ssl/ssl_lib.c:2931: error: BUFFER_OVERRUN_L2
  Offset: [min(-1, `s->s3->tmp.cert_idx`), max(6, `s->s3->tmp.cert_idx`)] Size: 6.
Showing all 8 steps of the trace


ssl/ssl_lib.c:2919:1: <Offset trace>
2917.   }
2918.   
2919. > int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
2920.                                      size_t *serverinfo_length)
2921.   {

ssl/ssl_lib.c:2919:1: Parameter `s->s3->tmp.cert_idx`
2917.   }
2918.   
2919. > int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
2920.                                      size_t *serverinfo_length)
2921.   {

ssl/ssl_lib.c:2927:9: Call
2925.   
2926.       c = s->cert;
2927.       i = ssl_get_server_cert_index(s);
                ^
2928.   
2929.       if (i == -1)

ssl/ssl_lib.c:2852:13: Assignment
  2850.           if (s->s3->tmp.sigalg == NULL) {
  2851.               SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
  2852.               return -1;
                      ^
  2853.           }
  2854.           return s->s3->tmp.cert_idx;

ssl/ssl_lib.c:2927:5: Assignment
2925.   
2926.       c = s->cert;
2927.       i = ssl_get_server_cert_index(s);
            ^
2928.   
2929.       if (i == -1)

ssl/ssl_lib.c:2919:1: <Length trace>
2917.   }
2918.   
2919. > int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
2920.                                      size_t *serverinfo_length)
2921.   {

ssl/ssl_lib.c:2919:1: Parameter `s->cert->pkeys[*]`
2917.   }
2918.   
2919. > int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
2920.                                      size_t *serverinfo_length)
2921.   {

ssl/ssl_lib.c:2931:9: Array access: Offset: [min(-1, s->s3->tmp.cert_idx), max(6, s->s3->tmp.cert_idx)] Size: 6
2929.       if (i == -1)
2930.           return 0;
2931.       if (c->pkeys[i].serverinfo == NULL)
                ^
2932.           return 0;
2933.   

int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
                                   size_t *serverinfo_length)
{
    CERT *c = NULL;
    int i = 0;
    *serverinfo_length = 0;
    c = s->cert;
    i = ssl_get_server_cert_index(s);
    if (i == -1)
        return 0;
    if (c->pkeys[i].serverinfo == NULL)
        return 0;
    *serverinfo = c->pkeys[i].serverinfo;
    *serverinfo_length = c->pkeys[i].serverinfo_length;
    return 1;
}
['int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,\n                                   size_t *serverinfo_length)\n{\n    CERT *c = NULL;\n    int i = 0;\n    *serverinfo_length = 0;\n    c = s->cert;\n    i = ssl_get_server_cert_index(s);\n    if (i == -1)\n        return 0;\n    if (c->pkeys[i].serverinfo == NULL)\n        return 0;\n    *serverinfo = c->pkeys[i].serverinfo;\n    *serverinfo_length = c->pkeys[i].serverinfo_length;\n    return 1;\n}', 'static int ssl_get_server_cert_index(const SSL *s)\n{\n    int idx;\n    if (SSL_IS_TLS13(s)) {\n        if (s->s3->tmp.sigalg == NULL) {\n            SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);\n            return -1;\n        }\n        return s->s3->tmp.cert_idx;\n    }\n    idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);\n    if (idx == SSL_PKEY_GOST_EC) {\n        if (s->cert->pkeys[SSL_PKEY_GOST12_512].x509)\n            idx = SSL_PKEY_GOST12_512;\n        else if (s->cert->pkeys[SSL_PKEY_GOST12_256].x509)\n            idx = SSL_PKEY_GOST12_256;\n        else if (s->cert->pkeys[SSL_PKEY_GOST01].x509)\n            idx = SSL_PKEY_GOST01;\n        else\n            idx = -1;\n    }\n    if (idx == -1)\n        SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);\n    return idx;\n}']