ssl/ssl_lib.c:4396: error: BUFFER_OVERRUN_S2
  Offset: [`prefix->strlen` + 1, +oo] Size: [1, 2⋅`parameter_2_len` + 2⋅`parameter_1_len` + `prefix->strlen` + 3].
Showing all 6 steps of the trace


ssl/ssl_lib.c:4358:1: <Length trace>
4356.   }
4357.   
4358. > static int nss_keylog_int(const char *prefix,
4359.                             SSL *ssl,
4360.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4358:1: Parameter `prefix->strlen`
4356.   }
4357.   
4358. > static int nss_keylog_int(const char *prefix,
4359.                             SSL *ssl,
4360.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4381:5: Assignment
4379.        * hexadecimal, so we need a buffer that is twice their lengths.
4380.        */
4381.       prefix_len = strlen(prefix);
            ^
4382.       out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;
4383.       if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {

ssl/ssl_lib.c:4389:5: Assignment
4387.   
4388.       strcpy(cursor, prefix);
4389.       cursor += prefix_len;
            ^
4390.       *cursor++ = ' ';
4391.   

ssl/ssl_lib.c:4390:6: Assignment
4388.       strcpy(cursor, prefix);
4389.       cursor += prefix_len;
4390.       *cursor++ = ' ';
             ^
4391.   
4392.       for (i = 0; i < parameter_1_len; i++) {

ssl/ssl_lib.c:4396:5: Array access: Offset: [prefix->strlen + 1, +oo] Size: [1, 2⋅parameter_2_len + 2⋅parameter_1_len + prefix->strlen + 3]
4394.           cursor += 2;
4395.       }
4396.       *cursor++ = ' ';
            ^
4397.   
4398.       for (i = 0; i < parameter_2_len; i++) {

static int nss_keylog_int(const char *prefix,
                          SSL *ssl,
                          const uint8_t *parameter_1,
                          size_t parameter_1_len,
                          const uint8_t *parameter_2,
                          size_t parameter_2_len)
{
    char *out = NULL;
    char *cursor = NULL;
    size_t out_len = 0;
    size_t i;
    size_t prefix_len;
    if (ssl->ctx->keylog_callback == NULL) return 1;
    prefix_len = strlen(prefix);
    out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;
    if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
        SSLerr(SSL_F_NSS_KEYLOG_INT, ERR_R_MALLOC_FAILURE);
        return 0;
    }
    strcpy(cursor, prefix);
    cursor += prefix_len;
    *cursor++ = ' ';
    for (i = 0; i < parameter_1_len; i++) {
        sprintf(cursor, "%02x", parameter_1[i]);
        cursor += 2;
    }
    *cursor++ = ' ';
    for (i = 0; i < parameter_2_len; i++) {
        sprintf(cursor, "%02x", parameter_2[i]);
        cursor += 2;
    }
    *cursor = '\0';
    ssl->ctx->keylog_callback(ssl, (const char *)out);
    OPENSSL_free(out);
    return 1;
}
['static int nss_keylog_int(const char *prefix,\n                          SSL *ssl,\n                          const uint8_t *parameter_1,\n                          size_t parameter_1_len,\n                          const uint8_t *parameter_2,\n                          size_t parameter_2_len)\n{\n    char *out = NULL;\n    char *cursor = NULL;\n    size_t out_len = 0;\n    size_t i;\n    size_t prefix_len;\n    if (ssl->ctx->keylog_callback == NULL) return 1;\n    prefix_len = strlen(prefix);\n    out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;\n    if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {\n        SSLerr(SSL_F_NSS_KEYLOG_INT, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    strcpy(cursor, prefix);\n    cursor += prefix_len;\n    *cursor++ = \' \';\n    for (i = 0; i < parameter_1_len; i++) {\n        sprintf(cursor, "%02x", parameter_1[i]);\n        cursor += 2;\n    }\n    *cursor++ = \' \';\n    for (i = 0; i < parameter_2_len; i++) {\n        sprintf(cursor, "%02x", parameter_2[i]);\n        cursor += 2;\n    }\n    *cursor = \'\\0\';\n    ssl->ctx->keylog_callback(ssl, (const char *)out);\n    OPENSSL_free(out);\n    return 1;\n}']