ssl/s3_lib.c:3477: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 1] by call to `tls1_set_groups`.
Showing all 9 steps of the trace


ssl/s3_lib.c:3477:20: Call
3475.               if (nid == NID_undef)
3476.                   return 0;
3477.               return tls1_set_groups(&s->ext.supportedgroups,
                           ^
3478.                                      &s->ext.supportedgroups_len,
3479.                                      &nid, 1);

ssl/t1_lib.c:382:1: <Offset trace>
380.   }
381.   
382. > int tls1_set_groups(uint16_t **pext, size_t *pextlen,
383.                       int *groups, size_t ngroups)
384.   {

ssl/t1_lib.c:382:1: Parameter `ngroups`
  380.   }
  381.   
  382. > int tls1_set_groups(uint16_t **pext, size_t *pextlen,
  383.                       int *groups, size_t ngroups)
  384.   {

ssl/t1_lib.c:382:1: <Length trace>
380.   }
381.   
382. > int tls1_set_groups(uint16_t **pext, size_t *pextlen,
383.                       int *groups, size_t ngroups)
384.   {

ssl/t1_lib.c:382:1: Parameter `ngroups`
  380.   }
  381.   
  382. > int tls1_set_groups(uint16_t **pext, size_t *pextlen,
  383.                       int *groups, size_t ngroups)
  384.   {

ssl/t1_lib.c:392:13: Call
  390.        */
  391.       unsigned long dup_list = 0;
  392.       glist = OPENSSL_malloc(ngroups * sizeof(*glist));
                     ^
  393.       if (glist == NULL)
  394.           return 0;

crypto/mem.c:178:9: Assignment
    176.   
    177.       if (num == 0)
    178.           return NULL;
                   ^
    179.   
    180.       FAILTEST();

ssl/t1_lib.c:392:5: Assignment
  390.        */
  391.       unsigned long dup_list = 0;
  392.       glist = OPENSSL_malloc(ngroups * sizeof(*glist));
             ^
  393.       if (glist == NULL)
  394.           return 0;

ssl/t1_lib.c:406:9: Array access: Offset: 0 Size: [0, 1] by call to `tls1_set_groups` 
  404.           }
  405.           dup_list |= idmask;
  406.           glist[i] = id;
                 ^
  407.       }
  408.       OPENSSL_free(*pext);

