ssl/statem/statem_srvr.c:1315: error: INTEGER_OVERFLOW_L2
  ([0, `pkt->remaining`] - [0, 32]):unsigned64 by call to `PACKET_copy_bytes`.
Showing all 11 steps of the trace


ssl/statem/statem_srvr.c:1299:17: Call
1297.   
1298.           if (!PACKET_get_net_2(pkt, &ciphersuite_len)
1299.               || !PACKET_get_net_2(pkt, &session_id_len)
                        ^
1300.               || !PACKET_get_net_2(pkt, &challenge_len)) {
1301.               SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,

ssl/packet_locl.h:155:10: Call
  153.   __owur static ossl_inline int PACKET_get_net_2(PACKET *pkt, unsigned int *data)
  154.   {
  155.       if (!PACKET_peek_net_2(pkt, data))
                  ^
  156.           return 0;
  157.   

ssl/packet_locl.h:139:8: Parameter `*data`
    137.    * |*data|
    138.    */
    139.   __owur static ossl_inline int PACKET_peek_net_2(const PACKET *pkt,
                  ^
    140.                                                   unsigned int *data)
    141.   {

ssl/statem/statem_srvr.c:1315:17: Call
1313.           if (!PACKET_get_sub_packet(pkt, &clienthello->ciphersuites,
1314.                                      ciphersuite_len)
1315.               || !PACKET_copy_bytes(pkt, clienthello->session_id, session_id_len)
                        ^
1316.               || !PACKET_get_sub_packet(pkt, &challenge, challenge_len)
1317.               /* No extensions. */

ssl/packet_locl.h:379:8: Parameter `len`
  377.    * The caller is responsible for ensuring that |data| can hold |len| bytes.
  378.    */
  379.   __owur static ossl_inline int PACKET_copy_bytes(PACKET *pkt,
                ^
  380.                                                   unsigned char *data, size_t len)
  381.   {

ssl/packet_locl.h:385:5: Call
  383.           return 0;
  384.   
  385.       packet_forward(pkt, len);
             ^
  386.   
  387.       return 1;

ssl/packet_locl.h:33:1: <LHS trace>
31.   
32.   /* Internal unchecked shorthand; don't use outside this file. */
33. > static ossl_inline void packet_forward(PACKET *pkt, size_t len)
34.   {
35.       pkt->curr += len;

ssl/packet_locl.h:33:1: Parameter `pkt->remaining`
    31.   
    32.   /* Internal unchecked shorthand; don't use outside this file. */
    33. > static ossl_inline void packet_forward(PACKET *pkt, size_t len)
    34.   {
    35.       pkt->curr += len;

ssl/packet_locl.h:33:1: <RHS trace>
31.   
32.   /* Internal unchecked shorthand; don't use outside this file. */
33. > static ossl_inline void packet_forward(PACKET *pkt, size_t len)
34.   {
35.       pkt->curr += len;

ssl/packet_locl.h:33:1: Parameter `len`
    31.   
    32.   /* Internal unchecked shorthand; don't use outside this file. */
    33. > static ossl_inline void packet_forward(PACKET *pkt, size_t len)
    34.   {
    35.       pkt->curr += len;

ssl/packet_locl.h:36:5: Binary operation: ([0, pkt->remaining] - [0, 32]):unsigned64 by call to `PACKET_copy_bytes` 
    34.   {
    35.       pkt->curr += len;
    36.       pkt->remaining -= len;
              ^
    37.   }
    38.   

