ssl/ssl_rsa.c:850: error: BUFFER_OVERRUN_L3
  Offset added: [56, +oo] (⇐ [0, +oo] + 56) Size: [1, +oo] by call to `serverinfo_process_buffer`.
Showing all 13 steps of the trace


ssl/ssl_rsa.c:850:10: Call
848.           return 0;
849.       }
850.       if (!serverinfo_process_buffer(version, serverinfo, serverinfo_length,
                ^
851.                                      NULL)) {
852.           SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, SSL_R_INVALID_SERVERINFO_DATA);

ssl/ssl_rsa.c:792:1: Parameter `ctx->cert->custext.meths_count`
  790.    * the included extensions.
  791.    */
  792. > static int serverinfo_process_buffer(unsigned int version,
  793.                                        const unsigned char *serverinfo,
  794.                                        size_t serverinfo_length, SSL_CTX *ctx)

ssl/ssl_rsa.c:821:18: Call
  819.   
  820.           if (version == SERVERINFOV1) {
  821.               if (!SSL_CTX_add_server_custom_ext(ctx, ext_type,
                          ^
  822.                                                  serverinfo_srv_add_cb,
  823.                                                  NULL, NULL,

ssl/statem/extensions_cust.c:430:1: Parameter `ctx->cert->custext.meths_count`
    428.   }
    429.   
    430. > int SSL_CTX_add_server_custom_ext(SSL_CTX *ctx, unsigned int ext_type,
    431.                                     custom_ext_add_cb add_cb,
    432.                                     custom_ext_free_cb free_cb,

ssl/statem/extensions_cust.c:436:12: Call
    434.                                     custom_ext_parse_cb parse_cb, void *parse_arg)
    435.   {
    436.       return add_old_custom_ext(ctx, ENDPOINT_SERVER, ext_type,
                      ^
    437.                                 SSL_EXT_TLS1_2_AND_BELOW_ONLY
    438.                                 | SSL_EXT_CLIENT_HELLO

ssl/statem/extensions_cust.c:373:1: Parameter `ctx->cert->custext.meths_count`
      371.   }
      372.   
      373. > static int add_old_custom_ext(SSL_CTX *ctx, ENDPOINT role,
      374.                                 unsigned int ext_type,
      375.                                 unsigned int context,

ssl/statem/extensions_cust.c:399:11: Call
      397.       parse_cb_wrap->parse_cb = parse_cb;
      398.   
      399.       ret = add_custom_ext_intern(ctx, role, ext_type,
                       ^
      400.                                   context,
      401.                                   custom_ext_add_old_cb_wrap,

ssl/statem/extensions_cust.c:308:1: <Length trace>
306.   }
307.   
308. > static int add_custom_ext_intern(SSL_CTX *ctx, ENDPOINT role,
309.                                    unsigned int ext_type,
310.                                    unsigned int context,

ssl/statem/extensions_cust.c:308:1: Parameter `ctx->cert->custext.meths_count`
        306.   }
        307.   
        308. > static int add_custom_ext_intern(SSL_CTX *ctx, ENDPOINT role,
        309.                                    unsigned int ext_type,
        310.                                    unsigned int context,

ssl/statem/extensions_cust.c:351:9: Call
        349.           return 0;
        350.       /* Search for duplicate */
        351.       if (custom_ext_find(exts, role, ext_type, NULL))
                       ^
        352.           return 0;
        353.       tmp = OPENSSL_realloc(exts->meths,

ssl/statem/extensions_cust.c:81:1: Parameter `exts->meths_count`
          79.    * client, or ENDPOINT_BOTH for either
          80.    */
          81. > custom_ext_method *custom_ext_find(const custom_ext_methods *exts,
          82.                                      ENDPOINT role, unsigned int ext_type,
          83.                                      size_t *idx)

ssl/statem/extensions_cust.c:359:5: Assignment
        357.   
        358.       exts->meths = tmp;
        359.       meth = exts->meths + exts->meths_count;
                   ^
        360.       memset(meth, 0, sizeof(*meth));
        361.       meth->role = role;

ssl/statem/extensions_cust.c:360:5: Array access: Offset added: [56, +oo] (⇐ [0, +oo] + 56) Size: [1, +oo] by call to `serverinfo_process_buffer` 
        358.       exts->meths = tmp;
        359.       meth = exts->meths + exts->meths_count;
        360.       memset(meth, 0, sizeof(*meth));
                   ^
        361.       meth->role = role;
        362.       meth->context = context;

