ssl/statem/statem_srvr.c:3170: error: BUFFER_OVERRUN_S2
  Offset: [`s->method->ssl3_enc->hhlen` + 3, `s->method->ssl3_enc->hhlen` + 3] (⇐ [`s->method->ssl3_enc->hhlen` + 1, `s->method->ssl3_enc->hhlen` + 1] + 2) Size: [1, 2147483644].
Showing all 5 steps of the trace


ssl/statem/statem_srvr.c:3150:1: <Length trace>
3148.   }
3149.   
3150. > int tls_construct_cert_status(SSL *s)
3151.   {
3152.       unsigned char *p;

ssl/statem/statem_srvr.c:3150:1: Parameter `s->method->ssl3_enc->hhlen`
3148.   }
3149.   
3150. > int tls_construct_cert_status(SSL *s)
3151.   {
3152.       unsigned char *p;

ssl/statem/statem_srvr.c:3165:5: Assignment
3163.           goto err;
3164.   
3165.       p = ssl_handshake_start(s);
            ^
3166.   
3167.       /* status type */

ssl/statem/statem_srvr.c:3168:7: Assignment
3166.   
3167.       /* status type */
3168.       *(p++) = s->tlsext_status_type;
              ^
3169.       /* length of OCSP response */
3170.       l2n3(s->tlsext_ocsp_resplen, p);

ssl/statem/statem_srvr.c:3170:5: Array access: Offset: [s->method->ssl3_enc->hhlen + 3, s->method->ssl3_enc->hhlen + 3] (⇐ [s->method->ssl3_enc->hhlen + 1, s->method->ssl3_enc->hhlen + 1] + 2) Size: [1, 2147483644]
3168.       *(p++) = s->tlsext_status_type;
3169.       /* length of OCSP response */
3170.       l2n3(s->tlsext_ocsp_resplen, p);
            ^
3171.       /* actual response */
3172.       memcpy(p, s->tlsext_ocsp_resp, s->tlsext_ocsp_resplen);

int tls_construct_cert_status(SSL *s)
{
    unsigned char *p;
    size_t msglen;
    msglen = 4 + s->tlsext_ocsp_resplen;
    if (!BUF_MEM_grow(s->init_buf, SSL_HM_HEADER_LENGTH(s) + msglen))
        goto err;
    p = ssl_handshake_start(s);
    *(p++) = s->tlsext_status_type;
    l2n3(s->tlsext_ocsp_resplen, p);
    memcpy(p, s->tlsext_ocsp_resp, s->tlsext_ocsp_resplen);
    if (!ssl_set_handshake_header(s, SSL3_MT_CERTIFICATE_STATUS, msglen))
        goto err;
    return 1;
 err:
    ossl_statem_set_error(s);
    return 0;
}
['int tls_construct_cert_status(SSL *s)\n{\n    unsigned char *p;\n    size_t msglen;\n    msglen = 4 + s->tlsext_ocsp_resplen;\n    if (!BUF_MEM_grow(s->init_buf, SSL_HM_HEADER_LENGTH(s) + msglen))\n        goto err;\n    p = ssl_handshake_start(s);\n    *(p++) = s->tlsext_status_type;\n    l2n3(s->tlsext_ocsp_resplen, p);\n    memcpy(p, s->tlsext_ocsp_resp, s->tlsext_ocsp_resplen);\n    if (!ssl_set_handshake_header(s, SSL3_MT_CERTIFICATE_STATUS, msglen))\n        goto err;\n    return 1;\n err:\n    ossl_statem_set_error(s);\n    return 0;\n}']