ssl/record/ssl3_record.c:936: error: BUFFER_OVERRUN_L3
  Offset added: [1, 15] Size: [0, +oo] by call to `ssl_randbytes`.
Showing all 11 steps of the trace


ssl/record/ssl3_record.c:925:17: Assignment
923.                   ivlen = EVP_CIPHER_iv_length(enc);
924.               else
925.                   ivlen = 0;
                       ^
926.               if (ivlen > 1) {
927.                   for (ctr = 0; ctr < n_recs; ctr++) {

ssl/record/ssl3_record.c:936:32: Call
934.                                    ERR_R_INTERNAL_ERROR);
935.                           return -1;
936.                       } else if (ssl_randbytes(s, recs[ctr].input, ivlen) <= 0) {
                                      ^
937.                           SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_ENC,
938.                                    ERR_R_INTERNAL_ERROR);

ssl/ssl_lib.c:5172:1: Parameter `size`
  5170.   }
  5171.   
  5172. > int ssl_randbytes(SSL *s, unsigned char *rnd, size_t size)
  5173.   {
  5174.       if (s->drbg != NULL) {

ssl/ssl_lib.c:5187:17: Call
  5185.            * here.
  5186.            */
  5187.            return RAND_DRBG_generate(s->drbg, rnd, size, 0, NULL, 0);
                          ^
  5188.       }
  5189.       return RAND_bytes(rnd, (int)size);

crypto/rand/drbg_lib.c:363:1: Parameter `outlen`
    361.    *
    362.    */
    363. > int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,
    364.                          int prediction_resistance,
    365.                          const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_lib.c:409:10: Call
    407.       }
    408.   
    409.       if (!ctr_generate(drbg, out, outlen, adin, adinlen)) {
                    ^
    410.           drbg->state = DRBG_ERROR;
    411.           RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);

crypto/rand/drbg_rand.c:266:1: <Offset trace>
264.   }
265.   
266. > int ctr_generate(RAND_DRBG *drbg,
267.                    unsigned char *out, size_t outlen,
268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: Parameter `outlen`
      264.   }
      265.   
      266. > int ctr_generate(RAND_DRBG *drbg,
      267.                    unsigned char *out, size_t outlen,
      268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: <Length trace>
264.   }
265.   
266. > int ctr_generate(RAND_DRBG *drbg,
267.                    unsigned char *out, size_t outlen,
268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: Parameter `drbg->ctr.K[*]`
      264.   }
      265.   
      266. > int ctr_generate(RAND_DRBG *drbg,
      267.                    unsigned char *out, size_t outlen,
      268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:288:13: Array access: Offset added: [1, 15] Size: [0, +oo] by call to `ssl_randbytes` 
      286.               /* Use K as temp space as it will be updated */
      287.               AES_encrypt(ctr->V, ctr->K, &ctr->ks);
      288.               memcpy(out, ctr->K, outlen);
                         ^
      289.               break;
      290.           }

