ssl/ssl_cert.c:844: error: BUFFER_OVERRUN_S2
  Offset: [`*l` + 2, `*l` + 2] (⇐ `*l` + 2) Size: [1, 2147483644].
Showing all 4 steps of the trace


ssl/ssl_cert.c:833:1: <Length trace>
831.   /* Add a certificate to a BUF_MEM structure */
832.   
833. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
834.   {
835.       int n;

ssl/ssl_cert.c:833:1: Parameter `*l`
831.   /* Add a certificate to a BUF_MEM structure */
832.   
833. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
834.   {
835.       int n;

ssl/ssl_cert.c:843:5: Assignment
841.           return 0;
842.       }
843.       p = (unsigned char *)&(buf->data[*l]);
           ^
844.       l2n3(n, p);
845.       n = i2d_X509(x, &p);

ssl/ssl_cert.c:844:5: Array access: Offset: [*l + 2, *l + 2] (⇐ *l + 2) Size: [1, 2147483644]
842.       }
843.       p = (unsigned char *)&(buf->data[*l]);
844.       l2n3(n, p);
           ^
845.       n = i2d_X509(x, &p);
846.       if (n < 0) {

static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
{
    int n;
    unsigned char *p;
    n = i2d_X509(x, NULL);
    if (n < 0 || !BUF_MEM_grow_clean(buf, (int)(n + (*l) + 3))) {
        SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);
        return 0;
    }
    p = (unsigned char *)&(buf->data[*l]);
    l2n3(n, p);
    n = i2d_X509(x, &p);
    if (n < 0) {
        SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);
        return 0;
    }
    *l += n + 3;
    return 1;
}
['static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)\n{\n    int n;\n    unsigned char *p;\n    n = i2d_X509(x, NULL);\n    if (n < 0 || !BUF_MEM_grow_clean(buf, (int)(n + (*l) + 3))) {\n        SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);\n        return 0;\n    }\n    p = (unsigned char *)&(buf->data[*l]);\n    l2n3(n, p);\n    n = i2d_X509(x, &p);\n    if (n < 0) {\n        SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);\n        return 0;\n    }\n    *l += n + 3;\n    return 1;\n}']