ssl/s3_lib.c:3794: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 1] by call to `tls1_set_groups`.
Showing all 9 steps of the trace


ssl/s3_lib.c:3794:20: Call
3792.               if (nid == NID_undef)
3793.                   return 0;
3794.               return tls1_set_groups(&ctx->ext.supportedgroups,
                           ^
3795.                                      &ctx->ext.supportedgroups_len,
3796.                                      &nid, 1);

ssl/t1_lib.c:382:1: <Offset trace>
380.   }
381.   
382. > int tls1_set_groups(uint16_t **pext, size_t *pextlen,
383.                       int *groups, size_t ngroups)
384.   {

ssl/t1_lib.c:382:1: Parameter `ngroups`
  380.   }
  381.   
  382. > int tls1_set_groups(uint16_t **pext, size_t *pextlen,
  383.                       int *groups, size_t ngroups)
  384.   {

ssl/t1_lib.c:382:1: <Length trace>
380.   }
381.   
382. > int tls1_set_groups(uint16_t **pext, size_t *pextlen,
383.                       int *groups, size_t ngroups)
384.   {

ssl/t1_lib.c:382:1: Parameter `ngroups`
  380.   }
  381.   
  382. > int tls1_set_groups(uint16_t **pext, size_t *pextlen,
  383.                       int *groups, size_t ngroups)
  384.   {

ssl/t1_lib.c:392:13: Call
  390.        */
  391.       unsigned long dup_list = 0;
  392.       glist = OPENSSL_malloc(ngroups * sizeof(*glist));
                     ^
  393.       if (glist == NULL)
  394.           return 0;

crypto/mem.c:178:9: Assignment
    176.   
    177.       if (num == 0)
    178.           return NULL;
                   ^
    179.   
    180.       FAILTEST();

ssl/t1_lib.c:392:5: Assignment
  390.        */
  391.       unsigned long dup_list = 0;
  392.       glist = OPENSSL_malloc(ngroups * sizeof(*glist));
             ^
  393.       if (glist == NULL)
  394.           return 0;

ssl/t1_lib.c:406:9: Array access: Offset: 0 Size: [0, 1] by call to `tls1_set_groups` 
  404.           }
  405.           dup_list |= idmask;
  406.           glist[i] = id;
                 ^
  407.       }
  408.       OPENSSL_free(*pext);

