ssl/s23_srvr.c:564: error: BUFFER_OVERRUN_L2
  Offset added: [0, 4096] Size: 88 by call to `RECORD_LAYER_set_data`.
Showing all 9 steps of the trace


ssl/s23_srvr.c:252:5: Assignment
250.       unsigned int i;
251.       unsigned int csl, sil, cl;
252.       int n = 0, j;
           ^
253.       int type = 0;
254.       int v[2];

ssl/s23_srvr.c:564:17: Call
562.                * put the 'n' bytes we have read into the input buffer for SSLv3
563.                */
564.               if(!RECORD_LAYER_set_data(&s->rlayer, buf, n))
                       ^
565.                   goto err;
566.           } else {

ssl/record/rec_layer_s3.c:196:1: Parameter `len`
  194.   }
  195.   
  196. > int RECORD_LAYER_set_data(RECORD_LAYER *rl, const unsigned char *buf, int len)
  197.   {
  198.       rl->packet_length = len;

ssl/record/rec_layer_s3.c:207:5: Call
  205.   
  206.       rl->packet = SSL3_BUFFER_get_buf(&rl->rbuf);
  207.       SSL3_BUFFER_set_data(&rl->rbuf, buf, len);
             ^
  208.   
  209.       return 1;

ssl/record/ssl3_buffer.c:115:1: <Offset trace>
113.   #include "record_locl.h"
114.   
115. > void SSL3_BUFFER_set_data(SSL3_BUFFER *b, const unsigned char *d, int n)
116.   {
117.       if(d != NULL)

ssl/record/ssl3_buffer.c:115:1: Parameter `n`
    113.   #include "record_locl.h"
    114.   
    115. > void SSL3_BUFFER_set_data(SSL3_BUFFER *b, const unsigned char *d, int n)
    116.   {
    117.       if(d != NULL)

ssl/record/ssl3_buffer.c:115:1: <Length trace>
113.   #include "record_locl.h"
114.   
115. > void SSL3_BUFFER_set_data(SSL3_BUFFER *b, const unsigned char *d, int n)
116.   {
117.       if(d != NULL)

ssl/record/ssl3_buffer.c:115:1: Parameter `*d`
    113.   #include "record_locl.h"
    114.   
    115. > void SSL3_BUFFER_set_data(SSL3_BUFFER *b, const unsigned char *d, int n)
    116.   {
    117.       if(d != NULL)

ssl/record/ssl3_buffer.c:118:9: Array access: Offset added: [0, 4096] Size: 88 by call to `RECORD_LAYER_set_data` 
    116.   {
    117.       if(d != NULL)
    118.           memcpy(b->buf, d, n);
                   ^
    119.       b->left = n;
    120.       b->offset = 0;

