ssl/ssl_lib.c:2285: error: BUFFER_OVERRUN_L2
  Offset: [0, 7] Size: 7.
Showing all 8 steps of the trace


ssl/ssl_lib.c:2278:9: <Offset trace>
2276.   
2277.       c = s->cert;
2278.       i = ssl_get_server_cert_index(s);
                ^
2279.   
2280.       if (i == -1)

ssl/ssl_lib.c:2278:9: Call
2276.   
2277.       c = s->cert;
2278.       i = ssl_get_server_cert_index(s);
                ^
2279.   
2280.       if (i == -1)

ssl/ssl_lib.c:2185:9: Assignment
  2183.       idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);
  2184.       if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)
  2185.           idx = SSL_PKEY_RSA_SIGN;
                  ^
  2186.       if (idx == SSL_PKEY_GOST_EC) {
  2187.           if (s->cert->pkeys[SSL_PKEY_GOST12_512].x509)

ssl/ssl_lib.c:2198:5: Assignment
  2196.       if (idx == -1)
  2197.           SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
  2198.       return idx;
              ^
  2199.   }
  2200.   

ssl/ssl_lib.c:2278:5: Assignment
2276.   
2277.       c = s->cert;
2278.       i = ssl_get_server_cert_index(s);
            ^
2279.   
2280.       if (i == -1)

ssl/ssl_lib.c:2270:1: <Length trace>
2268.   }
2269.   
2270. > int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
2271.                                      size_t *serverinfo_length)
2272.   {

ssl/ssl_lib.c:2270:1: Parameter `s->cert->pkeys[*]`
2268.   }
2269.   
2270. > int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
2271.                                      size_t *serverinfo_length)
2272.   {

ssl/ssl_lib.c:2285:19: Array access: Offset: [0, 7] Size: 7
2283.           return 0;
2284.   
2285.       *serverinfo = c->pkeys[i].serverinfo;
                          ^
2286.       *serverinfo_length = c->pkeys[i].serverinfo_length;
2287.       return 1;

int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
                                   size_t *serverinfo_length)
{
    CERT *c = NULL;
    int i = 0;
    *serverinfo_length = 0;
    c = s->cert;
    i = ssl_get_server_cert_index(s);
    if (i == -1)
        return 0;
    if (c->pkeys[i].serverinfo == NULL)
        return 0;
    *serverinfo = c->pkeys[i].serverinfo;
    *serverinfo_length = c->pkeys[i].serverinfo_length;
    return 1;
}
['int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,\n                                   size_t *serverinfo_length)\n{\n    CERT *c = NULL;\n    int i = 0;\n    *serverinfo_length = 0;\n    c = s->cert;\n    i = ssl_get_server_cert_index(s);\n    if (i == -1)\n        return 0;\n    if (c->pkeys[i].serverinfo == NULL)\n        return 0;\n    *serverinfo = c->pkeys[i].serverinfo;\n    *serverinfo_length = c->pkeys[i].serverinfo_length;\n    return 1;\n}', 'static int ssl_get_server_cert_index(const SSL *s)\n{\n    int idx;\n    idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);\n    if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)\n        idx = SSL_PKEY_RSA_SIGN;\n    if (idx == SSL_PKEY_GOST_EC) {\n        if (s->cert->pkeys[SSL_PKEY_GOST12_512].x509)\n            idx = SSL_PKEY_GOST12_512;\n        else if (s->cert->pkeys[SSL_PKEY_GOST12_256].x509)\n            idx = SSL_PKEY_GOST12_256;\n        else if (s->cert->pkeys[SSL_PKEY_GOST01].x509)\n            idx = SSL_PKEY_GOST01;\n        else\n            idx = -1;\n    }\n    if (idx == -1)\n        SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);\n    return idx;\n}']