ssl/ssltest.c:407: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [0, +oo] by call to `SSL_new`.
Showing all 23 steps of the trace


ssl/ssltest.c:309:8: Call
307.   
308.   	c_ctx=SSL_CTX_new(meth);
309.   	s_ctx=SSL_CTX_new(meth);
              ^
310.   	if ((c_ctx == NULL) || (s_ctx == NULL))
311.   		{

ssl/ssl_lib.c:1041:16: Call
  1039.   	ret->client_cert_cb=NULL;
  1040.   
  1041.   	ret->sessions=lh_new(SSL_SESSION_hash,SSL_SESSION_cmp);
                         ^
  1042.   	if (ret->sessions == NULL) goto err;
  1043.   	ret->cert_store=X509_STORE_new();

crypto/lhash/lhash.c:124:29: Array declaration
    122.   	if ((ret=(LHASH *)Malloc(sizeof(LHASH))) == NULL)
    123.   		goto err0;
    124.   	if ((ret->b=(LHASH_NODE **)Malloc(sizeof(LHASH_NODE *)*MIN_NODES)) == NULL)
                                       ^
    125.   		goto err1;
    126.   	for (i=0; i<MIN_NODES; i++)

crypto/lhash/lhash.c:124:7: Assignment
    122.   	if ((ret=(LHASH *)Malloc(sizeof(LHASH))) == NULL)
    123.   		goto err0;
    124.   	if ((ret->b=(LHASH_NODE **)Malloc(sizeof(LHASH_NODE *)*MIN_NODES)) == NULL)
                 ^
    125.   		goto err1;
    126.   	for (i=0; i<MIN_NODES; i++)

ssl/ssltest.c:407:8: Call
405.   	}
406.   
407.   	c_ssl=SSL_new(c_ctx);
              ^
408.   	s_ssl=SSL_new(s_ctx);
409.   

ssl/ssl_lib.c:162:1: Parameter `*ctx->sessions->b`
  160.   	}
  161.   
  162. > SSL *SSL_new(SSL_CTX *ctx)
  163.   	{
  164.   	SSL *s;

ssl/ssl_lib.c:219:2: Call
  217.   	s->options=ctx->options;
  218.   	s->mode=ctx->mode;
  219.   	SSL_clear(s);
          ^
  220.   
  221.   	CRYPTO_new_ex_data(ssl_meth,(char *)s,&s->ex_data);

ssl/ssl_lib.c:82:1: Parameter `*s->ctx->sessions->b`
    80.   	};
    81.   
    82. > int SSL_clear(SSL *s)
    83.   	{
    84.   	int state;

ssl/ssl_lib.c:121:6: Call
    119.   	ssl_clear_cipher_ctx(s);
    120.   
    121.   	if (ssl_clear_bad_session(s))
                ^
    122.   		{
    123.   		SSL_SESSION_free(s->session);

ssl/ssl_sess.c:582:1: Parameter `*s->ctx->sessions->b`
      580.   	}
      581.   
      582. > int ssl_clear_bad_session(SSL *s)
      583.   	{
      584.   	if (	(s->session != NULL) &&

ssl/ssl_sess.c:588:3: Call
      586.   		!(SSL_in_init(s) || SSL_in_before(s)))
      587.   		{
      588.   		SSL_CTX_remove_session(s->ctx,s->session);
               ^
      589.   		return(1);
      590.   		}

ssl/ssl_sess.c:382:1: Parameter `*ctx->sessions->b`
        380.   	}
        381.   
        382. > int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
        383.   {
        384.   	return remove_session_lock(ctx, c, 1);

ssl/ssl_sess.c:384:9: Call
        382.   int SSL_CTX_remove_session(SSL_CTX *ctx, SSL_SESSION *c)
        383.   {
        384.   	return remove_session_lock(ctx, c, 1);
                       ^
        385.   }
        386.   

ssl/ssl_sess.c:387:1: Parameter `*ctx->sessions->b`
          385.   }
          386.   
          387. > static int remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
          388.   	{
          389.   	SSL_SESSION *r;

ssl/ssl_sess.c:395:20: Call
          393.   		{
          394.   		if(lck) CRYPTO_w_lock(CRYPTO_LOCK_SSL_CTX);
          395.   		r=(SSL_SESSION *)lh_delete(ctx->sessions,(char *)c);
                                    ^
          396.   		if (r != NULL)
          397.   			{

crypto/lhash/lhash.c:220:1: Parameter `*lh->b`
            218.   	}
            219.   
            220. > char *lh_delete(LHASH *lh, char *data)
            221.   	{
            222.   	unsigned long hash;

crypto/lhash/lhash.c:246:3: Call
            244.   	if ((lh->num_nodes > MIN_NODES) &&
            245.   		(lh->down_load >= (lh->num_items*LH_LOAD_MULT/lh->num_nodes)))
            246.   		contract(lh);
                     ^
            247.   
            248.   	return(ret);

crypto/lhash/lhash.c:355:1: <Offset trace>
353.   	}
354.   
355. > static void contract(LHASH *lh)
356.   	{
357.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:355:1: Parameter `lh->p`
              353.   	}
              354.   
              355. > static void contract(LHASH *lh)
              356.   	{
              357.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:378:3: Assignment
              376.   		}
              377.   	else
              378.   		lh->p--;
                       ^
              379.   
              380.   	lh->num_nodes--;

crypto/lhash/lhash.c:355:1: <Length trace>
353.   	}
354.   
355. > static void contract(LHASH *lh)
356.   	{
357.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:355:1: Parameter `*lh->b`
              353.   	}
              354.   
              355. > static void contract(LHASH *lh)
              356.   	{
              357.   	LHASH_NODE **n,*n1,*np;

crypto/lhash/lhash.c:383:5: Array access: Offset: [-1, +oo] Size: [0, +oo] by call to `SSL_new` 
              381.   	lh->num_contracts++;
              382.   
              383.   	n1=lh->b[(int)lh->p];
                         ^
              384.   	if (n1 == NULL)
              385.   		lh->b[(int)lh->p]=np;
