include/openssl/lhash.h:197: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `OPENSSL_LH_delete`.
Showing all 10 steps of the trace


include/openssl/lhash.h:197:1: Parameter `lh->pmax`
195.       LHASH_OF(type)
196.   
197. > DEFINE_LHASH_OF(OPENSSL_STRING);
198.   # ifdef _MSC_VER
199.   /*

include/openssl/lhash.h:197:1: Call
195.       LHASH_OF(type)
196.   
197. > DEFINE_LHASH_OF(OPENSSL_STRING);
198.   # ifdef _MSC_VER
199.   /*

crypto/lhash/lhash.c:102:1: Parameter `lh->pmax`
  100.   }
  101.   
  102. > void *OPENSSL_LH_delete(OPENSSL_LHASH *lh, const void *data)
  103.   {
  104.       unsigned long hash;

crypto/lhash/lhash.c:125:9: Call
  123.       if ((lh->num_nodes > MIN_NODES) &&
  124.           (lh->down_load >= (lh->num_items * LH_LOAD_MULT / lh->num_nodes)))
  125.           contract(lh);
                 ^
  126.   
  127.       return ret;

crypto/lhash/lhash.c:231:1: <Offset trace>
229.   }
230.   
231. > static void contract(OPENSSL_LHASH *lh)
232.   {
233.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:231:1: Parameter `lh->p`
    229.   }
    230.   
    231. > static void contract(OPENSSL_LHASH *lh)
    232.   {
    233.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:251:9: Assignment
    249.           lh->b = n;
    250.       } else
    251.           lh->p--;
                   ^
    252.   
    253.       lh->num_nodes--;

crypto/lhash/lhash.c:231:1: <Length trace>
229.   }
230.   
231. > static void contract(OPENSSL_LHASH *lh)
232.   {
233.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:231:1: Parameter `*lh->b`
    229.   }
    230.   
    231. > static void contract(OPENSSL_LHASH *lh)
    232.   {
    233.       OPENSSL_LH_NODE **n, *n1, *np;

crypto/lhash/lhash.c:256:10: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `OPENSSL_LH_delete` 
    254.       lh->num_contracts++;
    255.   
    256.       n1 = lh->b[(int)lh->p];
                    ^
    257.       if (n1 == NULL)
    258.           lh->b[(int)lh->p] = np;
