apps/s_client.c:2294: error: BUFFER_OVERRUN_L1
  Offset: -1 Size: 8192 by call to `SSL_get_shared_ciphers`.
Showing all 6 steps of the trace


apps/s_client.c:2222:1: Array declaration
2220.   
2221.   
2222. > static void print_stuff(BIO *bio, SSL *s, int full)
2223.   	{
2224.   	X509 *peer=NULL;

apps/s_client.c:2294:5: Call
2292.   			BIO_printf(bio,"---\nNo client certificate CA names sent\n");
2293.   			}
2294.   		p=SSL_get_shared_ciphers(s,buf,sizeof buf);
            ^
2295.   		if (p != NULL)
2296.   			{

ssl/ssl_lib.c:1449:1: <Length trace>
1447.   
1448.   /* works well for SSLv2, not so good for SSLv3 */
1449. > char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
1450.   	{
1451.   	char *p;

ssl/ssl_lib.c:1449:1: Parameter `*buf`
  1447.   
  1448.   /* works well for SSLv2, not so good for SSLv3 */
  1449. > char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
  1450.   	{
  1451.   	char *p;

ssl/ssl_lib.c:1463:2: Assignment
  1461.   		return NULL;
  1462.   
  1463.   	p=buf;
           ^
  1464.   	sk=s->session->ciphers;
  1465.   	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)

ssl/ssl_lib.c:1483:2: Array access: Offset: -1 Size: 8192 by call to `SSL_get_shared_ciphers` 
  1481.   		len-=n+1;
  1482.   		}
  1483.   	p[-1]='\0';
           ^
  1484.   	return(buf);
  1485.   	}

