ssl/statem/statem_clnt.c:2526: error: BUFFER_OVERRUN_L3
  Offset: 3 Size: [1, +oo] by call to `ssl_log_rsa_client_key_exchange`.
Showing all 13 steps of the trace


ssl/statem/statem_clnt.c:2476:5: Assignment
2474.       }
2475.   
2476.       pmslen = SSL_MAX_MASTER_KEY_LENGTH;
            ^
2477.       pms = OPENSSL_malloc(pmslen);
2478.       if (pms == NULL) {

ssl/statem/statem_clnt.c:2526:10: Call
2524.   
2525.       /* Log the premaster secret, if logging is enabled. */
2526.       if (!ssl_log_rsa_client_key_exchange(s, encdata, enclen, pms, pmslen))
                 ^
2527.           goto err;
2528.   

ssl/ssl_lib.c:4410:1: Parameter `premaster_len`
  4408.   }
  4409.   
  4410. > int ssl_log_rsa_client_key_exchange(SSL *ssl,
  4411.                                       const uint8_t *encrypted_premaster,
  4412.                                       size_t encrypted_premaster_len,

ssl/ssl_lib.c:4421:12: Call
  4419.       }
  4420.   
  4421.       return nss_keylog_int("RSA",
                     ^
  4422.                             ssl,
  4423.                             encrypted_premaster,

ssl/ssl_lib.c:4358:1: <Offset trace>
4356.   }
4357.   
4358. > static int nss_keylog_int(const char *prefix,
4359.                             SSL *ssl,
4360.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4358:1: Parameter `prefix->strlen`
    4356.   }
    4357.   
    4358. > static int nss_keylog_int(const char *prefix,
    4359.                             SSL *ssl,
    4360.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4358:1: <Length trace>
4356.   }
4357.   
4358. > static int nss_keylog_int(const char *prefix,
4359.                             SSL *ssl,
4360.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4358:1: Parameter `parameter_2_len`
    4356.   }
    4357.   
    4358. > static int nss_keylog_int(const char *prefix,
    4359.                             SSL *ssl,
    4360.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4382:5: Assignment
    4380.        */
    4381.       prefix_len = strlen(prefix);
    4382.       out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;
                ^
    4383.       if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
    4384.           SSLerr(SSL_F_NSS_KEYLOG_INT, ERR_R_MALLOC_FAILURE);

ssl/ssl_lib.c:4383:25: Call
    4381.       prefix_len = strlen(prefix);
    4382.       out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;
    4383.       if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
                                    ^
    4384.           SSLerr(SSL_F_NSS_KEYLOG_INT, ERR_R_MALLOC_FAILURE);
    4385.           return 0;

crypto/mem.c:166:9: Assignment
      164.   
      165.       if (num <= 0)
      166.           return NULL;
                     ^
      167.   
      168.       FAILTEST();

ssl/ssl_lib.c:4383:16: Assignment
    4381.       prefix_len = strlen(prefix);
    4382.       out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;
    4383.       if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
                           ^
    4384.           SSLerr(SSL_F_NSS_KEYLOG_INT, ERR_R_MALLOC_FAILURE);
    4385.           return 0;

ssl/ssl_lib.c:4388:5: Array access: Offset: 3 Size: [1, +oo] by call to `ssl_log_rsa_client_key_exchange` 
    4386.       }
    4387.   
    4388.       strcpy(cursor, prefix);
                ^
    4389.       cursor += prefix_len;
    4390.       *cursor++ = ' ';

