ssl/ssl_rsa.c:850: error: BUFFER_OVERRUN_L3
  Offset added: [48, +oo] (⇐ [0, +oo] + 48) Size: [1, +oo] by call to `serverinfo_process_buffer`.
Showing all 11 steps of the trace


ssl/ssl_rsa.c:850:10: Call
848.           return 0;
849.       }
850.       if (!serverinfo_process_buffer(serverinfo, serverinfo_length, NULL)) {
                ^
851.           SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO, SSL_R_INVALID_SERVERINFO_DATA);
852.           return 0;

ssl/ssl_rsa.c:782:1: Parameter `ctx->cert->srv_ext.meths_count`
  780.    * the included extensions.
  781.    */
  782. > static int serverinfo_process_buffer(const unsigned char *serverinfo,
  783.                                        size_t serverinfo_length, SSL_CTX *ctx)
  784.   {

ssl/ssl_rsa.c:815:35: Call
  813.               }
  814.   
  815.               if (!have_ext_cbs && !SSL_CTX_add_server_custom_ext(ctx, ext_type,
                                           ^
  816.                                                                   serverinfo_srv_add_cb,
  817.                                                                   NULL, NULL,

ssl/t1_ext.c:225:1: Parameter `ctx->cert->srv_ext.meths_count`
    223.   }
    224.   
    225. > int SSL_CTX_add_server_custom_ext(SSL_CTX *ctx, unsigned int ext_type,
    226.                                     custom_ext_add_cb add_cb,
    227.                                     custom_ext_free_cb free_cb,

ssl/t1_ext.c:231:12: Call
    229.                                     custom_ext_parse_cb parse_cb, void *parse_arg)
    230.   {
    231.       return custom_ext_meth_add(&ctx->cert->srv_ext, ext_type,
                      ^
    232.                                  add_cb, free_cb, add_arg, parse_cb, parse_arg);
    233.   }

ssl/t1_ext.c:152:1: <Length trace>
150.   
151.   /* Set callbacks for a custom extension. */
152. > static int custom_ext_meth_add(custom_ext_methods *exts,
153.                                  unsigned int ext_type,
154.                                  custom_ext_add_cb add_cb,

ssl/t1_ext.c:152:1: Parameter `exts->meths_count`
      150.   
      151.   /* Set callbacks for a custom extension. */
      152. > static int custom_ext_meth_add(custom_ext_methods *exts,
      153.                                  unsigned int ext_type,
      154.                                  custom_ext_add_cb add_cb,

ssl/t1_ext.c:177:9: Call
      175.           return 0;
      176.       /* Search for duplicate */
      177.       if (custom_ext_find(exts, ext_type))
                     ^
      178.           return 0;
      179.       tmp = OPENSSL_realloc(exts->meths,

ssl/t1_ext.c:16:1: Parameter `exts->meths_count`
        14.   
        15.   /* Find a custom extension from the list. */
        16. > static custom_ext_method *custom_ext_find(const custom_ext_methods *exts,
        17.                                             unsigned int ext_type)
        18.   {

ssl/t1_ext.c:186:5: Assignment
      184.   
      185.       exts->meths = tmp;
      186.       meth = exts->meths + exts->meths_count;
                 ^
      187.       memset(meth, 0, sizeof(*meth));
      188.       meth->parse_cb = parse_cb;

ssl/t1_ext.c:187:5: Array access: Offset added: [48, +oo] (⇐ [0, +oo] + 48) Size: [1, +oo] by call to `serverinfo_process_buffer` 
      185.       exts->meths = tmp;
      186.       meth = exts->meths + exts->meths_count;
      187.       memset(meth, 0, sizeof(*meth));
                 ^
      188.       meth->parse_cb = parse_cb;
      189.       meth->add_cb = add_cb;

