q++ = hexdig[*p & 0xf];
                ^
214.           *q++ = ':';
215.       }

crypto/o_str.c:214:9: Array access: Offset: [2, +oo] Size: [1, +oo]
212.           *q++ = hexdig[(*p >> 4) & 0xf];
213.           *q++ = hexdig[*p & 0xf];
214.           *q++ = ':';
               ^
215.       }
216.       q[-1] = 0;