void SSL3_BUFFER_set_data(SSL3_BUFFER *b, const unsigned char *d, int n)
{
    if(d != NULL)
        memcpy(b->buf, d, n);
    b->left = n;
    b->offset = 0;
}
['int ssl23_get_client_hello(SSL *s)\n{\n    unsigned char buf_space[11];\n    unsigned char *buf = &(buf_space[0]);\n    unsigned char *p, *d, *d_len, *dd;\n    unsigned int i;\n    unsigned int csl, sil, cl;\n    int n = 0, j;\n    int type = 0;\n    int v[2];\n    if (s->state == SSL23_ST_SR_CLNT_HELLO_A) {\n        v[0] = v[1] = 0;\n        if (!ssl3_setup_buffers(s))\n            goto err;\n        n = ssl23_read_bytes(s, sizeof buf_space);\n        if (n != sizeof buf_space)\n            return (n);\n        p = RECORD_LAYER_get_packet(&s->rlayer);\n        memcpy(buf, p, n);\n        if ((p[0] & 0x80) && (p[2] == SSL2_MT_CLIENT_HELLO)) {\n            if ((p[3] == 0x00) && (p[4] == 0x02)) {\n                v[0] = p[3];\n                v[1] = p[4];\n            } else if (p[3] == SSL3_VERSION_MAJOR) {\n                v[0] = p[3];\n                v[1] = p[4];\n                if (p[4] >= TLS1_VERSION_MINOR) {\n                    if (p[4] >= TLS1_2_VERSION_MINOR &&\n                        !(s->options & SSL_OP_NO_TLSv1_2)) {\n                        s->version = TLS1_2_VERSION;\n                        s->state = SSL23_ST_SR_CLNT_HELLO_B;\n                    } else if (p[4] >= TLS1_1_VERSION_MINOR &&\n                               !(s->options & SSL_OP_NO_TLSv1_1)) {\n                        s->version = TLS1_1_VERSION;\n                        s->state = SSL23_ST_SR_CLNT_HELLO_B;\n                    } else if (!(s->options & SSL_OP_NO_TLSv1)) {\n                        s->version = TLS1_VERSION;\n                        s->state = SSL23_ST_SR_CLNT_HELLO_B;\n                    } else if (!(s->options & SSL_OP_NO_SSLv3)) {\n                        s->version = SSL3_VERSION;\n                        s->state = SSL23_ST_SR_CLNT_HELLO_B;\n                    }\n                } else if (!(s->options & SSL_OP_NO_SSLv3)) {\n                    s->version = SSL3_VERSION;\n                    s->state = SSL23_ST_SR_CLNT_HELLO_B;\n                }\n            }\n        }\n        else if ((p[0] == SSL3_RT_HANDSHAKE) &&\n                 (p[1] == SSL3_VERSION_MAJOR) &&\n                 (p[5] == SSL3_MT_CLIENT_HELLO) && ((p[3] == 0 && p[4] < 5)\n                                                    || (p[9] >= p[1]))) {\n            v[0] = p[1];\n            if (p[3] == 0 && p[4] < 6) {\n                SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_RECORD_TOO_SMALL);\n                goto err;\n            }\n            if (p[9] > SSL3_VERSION_MAJOR)\n                v[1] = 0xff;\n            else\n                v[1] = p[10];\n            if (v[1] >= TLS1_VERSION_MINOR) {\n                if (v[1] >= TLS1_2_VERSION_MINOR &&\n                    !(s->options & SSL_OP_NO_TLSv1_2)) {\n                    s->version = TLS1_2_VERSION;\n                    type = 3;\n                } else if (v[1] >= TLS1_1_VERSION_MINOR &&\n                           !(s->options & SSL_OP_NO_TLSv1_1)) {\n                    s->version = TLS1_1_VERSION;\n                    type = 3;\n                } else if (!(s->options & SSL_OP_NO_TLSv1)) {\n                    s->version = TLS1_VERSION;\n                    type = 3;\n                } else if (!(s->options & SSL_OP_NO_SSLv3)) {\n                    s->version = SSL3_VERSION;\n                    type = 3;\n                }\n            } else {\n                if (!(s->options & SSL_OP_NO_SSLv3)) {\n                    s->version = SSL3_VERSION;\n                    type = 3;\n                } else if (!(s->options & SSL_OP_NO_TLSv1)) {\n                    s->version = TLS1_VERSION;\n                    type = 3;\n                }\n            }\n        } else if ((strncmp("GET ", (char *)p, 4) == 0) ||\n                   (strncmp("POST ", (char *)p, 5) == 0) ||\n                   (strncmp("HEAD ", (char *)p, 5) == 0) ||\n                   (strncmp("PUT ", (char *)p, 4) == 0)) {\n            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_HTTP_REQUEST);\n            goto err;\n        } else if (strncmp("CONNECT", (char *)p, 7) == 0) {\n            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_HTTPS_PROXY_REQUEST);\n            goto err;\n        }\n    }\n    OPENSSL_assert(s->version <= TLS_MAX_VERSION);\n    if (s->version < TLS1_2_VERSION && tls1_suiteb(s)) {\n        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,\n               