ssl/ssl_rsa.c:971: error: BUFFER_OVERRUN_L3
  Offset: 7 Size: [1, 2147483644].
Showing all 4 steps of the trace


ssl/ssl_rsa.c:920:13: <Length trace>
918.   
919.       for (num_extensions = 0;; num_extensions++) {
920.           if (PEM_read_bio(bin, &name, &header, &extension, &extension_length)
                   ^
921.               == 0) {
922.               /*

ssl/ssl_rsa.c:920:13: Call
918.   
919.       for (num_extensions = 0;; num_extensions++) {
920.           if (PEM_read_bio(bin, &name, &header, &extension, &extension_length)
                   ^
921.               == 0) {
922.               /*

crypto/pem/pem_lib.c:664:1: Parameter `**data`
  662.   #endif
  663.   
  664. > int PEM_read_bio(BIO *bp, char **name, char **header, unsigned char **data,
  665.                    long *len)
  666.   {

ssl/ssl_rsa.c:971:46: Array access: Offset: 7 Size: [1, 2147483644]
969.               /* 8 byte header: 4 bytes context, 2 bytes type, 2 bytes len */
970.               if (extension_length < 8
971.                       || (extension[6] << 8) + extension[7]
                                                    ^
972.                          != extension_length - 8) {
973.                   SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, SSL_R_BAD_DATA);

