ssl/t1_lib.c:516: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: 29 by call to `tls_curve_allowed`.
Showing all 7 steps of the trace


ssl/t1_lib.c:279:1: Array declaration
277.   
278.   /* The default curves */
279. > static const unsigned char eccurves_default[] = {
280.       0, 29,                      /* X25519 (29) */
281.       0, 23,                      /* secp256r1 (23) */

ssl/t1_lib.c:516:22: Call
514.           for (j = 0; j < num_supp; j++, tsupp += 2) {
515.               if (pref[0] == tsupp[0] && pref[1] == tsupp[1]) {
516.                   if (!tls_curve_allowed(s, pref, SSL_SECOP_CURVE_SHARED))
                            ^
517.                       continue;
518.                   if (nmatch == k) {

ssl/t1_lib.c:406:1: <Offset trace>
404.   
405.   /* See if curve is allowed by security callback */
406. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
407.   {
408.       const tls_curve_info *cinfo;

ssl/t1_lib.c:406:1: Parameter `*curve`
  404.   
  405.   /* See if curve is allowed by security callback */
  406. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
  407.   {
  408.       const tls_curve_info *cinfo;

ssl/t1_lib.c:239:1: <Length trace>
237.    * table: the index of each entry is one less than the TLS curve id.
238.    */
239. > static const tls_curve_info nid_list[] = {
240.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
241.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:239:1: Array declaration
  237.    * table: the index of each entry is one less than the TLS curve id.
  238.    */
  239. > static const tls_curve_info nid_list[] = {
  240.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
  241.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:413:5: Array access: Offset: [-1, +oo] Size: 29 by call to `tls_curve_allowed` 
  411.       if ((curve[1] < 1) || ((size_t)curve[1] > OSSL_NELEM(nid_list)))
  412.           return 0;
  413.       cinfo = &nid_list[curve[1] - 1];
             ^
  414.   # ifdef OPENSSL_NO_EC2M
  415.       if (cinfo->flags & TLS_CURVE_CHAR2)

static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
{
    const tls_curve_info *cinfo;
    if (curve[0])
        return 1;
    if ((curve[1] < 1) || ((size_t)curve[1] > OSSL_NELEM(nid_list)))
        return 0;
    cinfo = &nid_list[curve[1] - 1];
# ifdef OPENSSL_NO_EC2M
    if (cinfo->flags & TLS_CURVE_CHAR2)
        return 0;
# endif
    return ssl_security(s, op, cinfo->secbits, cinfo->nid, (void *)curve);
}
['int tls1_shared_curve(SSL *s, int nmatch)\n{\n    const unsigned char *pref, *supp;\n    size_t num_pref, num_supp, i, j;\n    int k;\n    if (s->server == 0)\n        return -1;\n    if (nmatch == -2) {\n        if (tls1_suiteb(s)) {\n            unsigned long cid = s->s3->tmp.new_cipher->id;\n            if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)\n                return NID_X9_62_prime256v1;\n            if (cid == TLS1_CK_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)\n                return NID_secp384r1;\n            return NID_undef;\n        }\n        nmatch = 0;\n    }\n    if (!tls1_get_curvelist\n        (s, (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) != 0, &supp,\n         &num_supp))\n        return nmatch == -1 ? 0 : NID_undef;\n    if (!tls1_get_curvelist\n        (s, !(s->options & SSL_OP_CIPHER_SERVER_PREFERENCE), &pref,\n         &num_pref))\n        return nmatch == -1 ? 0 : NID_undef;\n    if (num_supp == 0 && (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) != 0) {\n        supp = eccurves_all;\n        num_supp = sizeof(eccurves_all) / 2;\n    } else if (num_pref == 0 &&\n        (s->options & SSL_OP_CIPHER_SERVER_PREFERENCE) == 0) {\n        pref = eccurves_all;\n        num_pref = sizeof(eccurves_all) / 2;\n    }\n    k = 0;\n    for (i = 0; i < num_pref; i++, pref += 2) {\n        const unsigned char *tsupp = supp;\n        for (j = 0; j < num_supp; j++, tsupp += 2) {\n            if (pref[0] == tsupp[0] && pref[1] == tsupp[1]) {\n                if (!tls_curve_allowed(s, pref, SSL_SECOP_CURVE_SHARED))\n                    continue;\n                if (nmatch == k) {\n                    int id = (pref[0] << 8) | pref[1];\n                    return tls1_ec_curve_id2nid(id);\n                }\n                k++;\n            }\n        }\n    }\n    if (nmatch == -1)\n        return k;\n    return NID_undef;\n}', 'static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)\n{\n    const tls_curve_info *cinfo;\n    if (curve[0])\n        return 1;\n    if ((curve[1] < 1) || ((size_t)curve[1] > OSSL_NELEM(nid_list)))\n        return 0;\n    cinfo = &nid_list[curve[1] - 1];\n# ifdef OPENSSL_NO_EC2M\n    if (cinfo->flags & TLS_CURVE_CHAR2)\n        return 0;\n# endif\n    return ssl_security(s, op, cinfo->secbits, cinfo->nid, (void *)curve);\n}']