crypto/conf/conf_def.c:376: error: BUFFER_OVERRUN_L3
  Offset added: [1, +oo] (⇐ [0, +oo] + [1, +oo]) Size: [0, +oo] by call to `_CONF_new_section`.
Showing all 8 steps of the trace


crypto/conf/conf_def.c:332:13: Assignment
330.           } else {
331.               pname = s;
332.               psection = NULL;
                   ^
333.               end = eat_alpha_numeric(conf, s);
334.               if ((end[0] == ':') && (end[1] == ':')) {

crypto/conf/conf_def.c:376:26: Call
374.                   if ((tv = _CONF_get_section(conf, psection))
375.                       == NULL)
376.                       tv = _CONF_new_section(conf, psection);
                                ^
377.                   if (tv == NULL) {
378.                       CONFerr(CONF_F_DEF_LOAD_BIO,

crypto/conf/conf_api.c:250:1: <Offset trace>
248.   
249.   /* Up until OpenSSL 0.9.5a, this was new_section */
250. > CONF_VALUE *_CONF_new_section(CONF *conf, const char *section)
251.   {
252.       STACK_OF(CONF_VALUE) *sk = NULL;

crypto/conf/conf_api.c:250:1: Parameter `section->strlen`
  248.   
  249.   /* Up until OpenSSL 0.9.5a, this was new_section */
  250. > CONF_VALUE *_CONF_new_section(CONF *conf, const char *section)
  251.   {
  252.       STACK_OF(CONF_VALUE) *sk = NULL;

crypto/conf/conf_api.c:260:5: Assignment
  258.       if ((v = OPENSSL_malloc(sizeof(*v))) == NULL)
  259.           goto err;
  260.       i = strlen(section) + 1;
             ^
  261.       if ((v->section = OPENSSL_malloc(i)) == NULL)
  262.           goto err;

crypto/conf/conf_api.c:250:1: <Length trace>
248.   
249.   /* Up until OpenSSL 0.9.5a, this was new_section */
250. > CONF_VALUE *_CONF_new_section(CONF *conf, const char *section)
251.   {
252.       STACK_OF(CONF_VALUE) *sk = NULL;

crypto/conf/conf_api.c:250:1: Parameter `*section`
  248.   
  249.   /* Up until OpenSSL 0.9.5a, this was new_section */
  250. > CONF_VALUE *_CONF_new_section(CONF *conf, const char *section)
  251.   {
  252.       STACK_OF(CONF_VALUE) *sk = NULL;

crypto/conf/conf_api.c:264:5: Array access: Offset added: [1, +oo] (⇐ [0, +oo] + [1, +oo]) Size: [0, +oo] by call to `_CONF_new_section` 
  262.           goto err;
  263.   
  264.       memcpy(v->section, section, i);
             ^
  265.       v->name = NULL;
  266.       v->value = (char *)sk;