int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file)
{
    unsigned char *serverinfo = NULL;
    unsigned char *tmp;
    size_t serverinfo_length = 0;
    unsigned char *extension = 0;
    long extension_length = 0;
    char *name = NULL;
    char *header = NULL;
    char namePrefix1[] = "SERVERINFO FOR ";
    char namePrefix2[] = "SERVERINFOV2 FOR ";
    int ret = 0;
    BIO *bin = NULL;
    size_t num_extensions = 0, contextoff = 0;
    unsigned int version;
    if (ctx == NULL || file == NULL) {
        SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_PASSED_NULL_PARAMETER);
        goto end;
    }
    bin = BIO_new(BIO_s_file());
    if (bin == NULL) {
        SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_BUF_LIB);
        goto end;
    }
    if (BIO_read_filename(bin, file) <= 0) {
        SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_SYS_LIB);
        goto end;
    }
    for (num_extensions = 0;; num_extensions++) {
        if (PEM_read_bio(bin, &name, &header, &extension, &extension_length)
            == 0) {
            if (num_extensions == 0) {
                SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE,
                       SSL_R_NO_PEM_EXTENSIONS);
                goto end;
            } else
                break;
        }
        if (strlen(name) < strlen(namePrefix1)) {
            SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, SSL_R_PEM_NAME_TOO_SHORT);
            goto end;
        }
        if (strncmp(name, namePrefix1, strlen(namePrefix1)) == 0) {
            version = SERVERINFOV1;
        } else {
            if (strlen(name) < strlen(namePrefix2)) {
                SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE,
                       SSL_R_PEM_NAME_TOO_SHORT);
                goto end;
            }
            if (strncmp(name, namePrefix2, strlen(namePrefix2)) != 0) {
                SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE,
                       SSL_R_PEM_NAME_BAD_PREFIX);
                goto end;
            }
            version = SERVERINFOV2;
        }
        if (version == SERVERINFOV1) {
            if (extension_length < 4
                    || (extension[2] << 8) + extension[3]
                       != extension_length - 4) {
                SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, SSL_R_BAD_DATA);
                goto end;
            }
            contextoff = 4;
        } else {
            if (extension_length < 8
                    || (extension[6] << 8) + extension[7]
                       != extension_length - 8) {
                SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, SSL_R_BAD_DATA);
                goto end;
            }
        }
        tmp = OPENSSL_realloc(serverinfo, serverinfo_length + extension_length
                                          + contextoff);
        if (tmp == NULL) {
            SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_MALLOC_FAILURE);
            goto end;
        }
        serverinfo = tmp;
        if (contextoff > 0) {
            unsigned int synthcontext = SSL_EXT_CLIENT_HELLO
                                        | SSL_EXT_TLS1_2_SERVER_HELLO;
            unsigned char *sinfo = serverinfo + serverinfo_length;
            sinfo[0] = 0;
            sinfo[1] = 0;
            sinfo[2] = (synthcontext >> 8) & 0xff;
            sinfo[3] = synthcontext & 0xff;
        }
        memcpy(serverinfo + serverinfo_length + contextoff,
               extension, extension_length);
        serverinfo_length += extension_length + contextoff;
        OPENSSL_free(name);
        name = NULL;
        OPENSSL_free(header);
        header = NULL;
        OPENSSL_free(extension);
        extension = NULL;
    }
    ret = SSL_CTX_use_serverinfo_ex(ctx, version, serverinfo,
                                    serverinfo_length);
 end:
    OPENSSL_free(name);
    OPENSSL_free(header);
    OPENSSL_free(extension);
    OPENSSL_free(serverinfo);
    BIO_free(bin);
    return ret;
}
['int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file)\n{\n    unsigned char *serverinfo = NULL;\n    unsigned char *tmp;\n    size_t serverinfo_length = 0;\n    unsigned char *extension = 0;\n    long extension_length = 0;\n    char *name = NULL;\n    char *header = NULL;\n    char namePrefix1[] = "SERVERINFO FOR ";\n    char namePrefix2[] = "SERVERINFOV2 FOR ";\n    int ret = 0;\n    BIO *bin = NULL;\n    size_t num_extensions = 0, contextoff = 0;\n    unsigned int version;\n    if (ctx == NULL || file == NULL) {\n        SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_PASSED_NULL_PARAMETER);\n        goto end;\n    }\n    bin = BIO_new(BIO_s_file());\n    if (bin == NULL) {\n        SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_BUF_LIB);\n        goto end;\n    }\n    if (BIO_read_filename(bin, file) <= 0) {\n        SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_SYS_LIB);\n        goto end;\n    }\n    for (num_extensions = 0;; num_extensions++) {\n        if (PEM_read_bio(bin, &name, &header, &extension, &extension_length)\n            == 0) {\n            if (num_extensions == 0) {\n                SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE,\n                       SSL_R_NO_PEM_EXTENSIONS);\n                goto end;\n            } else\n                break;\n        }\n        if (strlen(name) < strlen(namePrefix1)) {\n            SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, SSL_R_PEM_NAME_TOO_SHORT);\n            goto end;\n        }\n        if (strncmp(name, namePrefix1, strlen(namePrefix1)) == 0) {\n            version = SERVERINFOV1;\n        } else {\n            if (strlen(name) < strlen(namePrefix2)) {\n                SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE,\n                       SSL_R_PEM_NAME_TOO_SHORT);\n                goto end;\n            }\n            if (strncmp(name, namePrefix2, strlen(namePrefix2)) != 0) {\n                SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE,\n                       SSL_R_PEM_NAME_BAD_PREFIX);\n                goto end;\n            }\n            version = SERVERINFOV2;\n        }\n        if (version == SERVERINFOV1) {\n            if (extension_length < 4\n                    || (extension[2] << 8) + extension[3]\n                       != extension_length - 4) {\n                SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, SSL_R_BAD_DATA);\n                goto end;\n            }\n            contextoff = 4;\n        } else {\n            if (extension_length < 8\n                    || (extension[6] << 8) + extension[7]\n                       != extension_length - 8) {\n                SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, SSL_R_BAD_DATA);\n                goto end;\n            }\n        }\n        tmp = OPENSSL_realloc(serverinfo, serverinfo_length + extension_length\n                                          + contextoff);\n        if (tmp == NULL) {\n            SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_MALLOC_FAILURE);\n            goto end;\n        }\n        serverinfo = tmp;\n        if (contextoff > 0) {\n            unsigned int synthcontext = SSL_EXT_CLIENT_HELLO\n                                        | SSL_EXT_TLS1_2_SERVER_HELLO;\n            unsigned char *sinfo = serverinfo + serverinfo_length;\n            sinfo[0] = 0;\n            sinfo[1] = 0;\n            sinfo[2] = (synthcontext >> 8) & 0xff;\n            sinfo[3] = synthcontext & 0xff;\n        }\n        memcpy(serverinfo + serverinfo_length + contextoff,\n               extension, extension_length);\n        serverinfo_length += extension_length + contextoff;\n        OPENSSL_free(name);\n        name = NULL;\n        OPENSSL_free(header);\n        header = NULL;\n        OPENSSL_free(extension);\n        extension = NULL;\n    }\n    ret = SSL_CTX_use_serverinfo_ex(ctx, version, serverinfo,\n                                    serverinfo_length);\n end:\n    OPENSSL_free(name);\n    OPENSSL_free(header);\n    OPENSSL_free(extension);\n    OPENSSL_free(serverinfo);\n    BIO_free(bin);\n    return ret;\n}', 'int PEM_read_bio(BIO *bp, char **name, char **header, unsigned char **data,\n                 long *len)\n{\n    EVP_ENCODE_CTX *ctx = EVP_ENCODE_CTX_new();\n    int end = 0, i, k, bl = 0, hl = 0, nohead = 0;\n    char buf[256];\n    BUF_MEM *nameB;\n    BUF_MEM *headerB;\n    BUF_MEM *dataB, *tmpB;\n    if (ctx == NULL) {\n        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n        return (0);\n    }\n    nameB = BUF_MEM_new();\n    headerB = BUF_MEM_new();\n    dataB = BUF_MEM_new();\n    if ((nameB == NULL) || (headerB == NULL) || (dataB == NULL)) {\n        goto err;\n    }\n    buf[254] = \'\\0\';\n    for (;;) {\n        i = BIO_gets(bp, buf, 254);\n        if (i <= 0) {\n            PEMerr(PEM_F_PEM_READ_BIO, PEM_R_NO_START_LINE);\n            goto err;\n        }\n        while ((i >= 0) && (buf[i] <= \' \'))\n            i--;\n        buf[++i] = \'\\n\';\n        buf[++i] = \'\\0\';\n        if (strncmp(buf, "-----BEGIN ", 11) == 0) {\n            i = strlen(&(buf[11]));\n            if (strncmp(&(buf[11 + i - 6]), "-----\\n", 6) != 0)\n                continue;\n            if (!BUF_MEM_grow(nameB, i + 9)) {\n                PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            memcpy(nameB->data, &(buf[11]), i - 6);\n            nameB->data[i - 6] = \'\\0\';\n            break;\n        }\n    }\n    hl = 0;\n    if (!BUF_MEM_grow(headerB, 256)) {\n        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    headerB->data[0] = \'\\0\';\n    for (;;) {\n        i = BIO_gets(bp, buf, 254);\n        if (i <= 0)\n            break;\n        while ((i >= 0) && (buf[i] <= \' \'))\n            i--;\n        buf[++i] = \'\\n\';\n        buf[++i] = \'\\0\';\n        if (buf[0] == \'\\n\')\n            break;\n        if (!BUF_MEM_grow(headerB, hl + i + 9)) {\n            PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        if (strncmp(buf, "-----END ", 9) == 0) {\n            nohead = 1;\n            break;\n        }\n        memcpy(&(headerB->data[hl]), buf, i);\n        headerB->data[hl + i] = \'\\0\';\n        hl += i;\n    }\n    bl = 0;\n    if (!BUF_MEM_grow(dataB, 1024)) {\n        PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    dataB->data[0] = \'\\0\';\n    if (!nohead) {\n        for (;;) {\n            i = BIO_gets(bp, buf, 254);\n            if (i <= 0)\n                break;\n            while ((i >= 0) && (buf[i] <= \' \'))\n                i--;\n            buf[++i] = \'\\n\';\n            buf[++i] = \'\\0\';\n            if (i != 65)\n                end = 1;\n            if (strncmp(buf, "-----END ", 9) == 0)\n                break;\n            if (i > 65)\n                break;\n            if (!BUF_MEM_grow_clean(dataB, i + bl + 9)) {\n                PEMerr(PEM_F_PEM_READ_BIO, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            memcpy(&(dataB->data[bl]), buf, i);\n            dataB->data[bl + i] = \'\\0\';\n            bl += i;\n            if (end) {\n                buf[0] = \'\\0\';\n                i = BIO_gets(bp, buf, 254);\n                if (i <= 0)\n                    break;\n                while ((i >= 0) && (buf[i] <= \' \'))\n                    i--;\n                buf[++i] = \'\\n\';\n                buf[++i] = \'\\0\';\n                break;\n            }\n        }\n    } else {\n        tmpB = headerB;\n        headerB = dataB;\n        dataB = tmpB;\n        bl = hl;\n    }\n    i = strlen(nameB->data);\n    if ((strncmp(buf, "-----END ", 9) != 0) ||\n        (strncmp(nameB->data, &(buf[9]), i) != 0) ||\n        (strncmp(&(buf[9 + i]), "-----\\n", 6) != 0)) {\n        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_END_LINE);\n        goto err;\n    }\n    EVP_DecodeInit(ctx);\n    i = EVP_DecodeUpdate(ctx,\n                         (unsigned char *)dataB->data, &bl,\n                         (unsigned char *)dataB->data, bl);\n    if (i < 0) {\n        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_BASE64_DECODE);\n        goto err;\n    }\n    i = EVP_DecodeFinal(ctx, (unsigned char *)&(dataB->data[bl]), &k);\n    if (i < 0) {\n        PEMerr(PEM_F_PEM_READ_BIO, PEM_R_BAD_BASE64_DECODE);\n        goto err;\n    }\n    bl += k;\n    if (bl == 0)\n        goto err;\n    *name = nameB->data;\n    *header = headerB->data;\n    *data = (unsigned char *)dataB->data;\n    *len = bl;\n    OPENSSL_free(nameB);\n    OPENSSL_free(headerB);\n    OPENSSL_free(dataB);\n    EVP_ENCODE_CTX_free(ctx);\n    return (1);\n err:\n    BUF_MEM_free(nameB);\n    BUF_MEM_free(headerB);\n    BUF_MEM_free(dataB);\n    EVP_ENCODE_CTX_free(ctx);\n    return (0);\n}']