int tls1_set_groups(uint16_t **pext, size_t *pextlen,
                    int *groups, size_t ngroups)
{
    uint16_t *glist;
    size_t i;
    unsigned long dup_list = 0;
    glist = OPENSSL_malloc(ngroups * sizeof(*glist));
    if (glist == NULL)
        return 0;
    for (i = 0; i < ngroups; i++) {
        unsigned long idmask;
        uint16_t id;
        id = tls1_ec_nid2curve_id(groups[i]);
        idmask = 1L << id;
        if (!id || (dup_list & idmask)) {
            OPENSSL_free(glist);
            return 0;
        }
        dup_list |= idmask;
        glist[i] = id;
    }
    OPENSSL_free(*pext);
    *pext = glist;
    *pextlen = ngroups;
    return 1;
}
['long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)\n{\n    int ret = 0;\n    switch (cmd) {\n    case SSL_CTRL_GET_CLIENT_CERT_REQUEST:\n        break;\n    case SSL_CTRL_GET_NUM_RENEGOTIATIONS:\n        ret = s->s3->num_renegotiations;\n        break;\n    case SSL_CTRL_CLEAR_NUM_RENEGOTIATIONS:\n        ret = s->s3->num_renegotiations;\n        s->s3->num_renegotiations = 0;\n        break;\n    case SSL_CTRL_GET_TOTAL_RENEGOTIATIONS:\n        ret = s->s3->total_renegotiations;\n        break;\n    case SSL_CTRL_GET_FLAGS:\n        ret = (int)(s->s3->flags);\n        break;\n#ifndef OPENSSL_NO_DH\n    case SSL_CTRL_SET_TMP_DH:\n        {\n            DH *dh = (DH *)parg;\n            EVP_PKEY *pkdh = NULL;\n            if (dh == NULL) {\n                SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);\n                return (ret);\n            }\n            pkdh = ssl_dh_to_pkey(dh);\n            if (pkdh == NULL) {\n                SSLerr(SSL_F_SSL3_CTRL, ERR_R_MALLOC_FAILURE);\n                return 0;\n            }\n            if (!ssl_security(s, SSL_SECOP_TMP_DH,\n                              EVP_PKEY_security_bits(pkdh), 0, pkdh)) {\n                SSLerr(SSL_F_SSL3_CTRL, SSL_R_DH_KEY_TOO_SMALL);\n                EVP_PKEY_free(pkdh);\n                return ret;\n            }\n            EVP_PKEY_free(s->cert->dh_tmp);\n            s->cert->dh_tmp = pkdh;\n            ret = 1;\n        }\n        break;\n    case SSL_CTRL_SET_TMP_DH_CB:\n        {\n            SSLerr(SSL_F_SSL3_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);\n            return (ret);\n        }\n    case SSL_CTRL_SET_DH_AUTO:\n        s->cert->dh_tmp_auto = larg;\n        return 1;\n#endif\n#ifndef OPENSSL_NO_EC\n    case SSL_CTRL_SET_TMP_ECDH:\n        {\n            const EC_GROUP *group = NULL;\n            int nid;\n            if (parg == NULL) {\n                SSLerr(SSL_F_SSL3_CTRL, ERR_R_PASSED_NULL_PARAMETER);\n                return 0;\n            }\n            group = EC_KEY_get0_group((const EC_KEY *)parg);\n            if (group == NULL) {\n                SSLerr(SSL_F_SSL3_CTRL, EC_R_MISSING_PARAMETERS);\n                return 0;\n            }\n            nid = EC_GROUP_get_curve_name(group);\n            if (nid == NID_undef)\n                return 0;\n            return tls1_set_groups(&s->ext.supportedgroups,\n                                   &s->ext.supportedgroups_len,\n                                   &nid, 1);\n        }\n        break;\n#endif\n    case SSL_CTRL_SET_TLSEXT_HOSTNAME:\n        if (larg == TLSEXT_NAMETYPE_host_name) {\n            size_t len;\n            OPENSSL_free(s->ext.hostname);\n            s->ext.hostname = NULL;\n            ret = 1;\n            if (parg == NULL)\n                break;\n            len = strlen((char *)parg);\n            if (len == 0 || len > TLSEXT_MAXLEN_host_name) {\n                SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME);\n                return 0;\n            }\n            if ((s->ext.hostname = OPENSSL_strdup((char *)parg)) == NULL) {\n                SSLerr(SSL_F_SSL3_CTRL, ERR_R_INTERNAL_ERROR);\n                return 0;\n            }\n        } else {\n            SSLerr(SSL_F_SSL3_CTRL, SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE);\n            return 0;\n        }\n        break;\n    case SSL_CTRL_SET_TLSEXT_DEBUG_ARG:\n        s->ext.debug_arg = parg;\n        ret = 1;\n        break;\n    case SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE:\n        ret = s->ext.status_type;\n        break;\n    case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE:\n        s->ext.status_type = larg;\n        ret = 1;\n        break;\n    case SSL_CTRL_GET_TLSEXT_STATUS_REQ_EXTS:\n        *(STACK_OF(X509_EXTENSION) **)parg = s->ext.ocsp.exts;\n        ret = 1;\n        break;\n    case SSL_CTRL_SET_TLSEXT_STATUS_REQ_EXTS:\n        s->ext.ocsp.exts = parg;\n        ret = 1;\n        break;\n    case SSL_CTRL_GET_TLSEXT_STATUS_REQ_IDS:\n        *(STACK_OF(OCSP_RESPID) **)parg = s->ext.ocsp.ids;\n        ret = 1;\n        break;\n    case SSL_CTRL_SET_TLSEXT_STATUS_REQ_IDS:\n        s->ext.ocsp.ids = parg;\n        ret = 1;\n        break;\n    case SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP:\n        *(unsigned char **)parg = s->ext.ocsp.resp;\n        if (s->ext.ocsp.resp_len == 0\n                || s->ext.ocsp.resp_len > LONG_MAX)\n            return -1;\n        return (long)s->ext.ocsp.resp_len;\n    case SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP:\n        OPENSSL_free(s->ext.ocsp.resp);\n        s->ext.ocsp.resp = parg;\n        s->ext.ocsp.resp_len = larg;\n        ret = 1;\n        break;\n#ifndef OPENSSL_NO_HEARTBEATS\n    case SSL_CTRL_DTLS_EXT_SEND_HEARTBEAT:\n    