int ctr_generate(RAND_DRBG *drbg,
                 unsigned char *out, size_t outlen,
                 const unsigned char *adin, size_t adinlen)
{
    RAND_DRBG_CTR *ctr = &drbg->ctr;
    if (adin != NULL && adinlen != 0) {
        ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);
        if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) {
            adin = NULL;
            adinlen = 1;
        }
    } else {
        adinlen = 0;
    }
    for ( ; ; ) {
        inc_128(ctr);
        if (outlen < 16) {
            AES_encrypt(ctr->V, ctr->K, &ctr->ks);
            memcpy(out, ctr->K, outlen);
            break;
        }
        AES_encrypt(ctr->V, out, &ctr->ks);
        out += 16;
        outlen -= 16;
        if (outlen == 0)
            break;
    }
    ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);
    return 1;
}
['int tls1_enc(SSL *s, SSL3_RECORD *recs, size_t n_recs, int sending)\n{\n    EVP_CIPHER_CTX *ds;\n    size_t reclen[SSL_MAX_PIPELINES];\n    unsigned char buf[SSL_MAX_PIPELINES][EVP_AEAD_TLS1_AAD_LEN];\n    int i, pad = 0, ret, tmpr;\n    size_t bs, mac_size = 0, ctr, padnum, loop;\n    unsigned char padval;\n    int imac_size;\n    const EVP_CIPHER *enc;\n    if (n_recs == 0) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_ENC,\n                 ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    if (sending) {\n        if (EVP_MD_CTX_md(s->write_hash)) {\n            int n = EVP_MD_CTX_size(s->write_hash);\n            if (!ossl_assert(n >= 0)) {\n                SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_ENC,\n                         ERR_R_INTERNAL_ERROR);\n                return -1;\n            }\n        }\n        ds = s->enc_write_ctx;\n        if (s->enc_write_ctx == NULL)\n            enc = NULL;\n        else {\n            int ivlen;\n            enc = EVP_CIPHER_CTX_cipher(s->enc_write_ctx);\n            if (SSL_USE_EXPLICIT_IV(s)\n                && EVP_CIPHER_mode(enc) == EVP_CIPH_CBC_MODE)\n                ivlen = EVP_CIPHER_iv_length(enc);\n            else\n                ivlen = 0;\n            if (ivlen > 1) {\n                for (ctr = 0; ctr < n_recs; ctr++) {\n                    if (recs[ctr].data != recs[ctr].input) {\n                        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_ENC,\n                                 ERR_R_INTERNAL_ERROR);\n                        return -1;\n                    } else if (ssl_randbytes(s, recs[ctr].input, ivlen) <= 0) {\n                        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_ENC,\n                                 ERR_R_INTERNAL_ERROR);\n                        return -1;\n                    }\n                }\n            }\n        }\n    } else {\n        if (EVP_MD_CTX_md(s->read_hash)) {\n            int n = EVP_MD_CTX_size(s->read_hash);\n            if (!ossl_assert(n >= 0)) {\n                SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_ENC,\n                         ERR_R_INTERNAL_ERROR);\n                return -1;\n            }\n        }\n        ds = s->enc_read_ctx;\n        if (s->enc_read_ctx == NULL)\n            enc = NULL;\n        else\n            enc = EVP_CIPHER_CTX_cipher(s->enc_read_ctx);\n    }\n    if ((s->session == NULL) || (ds == NULL) || (enc == NULL)) {\n        for (ctr = 0; ctr < n_recs; ctr++) {\n            memmove(recs[ctr].data, recs[ctr].input, recs[ctr].length);\n            recs[ctr].input = recs[ctr].data;\n        }\n        ret = 1;\n    } else {\n        bs = EVP_CIPHER_block_size(EVP_CIPHER_CTX_cipher(ds));\n        if (n_recs > 1) {\n            if (!(EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ds))\n                  & EVP_CIPH_FLAG_PIPELINE)) {\n                SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_ENC,\n                         SSL_R_PIPELINE_FAILURE);\n                return -1;\n            }\n        }\n        for (ctr = 0; ctr < n_recs; ctr++) {\n            reclen[ctr] = recs[ctr].length;\n            if (EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ds))\n                & EVP_CIPH_FLAG_AEAD_CIPHER) {\n                unsigned char *seq;\n                seq = sending ? RECORD_LAYER_get_write_sequence(&s->rlayer)\n                    : RECORD_LAYER_get_read_sequence(&s->rlayer);\n                if (SSL_IS_DTLS(s)) {\n                    unsigned char dtlsseq[9], *p = dtlsseq;\n                    s2n(sending ? DTLS_RECORD_LAYER_get_w_epoch(&s->rlayer) :\n                        DTLS_RECORD_LAYER_get_r_epoch(&s->rlayer), p);\n                    memcpy(p, &seq[2], 6);\n                    memcpy(buf[ctr], dtlsseq, 8);\n                } else {\n                    memcpy(buf[ctr], seq, 8);\n                    for (i = 7; i >= 0; i--) {\n                        ++seq[i];\n                        if (seq[i] != 0)\n                            break;\n                    }\n                }\n                buf[ctr][8] = recs[ctr].type;\n                buf[ctr][9] = (unsigned char)(s->version >> 8);\n                buf[ctr][10] = (unsigned char)(s->version);\n                buf[ctr][11] = (unsigned char)(recs[ctr].length >> 8);\n                buf[ctr][12] = (unsigned char)(recs[ctr].length & 0xff);\n                pad = EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_AEAD_TLS1_AAD,\n                                          EVP_AEAD_TLS1_AAD_LEN, buf[ctr]);\n                if (pad <= 0) {\n                    SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_ENC,\n                             ERR_R_INTERNAL_ERROR);\n                    return -1;\n                }\n                if (sending) {\n                    reclen[ctr] += pad;\n                    recs[ctr].length += pad;\n                }\n            } else if ((bs != 1) && sending) {\n                padnum = bs - (reclen[ctr] % bs);\n                if (padnum > MAX_PADDING) {\n                    SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_ENC,\n                             ERR_R_INTERNAL_ERROR);\n                    return -1;\n                }\n                padval = (unsigned char)(padnum - 1);\n                for (loop = reclen[ctr]; loop < reclen[ctr] + padnum; loop++)\n                    recs[ctr].input[loop] = padval;\n                reclen[ctr] += padnum;\n                recs[ctr].length += padnum;\n            }\n            if (!sending) {\n                if (reclen[ctr] == 0 || reclen[ctr] % bs != 0)\n                    return 0;\n            }\n        }\n        if (n_recs > 1) {\n            unsigned char *data[SSL_MAX_PIPELINES];\n            for (ctr = 0; ctr < n_recs; ctr++) {\n                data[ctr] = recs[ctr].data;\n            }\n            if (EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_SET_PIPELINE_OUTPUT_BUFS,\n                                    (int)n_recs, data) <= 0) {\n                SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_ENC,\n                         SSL_R_PIPELINE_FAILURE);\n                return -1;\n            }\n            for (ctr = 0; ctr < n_recs; ctr++) {\n                data[ctr] = recs[ctr].input;\n            }\n            if (EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_SET_PIPELINE_INPUT_BUFS,\n                                    (int)n_recs, data) <= 0\n                || EVP_CIPHER_CTX_ctrl(ds, EVP_CTRL_SET_PIPELINE_INPUT_LENS,\n                                       (int)n_recs, reclen) <= 0) {\n                SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_ENC,\n                         SSL_R_PIPELINE_FAILURE);\n                return -1;\n            }\n        }\n        tmpr = EVP_Cipher(ds, recs[0].data, recs[0].input,\n                          (unsigned int)reclen[0]);\n        if ((EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(ds))\n             & EVP_CIPH_FLAG_CUSTOM_CIPHER)\n            ? (tmpr < 0)\n            : (tmpr == 0))\n            return -1;\n        if (sending == 0) {\n            if (EVP_CIPHER_mode(enc) == EVP_CIPH_GCM_MODE) {\n                for (ctr = 0; ctr < n_recs; ctr++) {\n                    recs[ctr].data += EVP_GCM_TLS_EXPLICIT_IV_LEN;\n                    recs[ctr].input += EVP_GCM_TLS_EXPLICIT_IV_LEN;\n                    recs[ctr].length -= EVP_GCM_TLS_EXPLICIT_IV_LEN;\n                }\n            } else if (EVP_CIPHER_mode(enc) == EVP_CIPH_CCM_MODE) {\n                for (ctr = 0; ctr < n_recs; ctr++) {\n                    recs[ctr].data += EVP_CCM_TLS_EXPLICIT_IV_LEN;\n                    recs[ctr].input += EVP_CCM_TLS_EXPLICIT_IV_LEN;\n                    recs[ctr].length -= EVP_CCM_TLS_EXPLICIT_IV_LEN;\n                }\n            }\n        }\n        ret = 1;\n        if (!SSL_READ_ETM(s) && EVP_MD_CTX_md(s->read_hash) != NULL) {\n            imac_size = EVP_MD_CTX_size(s->read_hash);\n            if (imac_size < 0) {\n                SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_ENC,\n                         ERR_R_INTERNAL_ERROR);\n                return -1;\n            }\n            mac_size = (size_t)imac_size;\n        }\n        if ((bs != 1) && !sending) {\n            int tmpret;\n            for (ctr = 0; ctr < n_recs; ctr++) {\n                tmpret = tls1_cbc_remove_padding(s, &recs[ctr], bs, mac_size);\n                if (tmpret == 0)\n                    return 0;\n                ret = constant_time_select_int(constant_time_eq_int(tmpret, 1),\n                                               ret, -1);\n            }\n        }\n        if (pad && !sending) {\n            for (ctr = 0; ctr < n_recs; ctr++) {\n                recs[ctr].length -= pad;\n            }\n        }\n    }\n    return ret;\n}', 'int ssl_randbytes(SSL *s, unsigned char *rnd, size_t size)\n{\n    if (s->drbg != NULL) {\n         return RAND_DRBG_generate(s->drbg, rnd, size, 0, NULL, 0);\n    }\n    return RAND_bytes(rnd, (int)size);\n}', 'int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,\n                       int prediction_resistance,\n                       const unsigned char *adin, size_t adinlen)\n{\n    int reseed_required = 0;\n    if (drbg->state != DRBG_READY) {\n        rand_drbg_restart(drbg, NULL, 0, 0);\n        if (drbg->state == DRBG_ERROR) {\n            RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_IN_ERROR_STATE);\n            return 0;\n        }\n        if (drbg->state == DRBG_UNINITIALISED) {\n            RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_NOT_INSTANTIATED);\n            return 0;\n        }\n    }\n    if (outlen > drbg->max_request) {\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_REQUEST_TOO_LARGE_FOR_DRBG);\n        return 0;\n    }\n    if (adinlen > drbg->max_adinlen) {\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_ADDITIONAL_INPUT_TOO_LONG);\n        return 0;\n    }\n    if (drbg->fork_count != rand_fork_count) {\n        drbg->fork_count = rand_fork_count;\n        reseed_required = 1;\n    }\n    if (drbg->reseed_counter >= drbg->reseed_interval)\n        reseed_required = 1;\n    if (reseed_required || prediction_resistance) {\n        if (!RAND_DRBG_reseed(drbg, adin, adinlen)) {\n            RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_RESEED_ERROR);\n            return 0;\n        }\n        adin = NULL;\n        adinlen = 0;\n    }\n    if (!ctr_generate(drbg, out, outlen, adin, adinlen)) {\n        drbg->state = DRBG_ERROR;\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);\n        return 0;\n    }\n    drbg->reseed_counter++;\n    return 1;\n}', 'int ctr_generate(RAND_DRBG *drbg,\n                 unsigned char *out, size_t outlen,\n                 const unsigned char *adin, size_t adinlen)\n{\n    RAND_DRBG_CTR *ctr = &drbg->ctr;\n    if (adin != NULL && adinlen != 0) {\n        ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);\n        if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) {\n            adin = NULL;\n            adinlen = 1;\n        }\n    } else {\n        adinlen = 0;\n    }\n    for ( ; ; ) {\n        inc_128(ctr);\n        if (outlen < 16) {\n            AES_encrypt(ctr->V, ctr->K, &ctr->ks);\n            memcpy(out, ctr->K, outlen);\n            break;\n        }\n        AES_encrypt(ctr->V, out, &ctr->ks);\n        out += 16;\n        outlen -= 16;\n        if (outlen == 0)\n            break;\n    }\n    ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);\n    return 1;\n}']