crypto/conf/conf_def.c:297: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] (⇐ [1, +oo] + 1) Size: [1, 2147483644] by call to `clear_comments`.
Showing all 10 steps of the trace


crypto/conf/conf_def.c:246:14: Call
244.       again = 0;
245.       for (;;) {
246.           if (!BUF_MEM_grow(buff, bufnum + CONFBUFSIZE)) {
                    ^
247.               CONFerr(CONF_F_DEF_LOAD_BIO, ERR_R_BUF_LIB);
248.               goto err;

crypto/buffer/buffer.c:122:1: Parameter `*str->data`
  120.   }
  121.   
  122. > size_t BUF_MEM_grow(BUF_MEM *str, size_t len)
  123.   {
  124.       char *ret;

crypto/conf/conf_def.c:295:9: Assignment
293.               continue;
294.           bufnum = 0;
295.           buf = buff->data;
               ^
296.   
297.           clear_comments(conf, buf);

crypto/conf/conf_def.c:297:9: Call
295.           buf = buff->data;
296.   
297.           clear_comments(conf, buf);
               ^
298.           s = eat_ws(conf, buf);
299.           if (IS_EOF(conf, *s))

crypto/conf/conf_def.c:413:1: Parameter `*p`
  411.   }
  412.   
  413. > static void clear_comments(CONF *conf, char *p)
  414.   {
  415.       for (;;) {

crypto/conf/conf_def.c:432:17: Call
  430.           }
  431.           if (IS_DQUOTE(conf, *p)) {
  432.               p = scan_dquote(conf, p);
                         ^
  433.               continue;
  434.           }

crypto/conf/conf_def.c:635:1: <Length trace>
633.   }
634.   
635. > static char *scan_dquote(CONF *conf, char *p)
636.   {
637.       int q = *p;

crypto/conf/conf_def.c:635:1: Parameter `*p`
    633.   }
    634.   
    635. > static char *scan_dquote(CONF *conf, char *p)
    636.   {
    637.       int q = *p;

crypto/conf/conf_def.c:639:5: Assignment
    637.       int q = *p;
    638.   
    639.       p++;
               ^
    640.       while (!(IS_EOF(conf, *p))) {
    641.           if (*p == q) {

crypto/conf/conf_def.c:642:17: Array access: Offset: [2, +oo] (⇐ [1, +oo] + 1) Size: [1, 2147483644] by call to `clear_comments` 
    640.       while (!(IS_EOF(conf, *p))) {
    641.           if (*p == q) {
    642.               if (*(p + 1) == q) {
                           ^
    643.                   p++;
    644.               } else {