case SSL_CTRL_GET_DTLS_EXT_HEARTBEAT_PENDING:\n    case SSL_CTRL_SET_DTLS_EXT_HEARTBEAT_NO_REQUESTS:\n        break;\n#endif\n    case SSL_CTRL_CHAIN:\n        if (larg)\n            return ssl_cert_set1_chain(s, NULL, (STACK_OF(X509) *)parg);\n        else\n            return ssl_cert_set0_chain(s, NULL, (STACK_OF(X509) *)parg);\n    case SSL_CTRL_CHAIN_CERT:\n        if (larg)\n            return ssl_cert_add1_chain_cert(s, NULL, (X509 *)parg);\n        else\n            return ssl_cert_add0_chain_cert(s, NULL, (X509 *)parg);\n    case SSL_CTRL_GET_CHAIN_CERTS:\n        *(STACK_OF(X509) **)parg = s->cert->key->chain;\n        break;\n    case SSL_CTRL_SELECT_CURRENT_CERT:\n        return ssl_cert_select_current(s->cert, (X509 *)parg);\n    case SSL_CTRL_SET_CURRENT_CERT:\n        if (larg == SSL_CERT_SET_SERVER) {\n            const SSL_CIPHER *cipher;\n            if (!s->server)\n                return 0;\n            cipher = s->s3->tmp.new_cipher;\n            if (cipher == NULL)\n                return 0;\n            if (cipher->algorithm_auth & (SSL_aNULL | SSL_aSRP))\n                return 2;\n            if (s->s3->tmp.cert == NULL)\n                return 0;\n            s->cert->key = s->s3->tmp.cert;\n            return 1;\n        }\n        return ssl_cert_set_current(s->cert, larg);\n#ifndef OPENSSL_NO_EC\n    case SSL_CTRL_GET_GROUPS:\n        {\n            uint16_t *clist;\n            size_t clistlen;\n            if (!s->session)\n                return 0;\n            clist = s->session->ext.supportedgroups;\n            clistlen = s->session->ext.supportedgroups_len;\n            if (parg) {\n                size_t i;\n                int *cptr = parg;\n                for (i = 0; i < clistlen; i++) {\n                    int nid = tls1_ec_curve_id2nid(clist[i], NULL);\n                    if (nid != 0)\n                        cptr[i] = nid;\n                    else\n                        cptr[i] = TLSEXT_nid_unknown | clist[i];\n                }\n            }\n            return (int)clistlen;\n        }\n    case SSL_CTRL_SET_GROUPS:\n        return tls1_set_groups(&s->ext.supportedgroups,\n                               &s->ext.supportedgroups_len, parg, larg);\n    case SSL_CTRL_SET_GROUPS_LIST:\n        return tls1_set_groups_list(&s->ext.supportedgroups,\n                                    &s->ext.supportedgroups_len, parg);\n    case SSL_CTRL_GET_SHARED_GROUP:\n        return tls1_shared_group(s, larg);\n#endif\n    case SSL_CTRL_SET_SIGALGS:\n        return tls1_set_sigalgs(s->cert, parg, larg, 0);\n    case SSL_CTRL_SET_SIGALGS_LIST:\n        return tls1_set_sigalgs_list(s->cert, parg, 0);\n    case SSL_CTRL_SET_CLIENT_SIGALGS:\n        return tls1_set_sigalgs(s->cert, parg, larg, 1);\n    case SSL_CTRL_SET_CLIENT_SIGALGS_LIST:\n        return tls1_set_sigalgs_list(s->cert, parg, 1);\n    case SSL_CTRL_GET_CLIENT_CERT_TYPES:\n        {\n            const unsigned char **pctype = parg;\n            if (s->server || !s->s3->tmp.cert_req)\n                return 0;\n            if (pctype)\n                *pctype = s->s3->tmp.ctype;\n            return s->s3->tmp.ctype_len;\n        }\n    case SSL_CTRL_SET_CLIENT_CERT_TYPES:\n        if (!s->server)\n            return 0;\n        return ssl3_set_req_cert_type(s->cert, parg, larg);\n    case SSL_CTRL_BUILD_CERT_CHAIN:\n        return ssl_build_cert_chain(s, NULL, larg);\n    case SSL_CTRL_SET_VERIFY_CERT_STORE:\n        return ssl_cert_set_cert_store(s->cert, parg, 0, larg);\n    case SSL_CTRL_SET_CHAIN_CERT_STORE:\n        return ssl_cert_set_cert_store(s->cert, parg, 1, larg);\n    case SSL_CTRL_GET_PEER_SIGNATURE_NID:\n        if (s->s3->tmp.peer_sigalg == NULL)\n            return 0;\n        *(int *)parg = s->s3->tmp.peer_sigalg->hash;\n        return 1;\n    case SSL_CTRL_GET_SERVER_TMP_KEY:\n#if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_EC)\n        if (s->server || s->session == NULL || s->s3->peer_tmp == NULL) {\n            return 0;\n        } else {\n            EVP_PKEY_up_ref(s->s3->peer_tmp);\n            *(EVP_PKEY **)parg = s->s3->peer_tmp;\n            return 1;\n        }\n#else\n        return 0;\n#endif\n#ifndef OPENSSL_NO_EC\n    case SSL_CTRL_GET_EC_POINT_FORMATS:\n        {\n            SSL_SESSION *sess = s->session;\n            const unsigned char **pformat = parg;\n            if (sess == NULL || sess->ext.ecpointformats == NULL)\n                return 0;\n            *pformat = sess->ext.ecpointformats;\n            return (int)sess->ext.ecpointformats_len;\n        }\n#endif\n    default:\n        break;\n    }\n    return (ret);\n}', 'int tls1_set_groups(uint16_t **pext, size_t *pextlen,\n                    int *groups, size_t ngroups)\n{\n    uint16_t *glist;\n    size_t i;\n    unsigned long dup_list = 0;\n    glist = OPENSSL_malloc(ngroups * sizeof(*glist));\n    if (glist == NULL)\n        return 0;\n    for (i = 0; i < ngroups; i++) {\n        unsigned long idmask;\n        uint16_t id;\n        id = tls1_ec_nid2curve_id(groups[i]);\n        idmask = 1L << id;\n        if (!id || (dup_list & idmask)) {\n            OPENSSL_free(glist);\n            return 0;\n        }\n        dup_list |= idmask;\n        glist[i] = id;\n    }\n    OPENSSL_free(*pext);\n    *pext = glist;\n    *pextlen = ngroups;\n    return 1;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)(file); (void)(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']