static int add_custom_ext_intern(SSL_CTX *ctx, ENDPOINT role,
                                 unsigned int ext_type,
                                 unsigned int context,
                                 SSL_custom_ext_add_cb_ex add_cb,
                                 SSL_custom_ext_free_cb_ex free_cb,
                                 void *add_arg,
                                 SSL_custom_ext_parse_cb_ex parse_cb,
                                 void *parse_arg)
{
    custom_ext_methods *exts = &ctx->cert->custext;
    custom_ext_method *meth, *tmp;
    if (add_cb == NULL && free_cb != NULL)
        return 0;
#ifndef OPENSSL_NO_CT
    if (ext_type == TLSEXT_TYPE_signed_certificate_timestamp
            && (context & SSL_EXT_CLIENT_HELLO) != 0
            && SSL_CTX_ct_is_enabled(ctx))
        return 0;
#endif
    if (SSL_extension_supported(ext_type)
            && ext_type != TLSEXT_TYPE_signed_certificate_timestamp)
        return 0;
    if (ext_type > 0xffff)
        return 0;
    if (custom_ext_find(exts, role, ext_type, NULL))
        return 0;
    tmp = OPENSSL_realloc(exts->meths,
                          (exts->meths_count + 1) * sizeof(custom_ext_method));
    if (tmp == NULL)
        return 0;
    exts->meths = tmp;
    meth = exts->meths + exts->meths_count;
    memset(meth, 0, sizeof(*meth));
    meth->role = role;
    meth->context = context;
    meth->parse_cb = parse_cb;
    meth->add_cb = add_cb;
    meth->free_cb = free_cb;
    meth->ext_type = ext_type;
    meth->add_arg = add_arg;
    meth->parse_arg = parse_arg;
    exts->meths_count++;
    return 1;
}
['int SSL_CTX_use_serverinfo_ex(SSL_CTX *ctx, unsigned int version,\n                              const unsigned char *serverinfo,\n                              size_t serverinfo_length)\n{\n    unsigned char *new_serverinfo;\n    if (ctx == NULL || serverinfo == NULL || serverinfo_length == 0) {\n        SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, ERR_R_PASSED_NULL_PARAMETER);\n        return 0;\n    }\n    if (!serverinfo_process_buffer(version, serverinfo, serverinfo_length,\n                                   NULL)) {\n        SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, SSL_R_INVALID_SERVERINFO_DATA);\n        return 0;\n    }\n    if (ctx->cert->key == NULL) {\n        SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    new_serverinfo = OPENSSL_realloc(ctx->cert->key->serverinfo,\n                                     serverinfo_length);\n    if (new_serverinfo == NULL) {\n        SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    ctx->cert->key->serverinfo = new_serverinfo;\n    memcpy(ctx->cert->key->serverinfo, serverinfo, serverinfo_length);\n    ctx->cert->key->serverinfo_length = serverinfo_length;\n    if (!serverinfo_process_buffer(version, serverinfo, serverinfo_length,\n                                   ctx)) {\n        SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, SSL_R_INVALID_SERVERINFO_DATA);\n        return 0;\n    }\n    return 1;\n}', 'static int serverinfo_process_buffer(unsigned int version,\n                                     const unsigned char *serverinfo,\n                                     size_t serverinfo_length, SSL_CTX *ctx)\n{\n    PACKET pkt;\n    if (serverinfo == NULL || serverinfo_length == 0)\n        return 0;\n    if (version != SERVERINFOV1 && version != SERVERINFOV2)\n        return 0;\n    if (!PACKET_buf_init(&pkt, serverinfo, serverinfo_length))\n        return 0;\n    while (PACKET_remaining(&pkt)) {\n        unsigned long context = 0;\n        unsigned int ext_type = 0;\n        PACKET data;\n        if (!PACKET_get_net_4(&pkt, &context)\n                || !PACKET_get_net_2(&pkt, &ext_type)\n                || !PACKET_get_length_prefixed_2(&pkt, &data))\n            return 0;\n        if (ctx == NULL)\n            continue;\n        if (version == SERVERINFOV1) {\n            if (!SSL_CTX_add_server_custom_ext(ctx, ext_type,\n                                               serverinfo_srv_add_cb,\n                                               NULL, NULL,\n                                               serverinfo_srv_parse_cb,\n                                               NULL))\n                return 0;\n        } else {\n            if (!SSL_CTX_add_custom_ext(ctx, ext_type, context,\n                                        serverinfoex_srv_add_cb,\n                                        NULL, NULL,\n                                        