test/lhash_test.c:92: error: BUFFER_OVERRUN_L3
  Offset: [16, +oo] Size: [1, +oo] by call to `lh_int_insert`.
Showing all 17 steps of the trace


test/lhash_test.c:83:24: Call
81.       };
82.       const unsigned int n_dels = OSSL_NELEM(dels);
83.       LHASH_OF(int) *h = lh_int_new(&int_hash, &int_cmp);
                             ^
84.       unsigned int i;
85.       int testresult = 0, j, *p;

test/lhash_test.c:30:1: Call
  28.   #endif
  29.   
  30. > DEFINE_LHASH_OF(int);
  31.   
  32.   static int int_tests[] = { 65537, 13, 1, 3, -5, 6, 7, 4, -10, -12, -14, 22, 9,

crypto/lhash/lhash.c:38:5: Assignment
    36.       ret->hash = ((h == NULL) ? (OPENSSL_LH_HASHFUNC)OPENSSL_LH_strhash : h);
    37.       ret->num_nodes = MIN_NODES / 2;
    38.       ret->num_alloc_nodes = MIN_NODES;
              ^
    39.       ret->pmax = MIN_NODES / 2;
    40.       ret->up_load = UP_LOAD;

test/lhash_test.c:92:14: Call
90.       /* insert */
91.       for (i = 0; i < n_int_tests; i++)
92.           if (!TEST_ptr_null(lh_int_insert(h, int_tests + i))) {
                   ^
93.               TEST_info("int insert %d", i);
94.               goto end;

test/lhash_test.c:30:1: Parameter `lh->num_alloc_nodes`
  28.   #endif
  29.   
  30. > DEFINE_LHASH_OF(int);
  31.   
  32.   static int int_tests[] = { 65537, 13, 1, 3, -5, 6, 7, 4, -10, -12, -14, 22, 9,

test/lhash_test.c:30:1: Call
  28.   #endif
  29.   
  30. > DEFINE_LHASH_OF(int);
  31.   
  32.   static int int_tests[] = { 65537, 13, 1, 3, -5, 6, 7, 4, -10, -12, -14, 22, 9,

crypto/lhash/lhash.c:70:1: Parameter `lh->num_alloc_nodes`
    68.   }
    69.   
    70. > void *OPENSSL_LH_insert(OPENSSL_LHASH *lh, void *data)
    71.   {
    72.       unsigned long hash;

crypto/lhash/lhash.c:77:77: Call
    75.   
    76.       lh->error = 0;
    77.       if ((lh->up_load <= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)) && !expand(lh))
                                                                                      ^
    78.           return NULL;        /* 'lh->error++' already done in 'expand' */
    79.   

crypto/lhash/lhash.c:186:1: <Offset trace>
184.   }
185.   
186. > static int expand(OPENSSL_LHASH *lh)
187.   {
188.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:186:1: Parameter `lh->num_alloc_nodes`
      184.   }
      185.   
      186. > static int expand(OPENSSL_LHASH *lh)
      187.   {
      188.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:212:9: Assignment
      210.   
      211.       if ((lh->p) >= lh->pmax) {
      212.           j = (int)lh->num_alloc_nodes * 2;
                     ^
      213.           n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));
      214.           if (n == NULL) {

crypto/lhash/lhash.c:186:1: <Length trace>
184.   }
185.   
186. > static int expand(OPENSSL_LHASH *lh)
187.   {
188.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:186:1: Parameter `*lh->b`
      184.   }
      185.   
      186. > static int expand(OPENSSL_LHASH *lh)
      187.   {
      188.       OPENSSL_LH_NODE **n, **n1, **n2, *np;

crypto/lhash/lhash.c:213:13: Call
      211.       if ((lh->p) >= lh->pmax) {
      212.           j = (int)lh->num_alloc_nodes * 2;
      213.           n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));
                         ^
      214.           if (n == NULL) {
      215.               lh->error++;

crypto/mem.c:240:9: Assignment
        238.       if (num == 0) {
        239.           CRYPTO_free(str, file, line);
        240.           return NULL;
                       ^
        241.       }
        242.   

crypto/lhash/lhash.c:213:9: Assignment
      211.       if ((lh->p) >= lh->pmax) {
      212.           j = (int)lh->num_alloc_nodes * 2;
      213.           n = OPENSSL_realloc(lh->b, (int)(sizeof(OPENSSL_LH_NODE *) * j));
                     ^
      214.           if (n == NULL) {
      215.               lh->error++;

crypto/lhash/lhash.c:221:13: Array access: Offset: [16, +oo] Size: [1, +oo] by call to `lh_int_insert` 
      219.           }
      220.           for (i = (int)lh->num_alloc_nodes; i < j; i++) /* 26/02/92 eay */
      221.               n[i] = NULL;        /* 02/03/92 eay */
                         ^
      222.           lh->pmax = lh->num_alloc_nodes;
      223.           lh->num_alloc_nodes = j;
