# apprentice.c 1117 size_t i = me->mp->type == FILE_NAME ? 1 : 0; 1. Condition mset[i].count == mset[i].max, taking true branch. 1118 if (mset[i].count == mset[i].max) { 1119 struct magic_entry *mp; 1120 1121 mset[i].max += ALLOC_INCR; 2. Condition (mp = (struct magic_entry *)realloc(mset[i].me, 16UL /* sizeof (*mp) */ * mset[i].max)) == NULL, taking false branch. 1122 if ((mp = CAST(struct magic_entry *, 1123 realloc(mset[i].me, sizeof(*mp) * mset[i].max))) == 1124 NULL) { 1125 file_oomem(ms, sizeof(*mp) * mset[i].max); 1126 return -1; 1127 } CID 277981: Wrong sizeof argument (SIZEOF_MISMATCH) [select issue] CID 277982 (#1 of 1): Out-of-bounds access (OVERRUN)3. overrun-buffer-arg: Overrunning struct type magic_entry of 16 bytes by passing it to a function which accesses it at byte offset 3199 using argument 3200UL. 1128 (void)memset(&mp[mset[i].count], 0, sizeof(*mp) * 1129 ALLOC_INCR); 1130 mset[i].me = mp; 1131 } 1132 mset[i].me[mset[i].count++] = *me; 1133 memset(me, 0, sizeof(*me)); 1134 return 0; 1135}