SSL_R_ONLY_TLS_1_2_ALLOWED_IN_SUITEB_MODE);\n        goto err;\n    }\n    if (FIPS_mode() && (s->version < TLS1_VERSION)) {\n        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,\n               SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);\n        goto err;\n    }\n    if (!ssl_security(s, SSL_SECOP_VERSION, 0, s->version, NULL)) {\n        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_VERSION_TOO_LOW);\n        goto err;\n    }\n    if (s->state == SSL23_ST_SR_CLNT_HELLO_B) {\n        type = 2;\n        p = RECORD_LAYER_get_packet(&s->rlayer);\n        v[0] = p[3];\n        v[1] = p[4];\n        n = ((p[0] & 0x7f) << 8) | p[1];\n        if (n > (1024 * 4)) {\n            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_RECORD_TOO_LARGE);\n            goto err;\n        }\n        if (n < 9) {\n            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,\n                   SSL_R_RECORD_LENGTH_MISMATCH);\n            goto err;\n        }\n        j = ssl23_read_bytes(s, n + 2);\n        if (j <= 0)\n            return (j);\n        ssl3_finish_mac(s, RECORD_LAYER_get_packet(&s->rlayer) + 2,\n                        RECORD_LAYER_get_packet_length(&s->rlayer) - 2);\n        if (s->msg_callback)\n            s->msg_callback(0, SSL2_VERSION, 0,\n                            RECORD_LAYER_get_packet(&s->rlayer) + 2,\n                            RECORD_LAYER_get_packet_length(&s->rlayer) - 2, s,\n                            s->msg_callback_arg);\n        p = RECORD_LAYER_get_packet(&s->rlayer);\n        p += 5;\n        n2s(p, csl);\n        n2s(p, sil);\n        n2s(p, cl);\n        d = (unsigned char *)s->init_buf->data;\n        if ((csl + sil + cl + 11)\n                != RECORD_LAYER_get_packet_length(&s->rlayer)) {\n            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,\n                   SSL_R_RECORD_LENGTH_MISMATCH);\n            goto err;\n        }\n        *(d++) = SSL3_MT_CLIENT_HELLO;\n        d_len = d;\n        d += 3;\n        *(d++) = SSL3_VERSION_MAJOR;\n        *(d++) = v[1];\n        i = (cl > SSL3_RANDOM_SIZE) ? SSL3_RANDOM_SIZE : cl;\n        memset(d, 0, SSL3_RANDOM_SIZE);\n        memcpy(&(d[SSL3_RANDOM_SIZE - i]), &(p[csl + sil]), i);\n        d += SSL3_RANDOM_SIZE;\n        *(d++) = 0;\n        j = 0;\n        dd = d;\n        d += 2;\n        for (i = 0; i < csl; i += 3) {\n            if (p[i] != 0)\n                continue;\n            *(d++) = p[i + 1];\n            *(d++) = p[i + 2];\n            j += 2;\n        }\n        s2n(j, dd);\n        *(d++) = 1;\n        *(d++) = 0;\n#if 0\n        p = p + csl + sil + cl;\n        while (p < s->packet + s->packet_length) {\n            *(d++) = *(p++);\n        }\n#endif\n        i = (d - (unsigned char *)s->init_buf->data) - 4;\n        l2n3((long)i, d_len);\n        s->s3->tmp.reuse_message = 1;\n        s->s3->tmp.message_type = SSL3_MT_CLIENT_HELLO;\n        s->s3->tmp.message_size = i;\n    }\n    if ((type == 2) || (type == 3)) {\n        const SSL_METHOD *new_method;\n        new_method = ssl23_get_server_method(s->version);\n        if (new_method == NULL) {\n            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNSUPPORTED_PROTOCOL);\n            goto err;\n        }\n        s->method = new_method;\n        if (!ssl_init_wbio_buffer(s, 1))\n            goto err;\n        s->state = SSL3_ST_SR_CLNT_HELLO_A;\n        if (type == 3) {\n            if(!RECORD_LAYER_set_data(&s->rlayer, buf, n))\n                goto err;\n        } else {\n            if(!RECORD_LAYER_set_data(&s->rlayer, NULL, 0))\n                goto err;\n        }\n        s->handshake_func = s->method->ssl_accept;\n    } else {\n        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL);\n        goto err;\n    }\n    s->init_num = 0;\n    if (buf != buf_space)\n        OPENSSL_free(buf);\n    return (SSL_accept(s));\n err:\n    if (buf != buf_space)\n        OPENSSL_free(buf);\n    return (-1);\n}', 'int RECORD_LAYER_set_data(RECORD_LAYER *rl, const unsigned char *buf, int len)\n{\n    rl->packet_length = len;\n    if(len != 0) {\n        rl->rstate = SSL_ST_READ_HEADER;\n        if (!SSL3_BUFFER_is_initialised(&rl->rbuf))\n            if (!ssl3_setup_read_buffer(rl->s))\n                return 0;\n    }\n    rl->packet = SSL3_BUFFER_get_buf(&rl->rbuf);\n    SSL3_BUFFER_set_data(&rl->rbuf, buf, len);\n    return 1;\n}', 'void SSL3_BUFFER_set_data(SSL3_BUFFER *b, const unsigned char *d, int n)\n{\n    if(d != NULL)\n        memcpy(b->buf, d, n);\n    b->left = n;\n    b->offset = 0;\n}']