int tls1_set_groups(uint16_t **pext, size_t *pextlen,
                    int *groups, size_t ngroups)
{
    uint16_t *glist;
    size_t i;
    unsigned long dup_list = 0;
    glist = OPENSSL_malloc(ngroups * sizeof(*glist));
    if (glist == NULL)
        return 0;
    for (i = 0; i < ngroups; i++) {
        unsigned long idmask;
        uint16_t id;
        id = tls1_ec_nid2curve_id(groups[i]);
        idmask = 1L << id;
        if (!id || (dup_list & idmask)) {
            OPENSSL_free(glist);
            return 0;
        }
        dup_list |= idmask;
        glist[i] = id;
    }
    OPENSSL_free(*pext);
    *pext = glist;
    *pextlen = ngroups;
    return 1;
}
['long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)\n{\n    switch (cmd) {\n#ifndef OPENSSL_NO_DH\n    case SSL_CTRL_SET_TMP_DH:\n        {\n            DH *dh = (DH *)parg;\n            EVP_PKEY *pkdh = NULL;\n            if (dh == NULL) {\n                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_PASSED_NULL_PARAMETER);\n                return 0;\n            }\n            pkdh = ssl_dh_to_pkey(dh);\n            if (pkdh == NULL) {\n                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_MALLOC_FAILURE);\n                return 0;\n            }\n            if (!ssl_ctx_security(ctx, SSL_SECOP_TMP_DH,\n                                  EVP_PKEY_security_bits(pkdh), 0, pkdh)) {\n                SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_DH_KEY_TOO_SMALL);\n                EVP_PKEY_free(pkdh);\n                return 1;\n            }\n            EVP_PKEY_free(ctx->cert->dh_tmp);\n            ctx->cert->dh_tmp = pkdh;\n            return 1;\n        }\n    case SSL_CTRL_SET_TMP_DH_CB:\n        {\n            SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);\n            return (0);\n        }\n    case SSL_CTRL_SET_DH_AUTO:\n        ctx->cert->dh_tmp_auto = larg;\n        return 1;\n#endif\n#ifndef OPENSSL_NO_EC\n    case SSL_CTRL_SET_TMP_ECDH:\n        {\n            const EC_GROUP *group = NULL;\n            int nid;\n            if (parg == NULL) {\n                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_PASSED_NULL_PARAMETER);\n                return 0;\n            }\n            group = EC_KEY_get0_group((const EC_KEY *)parg);\n            if (group == NULL) {\n                SSLerr(SSL_F_SSL3_CTX_CTRL, EC_R_MISSING_PARAMETERS);\n                return 0;\n            }\n            nid = EC_GROUP_get_curve_name(group);\n            if (nid == NID_undef)\n                return 0;\n            return tls1_set_groups(&ctx->ext.supportedgroups,\n                                   &ctx->ext.supportedgroups_len,\n                                   &nid, 1);\n        }\n#endif\n    case SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG:\n        ctx->ext.servername_arg = parg;\n        break;\n    case SSL_CTRL_SET_TLSEXT_TICKET_KEYS:\n    case SSL_CTRL_GET_TLSEXT_TICKET_KEYS:\n        {\n            unsigned char *keys = parg;\n            long tick_keylen = (sizeof(ctx->ext.tick_key_name) +\n                                sizeof(ctx->ext.tick_hmac_key) +\n                                sizeof(ctx->ext.tick_aes_key));\n            if (keys == NULL)\n                return tick_keylen;\n            if (larg != tick_keylen) {\n                SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_TICKET_KEYS_LENGTH);\n                return 0;\n            }\n            if (cmd == SSL_CTRL_SET_TLSEXT_TICKET_KEYS) {\n                memcpy(ctx->ext.tick_key_name, keys,\n                       sizeof(ctx->ext.tick_key_name));\n                memcpy(ctx->ext.tick_hmac_key,\n                       keys + sizeof(ctx->ext.tick_key_name),\n                       sizeof(ctx->ext.tick_hmac_key));\n                memcpy(ctx->ext.tick_aes_key,\n                       keys + sizeof(ctx->ext.tick_key_name) +\n                       sizeof(ctx->ext.tick_hmac_key),\n                       sizeof(ctx->ext.tick_aes_key));\n            } else {\n                memcpy(keys, ctx->ext.tick_key_name,\n                       sizeof(ctx->ext.tick_key_name));\n                memcpy(keys + sizeof(ctx->ext.tick_key_name),\n                       ctx->ext.tick_hmac_key,\n                       sizeof(ctx->ext.tick_hmac_key));\n                memcpy(keys + sizeof(ctx->ext.tick_key_name) +\n                       sizeof(ctx->ext.tick_hmac_key),\n                       ctx->ext.tick_aes_key,\n                       sizeof(ctx->ext.tick_aes_key));\n            }\n            return 1;\n        }\n    case SSL_CTRL_GET_TLSEXT_STATUS_REQ_TYPE:\n        return ctx->ext.status_type;\n    case SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE:\n        ctx->ext.status_type = larg;\n        break;\n    case SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG:\n        ctx->ext.status_arg = parg;\n        return 1;\n    case SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB_ARG:\n        *(void**)parg = ctx->ext.status_arg;\n        break;\n    case SSL_CTRL_GET_TLSEXT_STATUS_REQ_CB:\n        *(int (**)(SSL*, void*))parg = ctx->ext.status_cb;\n        break;\n#ifndef OPENSSL_NO_SRP\n    case SSL_CTRL_SET_TLS_EXT_SRP_USERNAME:\n        ctx->srp_ctx.srp_Mask |= SSL_kSRP;\n        OPENSSL_free(ctx->srp_ctx.login);\n        ctx->srp_ctx.login = NULL;\n        if (parg == NULL)\n            break;\n        if (strlen((const char *)parg) > 255 || strlen((const char *)parg) < 1) {\n            SSLerr(SSL_F_SSL3_CTX_CTRL, SSL_R_INVALID_SRP_USERNAME);\n            return 0;\n        }\n        if ((ctx->srp_ctx.login = OPENSSL_strdup((char *)parg)) == NULL) {\n            SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_INTERNAL_ERROR);\n            return 0;\n        }\n        break;\n    case SSL_CTRL_SET_TLS_EXT_SRP_PASSWORD:\n        ctx->srp_ctx.SRP_give_srp_client_pwd_callback =\n            srp_password_from_info_cb;\n        if (ctx->srp_ctx.info != NULL)\n            OPENSSL_free(ctx->srp_ctx.info);\n        if ((ctx->srp_ctx.info = BUF_strdup((char *)parg)) == NULL) {\n            SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_INTERNAL_ERROR);\n            return 0;\n        }\n        break;\n    case SSL_CTRL_SET_SRP_ARG:\n        ctx->srp_ctx.srp_Mask |= SSL_kSRP;\n        ctx->srp_ctx.SRP_cb_arg = parg;\n        break;\n    case SSL_CTRL_SET_TLS_EXT_SRP_STRENGTH:\n        ctx->srp_ctx.strength = larg;\n        break;\n#endif\n#ifndef OPENSSL_NO_EC\n    case SSL_CTRL_SET_GROUPS:\n        return tls1_set_groups(&ctx->ext.supportedgroups,\n                               &ctx->ext.supportedgroups_len,\n                               parg, larg);\n    case SSL_CTRL_SET_GROUPS_LIST:\n        return tls1_set_groups_list(&ctx->ext.supportedgroups,\n                                    &ctx->ext.supportedgroups_len,\n                                    parg);\n#endif\n    case SSL_CTRL_SET_SIGALGS:\n        return tls1_set_sigalgs(ctx->cert, parg, larg, 0);\n    case SSL_CTRL_SET_SIGALGS_LIST:\n        return tls1_set_sigalgs_list(ctx->cert, parg, 0);\n    case SSL_CTRL_SET_CLIENT_SIGALGS:\n        return tls1_set_sigalgs(ctx->cert, parg, larg, 1);\n    case SSL_CTRL_SET_CLIENT_SIGALGS_LIST:\n        return tls1_set_sigalgs_list(ctx->cert, parg, 1);\n    case SSL_CTRL_SET_CLIENT_CERT_TYPES:\n        return ssl3_set_req_cert_type(ctx->cert, parg, larg);\n    case SSL_CTRL_BUILD_CERT_CHAIN:\n        return ssl_build_cert_chain(NULL, ctx, larg);\n    case SSL_CTRL_SET_VERIFY_CERT_STORE:\n        return ssl_cert_set_cert_store(ctx->cert, parg, 0, larg);\n    case SSL_CTRL_SET_CHAIN_CERT_STORE:\n        return ssl_cert_set_cert_store(ctx->cert, parg, 1, larg);\n    case SSL_CTRL_EXTRA_CHAIN_CERT:\n        if (ctx->extra_certs == NULL) {\n            if ((ctx->extra_certs = sk_X509_new_null()) == NULL) {\n                SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_MALLOC_FAILURE);\n                return 0;\n            }\n        }\n        if (!sk_X509_push(ctx->extra_certs, (X509 *)parg)) {\n            SSLerr(SSL_F_SSL3_CTX_CTRL, ERR_R_MALLOC_FAILURE);\n            return 0;\n        }\n        break;\n    case SSL_CTRL_GET_EXTRA_CHAIN_CERTS:\n        if (ctx->extra_certs == NULL && larg == 0)\n            *(STACK_OF(X509) **)parg = ctx->cert->key->chain;\n        else\n            *(STACK_OF(X509) **)parg = ctx->extra_certs;\n        break;\n    case SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS:\n        sk_X509_pop_free(ctx->extra_certs, X509_free);\n        ctx->extra_certs = NULL;\n        break;\n    case SSL_CTRL_CHAIN:\n        if (larg)\n            return ssl_cert_set1_chain(NULL, ctx, (STACK_OF(X509) *)parg);\n        else\n            return ssl_cert_set0_chain(NULL, ctx, (STACK_OF(X509) *)parg);\n    case SSL_CTRL_CHAIN_CERT:\n        if (larg)\n            return ssl_cert_add1_chain_cert(NULL, ctx, (X509 *)parg);\n        else\n            return ssl_cert_add0_chain_cert(NULL, ctx, (X509 *)parg);\n    case SSL_CTRL_GET_CHAIN_CERTS:\n        *(STACK_OF(X509) **)parg = ctx->cert->key->chain;\n        break;\n    case SSL_CTRL_SELECT_CURRENT_CERT:\n        return ssl_cert_select_current(ctx->cert, (X509 *)parg);\n    case SSL_CTRL_SET_CURRENT_CERT:\n        return ssl_cert_set_current(ctx->cert, larg);\n    default:\n        return (0);\n    }\n    return (1);\n}', 'int tls1_set_groups(uint16_t **pext, size_t *pextlen,\n                    int *groups, size_t ngroups)\n{\n    uint16_t *glist;\n    size_t i;\n    unsigned long dup_list = 0;\n    glist = OPENSSL_malloc(ngroups * sizeof(*glist));\n    if (glist == NULL)\n        return 0;\n    for (i = 0; i < ngroups; i++) {\n        unsigned long idmask;\n        uint16_t id;\n        id = tls1_ec_nid2curve_id(groups[i]);\n        idmask = 1L << id;\n        if (!id || (dup_list & idmask)) {\n            OPENSSL_free(glist);\n            return 0;\n        }\n        dup_list |= idmask;\n        glist[i] = id;\n    }\n    OPENSSL_free(*pext);\n    *pext = glist;\n    *pextlen = ngroups;\n    return 1;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)(file); (void)(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']