char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
	{
	char *p;
	STACK_OF(SSL_CIPHER) *sk;
	SSL_CIPHER *c;
	int i;
	if ((s->session == NULL) || (s->session->ciphers == NULL) ||
		(len < 2))
		return(NULL);
	if (sk_SSL_CIPHER_num(sk) == 0)
		return NULL;
	p=buf;
	sk=s->session->ciphers;
	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
		{
		int n;
		c=sk_SSL_CIPHER_value(sk,i);
		n=strlen(c->name);
		if (n+1 > len)
			{
			if (p != buf)
				--p;
			*p='\0';
			return buf;
			}
		strcpy(p,c->name);
		p+=n;
		*(p++)=':';
		len-=n+1;
		}
	p[-1]='\0';
	return(buf);
	}
['static void print_stuff(BIO *bio, SSL *s, int full)\n\t{\n\tX509 *peer=NULL;\n\tchar *p;\n\tstatic const char *space="                ";\n\tchar buf[BUFSIZ];\n\tSTACK_OF(X509) *sk;\n\tSTACK_OF(X509_NAME) *sk2;\n\tconst SSL_CIPHER *c;\n\tX509_NAME *xn;\n\tint j,i;\n#ifndef OPENSSL_NO_COMP\n\tconst COMP_METHOD *comp, *expansion;\n#endif\n\tunsigned char *exportedkeymat;\n\tif (full)\n\t\t{\n\t\tint got_a_chain = 0;\n\t\tsk=SSL_get_peer_cert_chain(s);\n\t\tif (sk != NULL)\n\t\t\t{\n\t\t\tgot_a_chain = 1;\n\t\t\tBIO_printf(bio,"---\\nCertificate chain\\n");\n\t\t\tfor (i=0; i<sk_X509_num(sk); i++)\n\t\t\t\t{\n\t\t\t\tX509_NAME_oneline(X509_get_subject_name(\n\t\t\t\t\tsk_X509_value(sk,i)),buf,sizeof buf);\n\t\t\t\tBIO_printf(bio,"%2d s:%s\\n",i,buf);\n\t\t\t\tX509_NAME_oneline(X509_get_issuer_name(\n\t\t\t\t\tsk_X509_value(sk,i)),buf,sizeof buf);\n\t\t\t\tBIO_printf(bio,"   i:%s\\n",buf);\n\t\t\t\tif (c_showcerts)\n\t\t\t\t\tPEM_write_bio_X509(bio,sk_X509_value(sk,i));\n\t\t\t\t}\n\t\t\t}\n\t\tBIO_printf(bio,"---\\n");\n\t\tpeer=SSL_get_peer_certificate(s);\n\t\tif (peer != NULL)\n\t\t\t{\n\t\t\tBIO_printf(bio,"Server certificate\\n");\n\t\t\tif (!(c_showcerts && got_a_chain))\n\t\t\t\tPEM_write_bio_X509(bio,peer);\n\t\t\tX509_NAME_oneline(X509_get_subject_name(peer),\n\t\t\t\tbuf,sizeof buf);\n\t\t\tBIO_printf(bio,"subject=%s\\n",buf);\n\t\t\tX509_NAME_oneline(X509_get_issuer_name(peer),\n\t\t\t\tbuf,sizeof buf);\n\t\t\tBIO_printf(bio,"issuer=%s\\n",buf);\n\t\t\t}\n\t\telse\n\t\t\tBIO_printf(bio,"no peer certificate available\\n");\n\t\tsk2=SSL_get_client_CA_list(s);\n\t\tif ((sk2 != NULL) && (sk_X509_NAME_num(sk2) > 0))\n\t\t\t{\n\t\t\tBIO_printf(bio,"---\\nAcceptable client certificate CA names\\n");\n\t\t\tfor (i=0; i<sk_X509_NAME_num(sk2); i++)\n\t\t\t\t{\n\t\t\t\txn=sk_X509_NAME_value(sk2,i);\n\t\t\t\tX509_NAME_oneline(xn,buf,sizeof(buf));\n\t\t\t\tBIO_write(bio,buf,strlen(buf));\n\t\t\t\tBIO_write(bio,"\\n",1);\n\t\t\t\t}\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tBIO_printf(bio,"---\\nNo client certificate CA names sent\\n");\n\t\t\t}\n\t\tp=SSL_get_shared_ciphers(s,buf,sizeof buf);\n\t\tif (p != NULL)\n\t\t\t{\n\t\t\tBIO_printf(bio,"---\\nCiphers common between both SSL endpoints:\\n");\n\t\t\tj=i=0;\n\t\t\twhile (*p)\n\t\t\t\t{\n\t\t\t\tif (*p == \':\')\n\t\t\t\t\t{\n\t\t\t\t\tBIO_write(bio,space,15-j%25);\n\t\t\t\t\ti++;\n\t\t\t\t\tj=0;\n\t\t\t\t\tBIO_write(bio,((i%3)?" ":"\\n"),1);\n\t\t\t\t\t}\n\t\t\t\telse\n\t\t\t\t\t{\n\t\t\t\t\tBIO_write(bio,p,1);\n\t\t\t\t\tj++;\n\t\t\t\t\t}\n\t\t\t\tp++;\n\t\t\t\t}\n\t\t\tBIO_write(bio,"\\n",1);\n\t\t\t}\n\t\tssl_print_sigalgs(bio, s);\n\t\tssl_print_tmp_key(bio, s);\n\t\tBIO_printf(bio,"---\\nSSL handshake has read %ld bytes and written %ld bytes\\n",\n\t\t\tBIO_number_read(SSL_get_rbio(s)),\n\t\t\tBIO_number_written(SSL_get_wbio(s)));\n\t\t}\n\tBIO_printf(bio,(SSL_cache_hit(s)?"