static ossl_inline void packet_forward(PACKET *pkt, size_t len)
{
    pkt->curr += len;
    pkt->remaining -= len;
}
['MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)\n{\n    int al = SSL_AD_INTERNAL_ERROR;\n    PACKET session_id, compression, extensions, cookie;\n    static const unsigned char null_compression = 0;\n    CLIENTHELLO_MSG *clienthello;\n    clienthello = OPENSSL_zalloc(sizeof(*clienthello));\n    if (clienthello == NULL) {\n        SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    if (s->renegotiate == 0 && !SSL_IS_FIRST_HANDSHAKE(s)) {\n        s->renegotiate = 1;\n        s->new_session = 1;\n    }\n    s->statem.cleanuphand = 1;\n    clienthello->isv2 = RECORD_LAYER_is_sslv2_record(&s->rlayer);\n    PACKET_null_init(&cookie);\n    if (clienthello->isv2) {\n        unsigned int mt;\n        if (!SSL_IS_FIRST_HANDSHAKE(s) || s->hello_retry_request) {\n            al = SSL_AD_HANDSHAKE_FAILURE;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_UNEXPECTED_MESSAGE);\n            goto f_err;\n        }\n        if (!PACKET_get_1(pkt, &mt)\n            || mt != SSL2_MT_CLIENT_HELLO) {\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n    }\n    if (!PACKET_get_net_2(pkt, &clienthello->legacy_version)) {\n        al = SSL_AD_DECODE_ERROR;\n        SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_TOO_SHORT);\n        goto err;\n    }\n    if (clienthello->isv2) {\n        unsigned int ciphersuite_len, session_id_len, challenge_len;\n        PACKET challenge;\n        if (!PACKET_get_net_2(pkt, &ciphersuite_len)\n            || !PACKET_get_net_2(pkt, &session_id_len)\n            || !PACKET_get_net_2(pkt, &challenge_len)) {\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,\n                   SSL_R_RECORD_LENGTH_MISMATCH);\n            al = SSL_AD_DECODE_ERROR;\n            goto f_err;\n        }\n        if (session_id_len > SSL_MAX_SSL_SESSION_ID_LENGTH) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);\n            goto f_err;\n        }\n        if (!PACKET_get_sub_packet(pkt, &clienthello->ciphersuites,\n                                   ciphersuite_len)\n            || !PACKET_copy_bytes(pkt, clienthello->session_id, session_id_len)\n            || !PACKET_get_sub_packet(pkt, &challenge, challenge_len)\n            || PACKET_remaining(pkt) != 0) {\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO,\n                   SSL_R_RECORD_LENGTH_MISMATCH);\n            al = SSL_AD_DECODE_ERROR;\n            goto f_err;\n        }\n        clienthello->session_id_len = session_id_len;\n        challenge_len = challenge_len > SSL3_RANDOM_SIZE\n                        ? SSL3_RANDOM_SIZE : challenge_len;\n        memset(clienthello->random, 0, SSL3_RANDOM_SIZE);\n        if (!PACKET_copy_bytes(&challenge,\n                               clienthello->random + SSL3_RANDOM_SIZE -\n                               challenge_len, challenge_len)\n            || !PACKET_buf_init(&compression, &null_compression, 1)) {\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);\n            al = SSL_AD_INTERNAL_ERROR;\n            goto f_err;\n        }\n        PACKET_null_init(&clienthello->extensions);\n    } else {\n        if (!PACKET_copy_bytes(pkt, clienthello->random, SSL3_RANDOM_SIZE)\n            || !PACKET_get_length_prefixed_1(pkt, &session_id)\n            || !PACKET_copy_all(&session_id, clienthello->session_id,\n                    SSL_MAX_SSL_SESSION_ID_LENGTH,\n                    &clienthello->session_id_len)) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);\n            goto f_err;\n        }\n        if (SSL_IS_DTLS(s)) {\n            if (!PACKET_get_length_prefixed_1(pkt, &cookie)) {\n                al = SSL_AD_DECODE_ERROR;\n                SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);\n                goto f_err;\n            }\n            if (!PACKET_copy_all(&cookie, clienthello->dtls_cookie,\n                                 DTLS1_COOKIE_LENGTH,\n                                 &clienthello->dtls_cookie_len)) {\n                al = SSL_AD_DECODE_ERROR;\n                SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);\n                goto f_err;\n            }\n            if (SSL_get_options(s) & SSL_OP_COOKIE_EXCHANGE) {\n                if (clienthello->dtls_cookie_len == 0)\n                    return 1;\n            }\n        }\n        if (!PACKET_get_length_prefixed_2(pkt, &clienthello->ciphersuites)) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);\n            goto f_err;\n        }\n        if (!PACKET_get_length_prefixed_1(pkt, &compression)) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);\n            goto f_err;\n        }\n        if (PACKET_remaining(pkt) == 0) {\n            PACKET_null_init(&clienthello->extensions);\n        } else {\n            if (!PACKET_get_length_prefixed_2(pkt, &clienthello->extensions)) {\n                al = SSL_AD_DECODE_ERROR;\n                SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);\n                goto f_err;\n            }\n        }\n    }\n    if (!PACKET_copy_all(&compression, clienthello->compressions,\n                         MAX_COMPRESSIONS_SIZE,\n                         &clienthello->compressions_len)) {\n        al = SSL_AD_DECODE_ERROR;\n        SSLerr(SSL_F_TLS_PROCESS_CLIENT_HELLO, SSL_R_LENGTH_MISMATCH);\n        goto f_err;\n    }\n    extensions = clienthello->extensions;\n    if (!tls_collect_extensions(s, &extensions, EXT_CLIENT_HELLO,\n                                &clienthello->pre_proc_exts, &al,\n                                &clienthello->pre_proc_exts_len)) {\n        goto f_err;\n    }\n    s->clienthello = clienthello;\n    return MSG_PROCESS_CONTINUE_PROCESSING;\n f_err:\n    ssl3_send_alert(s, SSL3_AL_FATAL, al);\n err:\n    ossl_statem_set_error(s);\n    OPENSSL_free(clienthello->pre_proc_exts);\n    OPENSSL_free(clienthello);\n    return MSG_PROCESS_ERROR;\n}', 'static ossl_inline int PACKET_get_net_2(PACKET *pkt, unsigned int *data)\n{\n    if (!PACKET_peek_net_2(pkt, data))\n        return 0;\n    packet_forward(pkt, 2);\n    return 1;\n}', 'static ossl_inline int PACKET_peek_net_2(const PACKET *pkt,\n                                                unsigned int *data)\n{\n    if (PACKET_remaining(pkt) < 2)\n        return 0;\n    *data = ((unsigned int)(*pkt->curr)) << 8;\n    *data |= *(pkt->curr + 1);\n    return 1;\n}', 'static ossl_inline int PACKET_copy_bytes(PACKET *pkt,\n                                                unsigned char *data, size_t len)\n{\n    if (!PACKET_peek_copy_bytes(pkt, data, len))\n        return 0;\n    packet_forward(pkt, len);\n    return 1;\n}', 'static ossl_inline void packet_forward(PACKET *pkt, size_t len)\n{\n    pkt->curr += len;\n    pkt->remaining -= len;\n}']