ssl/statem/extensions_clnt.c:166: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: 29 by call to `tls_curve_allowed`.
Showing all 8 steps of the trace


ssl/statem/extensions_clnt.c:167:18: Call
165.       for (i = 0; i < num_curves; i++, pcurvestmp += 2) {
166.           if (tls_curve_allowed(s, pcurves, SSL_SECOP_CURVE_SUPPORTED)) {
167.               if (!WPACKET_put_bytes_u8(pkt, pcurvestmp[0])
                        ^
168.                   || !WPACKET_put_bytes_u8(pkt, pcurvestmp[1])) {
169.                       SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS,

ssl/packet.c:289:1: Parameter `*pkt->buf->data`
  287.   }
  288.   
  289. > int WPACKET_put_bytes__(WPACKET *pkt, unsigned int val, size_t size)
  290.   {
  291.       unsigned char *data;

ssl/statem/extensions_clnt.c:166:13: Call
164.       /* Copy curve ID if supported */
165.       for (i = 0; i < num_curves; i++, pcurvestmp += 2) {
166.           if (tls_curve_allowed(s, pcurves, SSL_SECOP_CURVE_SUPPORTED)) {
                   ^
167.               if (!WPACKET_put_bytes_u8(pkt, pcurvestmp[0])
168.                   || !WPACKET_put_bytes_u8(pkt, pcurvestmp[1])) {

ssl/t1_lib.c:309:1: <Offset trace>
307.   
308.   /* See if curve is allowed by security callback */
309. > int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
310.   {
311.       const tls_curve_info *cinfo;

ssl/t1_lib.c:309:1: Parameter `*curve`
  307.   
  308.   /* See if curve is allowed by security callback */
  309. > int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
  310.   {
  311.       const tls_curve_info *cinfo;

ssl/t1_lib.c:141:1: <Length trace>
139.    * table: the index of each entry is one less than the TLS curve id.
140.    */
141. > static const tls_curve_info nid_list[] = {
142.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
143.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:141:1: Array declaration
  139.    * table: the index of each entry is one less than the TLS curve id.
  140.    */
  141. > static const tls_curve_info nid_list[] = {
  142.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
  143.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:316:5: Array access: Offset: [-1, +oo] Size: 29 by call to `tls_curve_allowed` 
  314.       if ((curve[1] < 1) || ((size_t)curve[1] > OSSL_NELEM(nid_list)))
  315.           return 0;
  316.       cinfo = &nid_list[curve[1] - 1];
             ^
  317.   # ifdef OPENSSL_NO_EC2M
  318.       if (cinfo->flags & TLS_CURVE_CHAR2)

int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
{
    const tls_curve_info *cinfo;
    if (curve[0])
        return 1;
    if ((curve[1] < 1) || ((size_t)curve[1] > OSSL_NELEM(nid_list)))
        return 0;
    cinfo = &nid_list[curve[1] - 1];
# ifdef OPENSSL_NO_EC2M
    if (cinfo->flags & TLS_CURVE_CHAR2)
        return 0;
# endif
    return ssl_security(s, op, cinfo->secbits, cinfo->nid, (void *)curve);
}
['int tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt, X509 *x,\n                                        size_t chainidx, int *al)\n{\n    const unsigned char *pcurves = NULL, *pcurvestmp;\n    size_t num_curves = 0, i;\n    if (!use_ecc(s))\n        return 1;\n    pcurves = s->ext.supportedgroups;\n    if (!tls1_get_curvelist(s, 0, &pcurves, &num_curves)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS,\n               ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    pcurvestmp = pcurves;\n    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups)\n            || !WPACKET_start_sub_packet_u16(pkt)\n            || !WPACKET_start_sub_packet_u16(pkt)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS,\n               ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    for (i = 0; i < num_curves; i++, pcurvestmp += 2) {\n        if (tls_curve_allowed(s, pcurves, SSL_SECOP_CURVE_SUPPORTED)) {\n            if (!WPACKET_put_bytes_u8(pkt, pcurvestmp[0])\n                || !WPACKET_put_bytes_u8(pkt, pcurvestmp[1])) {\n                    SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS,\n                           ERR_R_INTERNAL_ERROR);\n                    return 0;\n                }\n        }\n    }\n    if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS,\n               ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    return 1;\n}', 'int WPACKET_put_bytes__(WPACKET *pkt, unsigned int val, size_t size)\n{\n    unsigned char *data;\n    assert(size <= sizeof(unsigned int));\n    if (size > sizeof(unsigned int)\n            || !WPACKET_allocate_bytes(pkt, size, &data)\n            || !put_value(data, val, size))\n        return 0;\n    return 1;\n}', 'int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)\n{\n    const tls_curve_info *cinfo;\n    if (curve[0])\n        return 1;\n    if ((curve[1] < 1) || ((size_t)curve[1] > OSSL_NELEM(nid_list)))\n        return 0;\n    cinfo = &nid_list[curve[1] - 1];\n# ifdef OPENSSL_NO_EC2M\n    if (cinfo->flags & TLS_CURVE_CHAR2)\n        return 0;\n# endif\n    return ssl_security(s, op, cinfo->secbits, cinfo->nid, (void *)curve);\n}']