serverinfoex_srv_parse_cb,\n                                        NULL))\n                return 0;\n        }\n    }\n    return 1;\n}', 'int SSL_CTX_add_server_custom_ext(SSL_CTX *ctx, unsigned int ext_type,\n                                  custom_ext_add_cb add_cb,\n                                  custom_ext_free_cb free_cb,\n                                  void *add_arg,\n                                  custom_ext_parse_cb parse_cb, void *parse_arg)\n{\n    return add_old_custom_ext(ctx, ENDPOINT_SERVER, ext_type,\n                              SSL_EXT_TLS1_2_AND_BELOW_ONLY\n                              | SSL_EXT_CLIENT_HELLO\n                              | SSL_EXT_TLS1_2_SERVER_HELLO\n                              | SSL_EXT_IGNORE_ON_RESUMPTION,\n                              add_cb, free_cb, add_arg, parse_cb, parse_arg);\n}', 'static int add_old_custom_ext(SSL_CTX *ctx, ENDPOINT role,\n                              unsigned int ext_type,\n                              unsigned int context,\n                              custom_ext_add_cb add_cb,\n                              custom_ext_free_cb free_cb,\n                              void *add_arg,\n                              custom_ext_parse_cb parse_cb, void *parse_arg)\n{\n    custom_ext_add_cb_wrap *add_cb_wrap\n        = OPENSSL_malloc(sizeof(*add_cb_wrap));\n    custom_ext_parse_cb_wrap *parse_cb_wrap\n        = OPENSSL_malloc(sizeof(*parse_cb_wrap));\n    int ret;\n    if (add_cb_wrap == NULL || parse_cb_wrap == NULL) {\n        OPENSSL_free(add_cb_wrap);\n        OPENSSL_free(parse_cb_wrap);\n        return 0;\n    }\n    add_cb_wrap->add_arg = add_arg;\n    add_cb_wrap->add_cb = add_cb;\n    add_cb_wrap->free_cb = free_cb;\n    parse_cb_wrap->parse_arg = parse_arg;\n    parse_cb_wrap->parse_cb = parse_cb;\n    ret = add_custom_ext_intern(ctx, role, ext_type,\n                                context,\n                                custom_ext_add_old_cb_wrap,\n                                custom_ext_free_old_cb_wrap,\n                                add_cb_wrap,\n                                custom_ext_parse_old_cb_wrap,\n                                parse_cb_wrap);\n    if (!ret) {\n        OPENSSL_free(add_cb_wrap);\n        OPENSSL_free(parse_cb_wrap);\n    }\n    return ret;\n}', 'static int add_custom_ext_intern(SSL_CTX *ctx, ENDPOINT role,\n                                 unsigned int ext_type,\n                                 unsigned int context,\n                                 SSL_custom_ext_add_cb_ex add_cb,\n                                 SSL_custom_ext_free_cb_ex free_cb,\n                                 void *add_arg,\n                                 SSL_custom_ext_parse_cb_ex parse_cb,\n                                 void *parse_arg)\n{\n    custom_ext_methods *exts = &ctx->cert->custext;\n    custom_ext_method *meth, *tmp;\n    if (add_cb == NULL && free_cb != NULL)\n        return 0;\n#ifndef OPENSSL_NO_CT\n    if (ext_type == TLSEXT_TYPE_signed_certificate_timestamp\n            && (context & SSL_EXT_CLIENT_HELLO) != 0\n            && SSL_CTX_ct_is_enabled(ctx))\n        return 0;\n#endif\n    if (SSL_extension_supported(ext_type)\n            && ext_type != TLSEXT_TYPE_signed_certificate_timestamp)\n        return 0;\n    if (ext_type > 0xffff)\n        return 0;\n    if (custom_ext_find(exts, role, ext_type, NULL))\n        return 0;\n    tmp = OPENSSL_realloc(exts->meths,\n                          (exts->meths_count + 1) * sizeof(custom_ext_method));\n    if (tmp == NULL)\n        return 0;\n    exts->meths = tmp;\n    meth = exts->meths + exts->meths_count;\n    memset(meth, 0, sizeof(*meth));\n    meth->role = role;\n    meth->context = context;\n    meth->parse_cb = parse_cb;\n    meth->add_cb = add_cb;\n    meth->free_cb = free_cb;\n    meth->ext_type = ext_type;\n    meth->add_arg = add_arg;\n    meth->parse_arg = parse_arg;\n    exts->meths_count++;\n    return 1;\n}', 'custom_ext_method *custom_ext_find(const custom_ext_methods *exts,\n                                   ENDPOINT role, unsigned int ext_type,\n                                   size_t *idx)\n{\n    size_t i;\n    custom_ext_method *meth = exts->meths;\n    for (i = 0; i < exts->meths_count; i++, meth++) {\n        if (ext_type == meth->ext_type\n                && (role == ENDPOINT_BOTH || role == meth->role\n                    || meth->role == ENDPOINT_BOTH)) {\n            if (idx != NULL)\n                *idx = i;\n            return meth;\n        }\n    }\n    return NULL;\n}']