---\\nReused, ":"---\\nNew, "));\n\tc=SSL_get_current_cipher(s);\n\tBIO_printf(bio,"%s, Cipher is %s\\n",\n\t\tSSL_CIPHER_get_version(c),\n\t\tSSL_CIPHER_get_name(c));\n\tif (peer != NULL) {\n\t\tEVP_PKEY *pktmp;\n\t\tpktmp = X509_get_pubkey(peer);\n\t\tBIO_printf(bio,"Server public key is %d bit\\n",\n\t\t\t\t\t\t\t EVP_PKEY_bits(pktmp));\n\t\tEVP_PKEY_free(pktmp);\n\t}\n\tBIO_printf(bio, "Secure Renegotiation IS%s supported\\n",\n\t\t\tSSL_get_secure_renegotiation_support(s) ? "" : " NOT");\n#ifndef OPENSSL_NO_COMP\n\tcomp=SSL_get_current_compression(s);\n\texpansion=SSL_get_current_expansion(s);\n\tBIO_printf(bio,"Compression: %s\\n",\n\t\tcomp ? SSL_COMP_get_name(comp) : "NONE");\n\tBIO_printf(bio,"Expansion: %s\\n",\n\t\texpansion ? SSL_COMP_get_name(expansion) : "NONE");\n#endif\n#ifdef SSL_DEBUG\n\t{\n\tint sock;\n\tstruct sockaddr_in ladd;\n\tsocklen_t ladd_size = sizeof(ladd);\n\tsock = SSL_get_fd(s);\n\tgetsockname(sock, (struct sockaddr *)&ladd, &ladd_size);\n\tBIO_printf(bio_c_out, "LOCAL PORT is %u\\n", ntohs(ladd.sin_port));\n\t}\n#endif\n#if !defined(OPENSSL_NO_TLSEXT)\n# if !defined(OPENSSL_NO_NEXTPROTONEG)\n\tif (next_proto.status != -1) {\n\t\tconst unsigned char *proto;\n\t\tunsigned int proto_len;\n\t\tSSL_get0_next_proto_negotiated(s, &proto, &proto_len);\n\t\tBIO_printf(bio, "Next protocol: (%d) ", next_proto.status);\n\t\tBIO_write(bio, proto, proto_len);\n\t\tBIO_write(bio, "\\n", 1);\n\t}\n# endif\n\t{\n\t\tconst unsigned char *proto;\n\t\tunsigned int proto_len;\n\t\tSSL_get0_alpn_selected(s, &proto, &proto_len);\n\t\tif (proto_len > 0)\n\t\t\t{\n\t\t\tBIO_printf(bio, "ALPN protocol: ");\n\t\t\tBIO_write(bio, proto, proto_len);\n\t\t\tBIO_write(bio, "\\n", 1);\n\t\t\t}\n\t\telse\n\t\t\tBIO_printf(bio, "No ALPN negotiated\\n");\n\t}\n#endif\n \t{\n \tSRTP_PROTECTION_PROFILE *srtp_profile=SSL_get_selected_srtp_profile(s);\n\tif(srtp_profile)\n\t\tBIO_printf(bio,"SRTP Extension negotiated, profile=%s\\n",\n\t\t\t   srtp_profile->name);\n\t}\n\tSSL_SESSION_print(bio,SSL_get_session(s));\n\tif (keymatexportlabel != NULL)\n\t\t{\n\t\tBIO_printf(bio, "Keying material exporter:\\n");\n\t\tBIO_printf(bio, "    Label: \'%s\'\\n", keymatexportlabel);\n\t\tBIO_printf(bio, "    Length: %i bytes\\n", keymatexportlen);\n\t\texportedkeymat = OPENSSL_malloc(keymatexportlen);\n\t\tif (exportedkeymat != NULL)\n\t\t\t{\n\t\t\tif (!SSL_export_keying_material(s, exportedkeymat,\n\t\t\t\t\t\t        keymatexportlen,\n\t\t\t\t\t\t        keymatexportlabel,\n\t\t\t\t\t\t        strlen(keymatexportlabel),\n\t\t\t\t\t\t        NULL, 0, 0))\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio, "    Error\\n");\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio, "    Keying material: ");\n\t\t\t\tfor (i=0; i<keymatexportlen; i++)\n\t\t\t\t\tBIO_printf(bio, "%02X",\n\t\t\t\t\t\t   exportedkeymat[i]);\n\t\t\t\tBIO_printf(bio, "\\n");\n\t\t\t\t}\n\t\t\tOPENSSL_free(exportedkeymat);\n\t\t\t}\n\t\t}\n\tBIO_printf(bio,"---\\n");\n\tif (peer != NULL)\n\t\tX509_free(peer);\n\t(void)BIO_flush(bio);\n\t}', "char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)\n\t{\n\tchar *p;\n\tSTACK_OF(SSL_CIPHER) *sk;\n\tSSL_CIPHER *c;\n\tint i;\n\tif ((s->session == NULL) || (s->session->ciphers == NULL) ||\n\t\t(len < 2))\n\t\treturn(NULL);\n\tif (sk_SSL_CIPHER_num(sk) == 0)\n\t\treturn NULL;\n\tp=buf;\n\tsk=s->session->ciphers;\n\tfor (i=0; i<sk_SSL_CIPHER_num(sk); i++)\n\t\t{\n\t\tint n;\n\t\tc=sk_SSL_CIPHER_value(sk,i);\n\t\tn=strlen(c->name);\n\t\tif (n+1 > len)\n\t\t\t{\n\t\t\tif (p != buf)\n\t\t\t\t--p;\n\t\t\t*p='\\0';\n\t\t\treturn buf;\n\t\t\t}\n\t\tstrcpy(p,c->name);\n\t\tp+=n;\n\t\t*(p++)=':';\n\t\tlen-=n+1;\n\t\t}\n\tp[-1]='\\0';\n\treturn(buf);\n\t}"]