static int custom_ext_meth_add(custom_ext_methods *exts,
                               unsigned int ext_type,
                               custom_ext_add_cb add_cb,
                               custom_ext_free_cb free_cb,
                               void *add_arg,
                               custom_ext_parse_cb parse_cb, void *parse_arg)
{
    custom_ext_method *meth, *tmp;
    if (!add_cb && free_cb)
        return 0;
    if (SSL_extension_supported(ext_type) &&
        ext_type != TLSEXT_TYPE_signed_certificate_timestamp)
        return 0;
    if (ext_type > 0xffff)
        return 0;
    if (custom_ext_find(exts, ext_type))
        return 0;
    tmp = OPENSSL_realloc(exts->meths,
                          (exts->meths_count + 1) * sizeof(custom_ext_method));
    if (tmp == NULL)
        return 0;
    exts->meths = tmp;
    meth = exts->meths + exts->meths_count;
    memset(meth, 0, sizeof(*meth));
    meth->parse_cb = parse_cb;
    meth->add_cb = add_cb;
    meth->free_cb = free_cb;
    meth->ext_type = ext_type;
    meth->add_arg = add_arg;
    meth->parse_arg = parse_arg;
    exts->meths_count++;
    return 1;
}
['int SSL_CTX_use_serverinfo(SSL_CTX *ctx, const unsigned char *serverinfo,\n                           size_t serverinfo_length)\n{\n    unsigned char *new_serverinfo;\n    if (ctx == NULL || serverinfo == NULL || serverinfo_length == 0) {\n        SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO, ERR_R_PASSED_NULL_PARAMETER);\n        return 0;\n    }\n    if (!serverinfo_process_buffer(serverinfo, serverinfo_length, NULL)) {\n        SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO, SSL_R_INVALID_SERVERINFO_DATA);\n        return 0;\n    }\n    if (ctx->cert->key == NULL) {\n        SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    new_serverinfo = OPENSSL_realloc(ctx->cert->key->serverinfo,\n                                     serverinfo_length);\n    if (new_serverinfo == NULL) {\n        SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    ctx->cert->key->serverinfo = new_serverinfo;\n    memcpy(ctx->cert->key->serverinfo, serverinfo, serverinfo_length);\n    ctx->cert->key->serverinfo_length = serverinfo_length;\n    if (!serverinfo_process_buffer(serverinfo, serverinfo_length, ctx)) {\n        SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO, SSL_R_INVALID_SERVERINFO_DATA);\n        return 0;\n    }\n    return 1;\n}', 'static int serverinfo_process_buffer(const unsigned char *serverinfo,\n                                     size_t serverinfo_length, SSL_CTX *ctx)\n{\n    if (serverinfo == NULL || serverinfo_length == 0)\n        return 0;\n    for (;;) {\n        unsigned int ext_type = 0;\n        size_t len = 0;\n        if (serverinfo_length == 0)\n            return 1;\n        if (serverinfo_length < 2)\n            return 0;\n        ext_type = (serverinfo[0] << 8) + serverinfo[1];\n        if (ctx) {\n            int have_ext_cbs = 0;\n            size_t i;\n            custom_ext_methods *exts = &ctx->cert->srv_ext;\n            custom_ext_method *meth = exts->meths;\n            for (i = 0; i < exts->meths_count; i++, meth++) {\n                if (ext_type == meth->ext_type) {\n                    have_ext_cbs = 1;\n                    break;\n                }\n            }\n            if (!have_ext_cbs && !SSL_CTX_add_server_custom_ext(ctx, ext_type,\n                                                                serverinfo_srv_add_cb,\n                                                                NULL, NULL,\n                                                                serverinfo_srv_parse_cb,\n                                                                NULL))\n                return 0;\n        }\n        serverinfo += 2;\n        serverinfo_length -= 2;\n        if (serverinfo_length < 2)\n            return 0;\n        len = (serverinfo[0] << 8) + serverinfo[1];\n        serverinfo += 2;\n        serverinfo_length -= 2;\n        if (len > serverinfo_length)\n            return 0;\n        serverinfo += len;\n        serverinfo_length -= len;\n    }\n}', 'int SSL_CTX_add_server_custom_ext(SSL_CTX *ctx, unsigned int ext_type,\n                                  custom_ext_add_cb add_cb,\n                                  custom_ext_free_cb free_cb,\n                                  void *add_arg,\n                                  custom_ext_parse_cb parse_cb, void *parse_arg)\n{\n    return custom_ext_meth_add(&ctx->cert->srv_ext, ext_type,\n                               add_cb, free_cb, add_arg, parse_cb, parse_arg);\n}', 'static int custom_ext_meth_add(custom_ext_methods *exts,\n                               unsigned int ext_type,\n                               custom_ext_add_cb add_cb,\n                               custom_ext_free_cb free_cb,\n                               void *add_arg,\n                               custom_ext_parse_cb parse_cb, void *parse_arg)\n{\n    custom_ext_method *meth, *tmp;\n    if (!add_cb && free_cb)\n        return 0;\n    if (SSL_extension_supported(ext_type) &&\n        ext_type != TLSEXT_TYPE_signed_certificate_timestamp)\n        return 0;\n    if (ext_type > 0xffff)\n        return 0;\n    if (custom_ext_find(exts, ext_type))\n        return 0;\n    tmp = OPENSSL_realloc(exts->meths,\n                          (exts->meths_count + 1) * sizeof(custom_ext_method));\n    if (tmp == NULL)\n        return 0;\n    exts->meths = tmp;\n    meth = exts->meths + exts->meths_count;\n    memset(meth, 0, sizeof(*meth));\n    meth->parse_cb = parse_cb;\n    meth->add_cb = add_cb;\n    meth->free_cb = free_cb;\n    meth->ext_type = ext_type;\n    meth->add_arg = add_arg;\n    meth->parse_arg = parse_arg;\n    exts->meths_count++;\n    return 1;\n}', 'static custom_ext_method *custom_ext_find(const custom_ext_methods *exts,\n                                          unsigned int ext_type)\n{\n    size_t i;\n    custom_ext_method *meth = exts->meths;\n    for (i = 0; i < exts->meths_count; i++, meth++) {\n        if (ext_type == meth->ext_type)\n            return meth;\n    }\n    return NULL;\n}']