ssl/ssl_lib.c:4781: error: BUFFER_OVERRUN_S2
  Offset: `s->clienthello->pre_proc_exts->received_order` Size: [0, +oo].
Showing all 8 steps of the trace


ssl/ssl_lib.c:4760:1: <Offset trace>
4758.   }
4759.   
4760. > int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen)
4761.   {
4762.       RAW_EXTENSION *ext;

ssl/ssl_lib.c:4760:1: Parameter `s->clienthello->pre_proc_exts->received_order`
4758.   }
4759.   
4760. > int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen)
4761.   {
4762.       RAW_EXTENSION *ext;

ssl/ssl_lib.c:4764:5: <Length trace>
4762.       RAW_EXTENSION *ext;
4763.       int *present;
4764.       size_t num = 0, i;
            ^
4765.   
4766.       if (s->clienthello == NULL || out == NULL || outlen == NULL)

ssl/ssl_lib.c:4764:5: Assignment
4762.       RAW_EXTENSION *ext;
4763.       int *present;
4764.       size_t num = 0, i;
            ^
4765.   
4766.       if (s->clienthello == NULL || out == NULL || outlen == NULL)

ssl/ssl_lib.c:4773:15: Call
4771.               num++;
4772.       }
4773.       present = OPENSSL_malloc(sizeof(*present) * num);
                      ^
4774.       if (present == NULL)
4775.           return 0;

crypto/mem.c:178:9: Assignment
  176.   
  177.       if (num == 0)
  178.           return NULL;
                 ^
  179.   
  180.       FAILTEST();

ssl/ssl_lib.c:4773:5: Assignment
4771.               num++;
4772.       }
4773.       present = OPENSSL_malloc(sizeof(*present) * num);
            ^
4774.       if (present == NULL)
4775.           return 0;

ssl/ssl_lib.c:4781:13: Array access: Offset: s->clienthello->pre_proc_exts->received_order Size: [0, +oo]
4779.               if (ext->received_order >= num)
4780.                   goto err;
4781.               present[ext->received_order] = ext->type;
                    ^
4782.           }
4783.       }

int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen)
{
    RAW_EXTENSION *ext;
    int *present;
    size_t num = 0, i;
    if (s->clienthello == NULL || out == NULL || outlen == NULL)
        return 0;
    for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) {
        ext = s->clienthello->pre_proc_exts + i;
        if (ext->present)
            num++;
    }
    present = OPENSSL_malloc(sizeof(*present) * num);
    if (present == NULL)
        return 0;
    for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) {
        ext = s->clienthello->pre_proc_exts + i;
        if (ext->present) {
            if (ext->received_order >= num)
                goto err;
            present[ext->received_order] = ext->type;
        }
    }
    *out = present;
    *outlen = num;
    return 1;
 err:
    OPENSSL_free(present);
    return 0;
}
['int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen)\n{\n    RAW_EXTENSION *ext;\n    int *present;\n    size_t num = 0, i;\n    if (s->clienthello == NULL || out == NULL || outlen == NULL)\n        return 0;\n    for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) {\n        ext = s->clienthello->pre_proc_exts + i;\n        if (ext->present)\n            num++;\n    }\n    present = OPENSSL_malloc(sizeof(*present) * num);\n    if (present == NULL)\n        return 0;\n    for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) {\n        ext = s->clienthello->pre_proc_exts + i;\n        if (ext->present) {\n            if (ext->received_order >= num)\n                goto err;\n            present[ext->received_order] = ext->type;\n        }\n    }\n    *out = present;\n    *outlen = num;\n    return 1;\n err:\n    OPENSSL_free(present);\n    return 0;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)(file); (void)(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']