static int nss_keylog_int(const char *prefix,
                          SSL *ssl,
                          const uint8_t *parameter_1,
                          size_t parameter_1_len,
                          const uint8_t *parameter_2,
                          size_t parameter_2_len)
{
    char *out = NULL;
    char *cursor = NULL;
    size_t out_len = 0;
    size_t i;
    size_t prefix_len;
    if (ssl->ctx->keylog_callback == NULL) return 1;
    prefix_len = strlen(prefix);
    out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;
    if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
        SSLerr(SSL_F_NSS_KEYLOG_INT, ERR_R_MALLOC_FAILURE);
        return 0;
    }
    strcpy(cursor, prefix);
    cursor += prefix_len;
    *cursor++ = ' ';
    for (i = 0; i < parameter_1_len; i++) {
        sprintf(cursor, "%02x", parameter_1[i]);
        cursor += 2;
    }
    *cursor++ = ' ';
    for (i = 0; i < parameter_2_len; i++) {
        sprintf(cursor, "%02x", parameter_2[i]);
        cursor += 2;
    }
    *cursor = '\0';
    ssl->ctx->keylog_callback(ssl, (const char *)out);
    OPENSSL_free(out);
    return 1;
}
['static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt, int *al)\n{\n#ifndef OPENSSL_NO_RSA\n    unsigned char *encdata = NULL;\n    EVP_PKEY *pkey = NULL;\n    EVP_PKEY_CTX *pctx = NULL;\n    size_t enclen;\n    unsigned char *pms = NULL;\n    size_t pmslen = 0;\n    if (s->session->peer == NULL) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    pkey = X509_get0_pubkey(s->session->peer);\n    if (EVP_PKEY_get0_RSA(pkey) == NULL) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    pmslen = SSL_MAX_MASTER_KEY_LENGTH;\n    pms = OPENSSL_malloc(pmslen);\n    if (pms == NULL) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_MALLOC_FAILURE);\n        *al = SSL_AD_INTERNAL_ERROR;\n        return 0;\n    }\n    pms[0] = s->client_version >> 8;\n    pms[1] = s->client_version & 0xff;\n    if (RAND_bytes(pms + 2, (int)(pmslen - 2)) <= 0) {\n        goto err;\n    }\n    if (s->version > SSL3_VERSION && !WPACKET_start_sub_packet_u16(pkt)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    pctx = EVP_PKEY_CTX_new(pkey, NULL);\n    if (pctx == NULL || EVP_PKEY_encrypt_init(pctx) <= 0\n        || EVP_PKEY_encrypt(pctx, NULL, &enclen, pms, pmslen) <= 0) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_EVP_LIB);\n        goto err;\n    }\n    if (!WPACKET_allocate_bytes(pkt, enclen, &encdata)\n            || EVP_PKEY_encrypt(pctx, encdata, &enclen, pms, pmslen) <= 0) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, SSL_R_BAD_RSA_ENCRYPT);\n        goto err;\n    }\n    EVP_PKEY_CTX_free(pctx);\n    pctx = NULL;\n# ifdef PKCS1_CHECK\n    if (s->options & SSL_OP_PKCS1_CHECK_1)\n        (*p)[1]++;\n    if (s->options & SSL_OP_PKCS1_CHECK_2)\n        tmp_buf[0] = 0x70;\n# endif\n    if (s->version > SSL3_VERSION && !WPACKET_close(pkt)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    s->s3->tmp.pms = pms;\n    s->s3->tmp.pmslen = pmslen;\n    if (!ssl_log_rsa_client_key_exchange(s, encdata, enclen, pms, pmslen))\n        goto err;\n    return 1;\n err:\n    OPENSSL_clear_free(pms, pmslen);\n    EVP_PKEY_CTX_free(pctx);\n    return 0;\n#else\n    SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);\n    *al = SSL_AD_INTERNAL_ERROR;\n    return 0;\n#endif\n}', 'int ssl_log_rsa_client_key_exchange(SSL *ssl,\n                                    const uint8_t *encrypted_premaster,\n                                    size_t encrypted_premaster_len,\n                                    const uint8_t *premaster,\n                                    size_t premaster_len)\n{\n    if (encrypted_premaster_len < 8) {\n        SSLerr(SSL_F_SSL_LOG_RSA_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    return nss_keylog_int("RSA",\n                          ssl,\n                          encrypted_premaster,\n                          encrypted_premaster_len,\n                          premaster,\n                          premaster_len);\n}', 'static int nss_keylog_int(const char *prefix,\n                          SSL *ssl,\n                          const uint8_t *parameter_1,\n                          size_t parameter_1_len,\n                          const uint8_t *parameter_2,\n                          size_t parameter_2_len)\n{\n    char *out = NULL;\n    char *cursor = NULL;\n    size_t out_len = 0;\n    size_t i;\n    size_t prefix_len;\n    if (ssl->ctx->keylog_callback == NULL) return 1;\n    prefix_len = strlen(prefix);\n    out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;\n    if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {\n        SSLerr(SSL_F_NSS_KEYLOG_INT, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    strcpy(cursor, prefix);\n    cursor += prefix_len;\n    *cursor++ = \' \';\n    for (i = 0; i < parameter_1_len; i++) {\n        sprintf(cursor, "%02x", parameter_1[i]);\n        cursor += 2;\n    }\n    *cursor++ = \' \';\n    for (i = 0; i < parameter_2_len; i++) {\n        sprintf(cursor, "%02x", parameter_2[i]);\n        cursor += 2;\n    }\n    *cursor = \'\\0\';\n    ssl->ctx->keylog_callback(ssl, (const char *)out);\n    OPENSSL_free(out);\n    return 1;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num <= 0)\n        return NULL;\n    FAILTEST();\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    osslargused(file); osslargused(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']