apps/s_server.c:2764: error: BUFFER_OVERRUN_L1
  Offset: -1 Size: 8192 by call to `SSL_get_shared_ciphers`.
Showing all 6 steps of the trace


apps/s_server.c:2681:1: Array declaration
2679.   	}
2680.   
2681. > static int init_ssl_connection(SSL *con)
2682.   	{
2683.   	int i;

apps/s_server.c:2764:6: Call
2762.   		}
2763.   
2764.   	if (SSL_get_shared_ciphers(con,buf,sizeof buf) != NULL)
             ^
2765.   		BIO_printf(bio_s_out,"Shared ciphers:%s\n",buf);
2766.   	str=SSL_CIPHER_get_name(SSL_get_current_cipher(con));

ssl/ssl_lib.c:1449:1: <Length trace>
1447.   
1448.   /* works well for SSLv2, not so good for SSLv3 */
1449. > char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
1450.   	{
1451.   	char *p;

ssl/ssl_lib.c:1449:1: Parameter `*buf`
  1447.   
  1448.   /* works well for SSLv2, not so good for SSLv3 */
  1449. > char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
  1450.   	{
  1451.   	char *p;

ssl/ssl_lib.c:1463:2: Assignment
  1461.   		return NULL;
  1462.   
  1463.   	p=buf;
           ^
  1464.   	sk=s->session->ciphers;
  1465.   	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)

ssl/ssl_lib.c:1483:2: Array access: Offset: -1 Size: 8192 by call to `SSL_get_shared_ciphers` 
  1481.   		len-=n+1;
  1482.   		}
  1483.   	p[-1]='\0';
           ^
  1484.   	return(buf);
  1485.   	}

char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
	{
	char *p;
	STACK_OF(SSL_CIPHER) *sk;
	SSL_CIPHER *c;
	int i;
	if ((s->session == NULL) || (s->session->ciphers == NULL) ||
		(len < 2))
		return(NULL);
	if (sk_SSL_CIPHER_num(sk) == 0)
		return NULL;
	p=buf;
	sk=s->session->ciphers;
	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
		{
		int n;
		c=sk_SSL_CIPHER_value(sk,i);
		n=strlen(c->name);
		if (n+1 > len)
			{
			if (p != buf)
				--p;
			*p='\0';
			return buf;
			}
		strcpy(p,c->name);
		p+=n;
		*(p++)=':';
		len-=n+1;
		}
	p[-1]='\0';
	return(buf);
	}
['static int init_ssl_connection(SSL *con)\n\t{\n\tint i;\n\tconst char *str;\n\tX509 *peer;\n\tlong verify_error;\n\tMS_STATIC char buf[BUFSIZ];\n#ifndef OPENSSL_NO_KRB5\n\tchar *client_princ;\n#endif\n#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)\n\tconst unsigned char *next_proto_neg;\n\tunsigned next_proto_neg_len;\n#endif\n\tunsigned char *exportedkeymat;\n\ti=SSL_accept(con);\n#ifdef CERT_CB_TEST_RETRY\n\t{\n\twhile (i <= 0 && SSL_get_error(con,i) == SSL_ERROR_WANT_X509_LOOKUP && SSL_state(con) == SSL3_ST_SR_CLNT_HELLO_C)\n\t\t{\n\t\tfprintf(stderr, "LOOKUP from certificate callback during accept\\n");\n\t\ti=SSL_accept(con);\n\t\t}\n\t}\n#endif\n#ifndef OPENSSL_NO_SRP\n\twhile (i <= 0 &&  SSL_get_error(con,i) == SSL_ERROR_WANT_X509_LOOKUP)\n\t\t{\n\t\t\tBIO_printf(bio_s_out,"LOOKUP during accept %s\\n",srp_callback_parm.login);\n\t\t\tsrp_callback_parm.user = SRP_VBASE_get_by_user(srp_callback_parm.vb, srp_callback_parm.login);\n\t\t\tif (srp_callback_parm.user)\n\t\t\t\tBIO_printf(bio_s_out,"LOOKUP done %s\\n",srp_callback_parm.user->info);\n\t\t\telse\n\t\t\t\tBIO_printf(bio_s_out,"LOOKUP not successful\\n");\n\t\t\ti=SSL_accept(con);\n\t\t}\n#endif\n\tif (generated_supp_data)\n\t\t{\n        OPENSSL_free(generated_supp_data);\n\t\tgenerated_supp_data = NULL;\n\t\t}\n\tif (i <= 0)\n\t\t{\n\t\tif (BIO_sock_should_retry(i))\n\t\t\t{\n\t\t\tBIO_printf(bio_s_out,"DELAY\\n");\n\t\t\treturn(1);\n\t\t\t}\n\t\tBIO_printf(bio_err,"ERROR\\n");\n\t\tverify_error=SSL_get_verify_result(con);\n\t\tif (verify_error != X509_V_OK)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"verify error:%s\\n",\n\t\t\t\tX509_verify_cert_error_string(verify_error));\n\t\t\t}\n\t\tERR_print_errors(bio_err);\n\t\treturn(0);\n\t\t}\n\tif (s_brief)\n\t\tprint_ssl_summary(bio_err, con);\n\tPEM_write_bio_SSL_SESSION(bio_s_out,SSL_get_session(con));\n\tpeer=SSL_get_peer_certificate(con);\n\tif (peer != NULL)\n\t\t{\n\t\tBIO_printf(bio_s_out,"Client certificate\\n");\n\t\tPEM_write_bio_X509(bio_s_out,peer);\n\t\tX509_NAME_oneline(X509_get_subject_name(peer),buf,sizeof buf);\n\t\tBIO_printf(bio_s_out,"subject=%s\\n",buf);\n\t\tX509_NAME_oneline(X509_get_issuer_name(peer),buf,sizeof buf);\n\t\tBIO_printf(bio_s_out,"issuer=%s\\n",buf);\n\t\tX509_free(peer);\n\t\t}\n\tif (SSL_get_shared_ciphers(con,buf,sizeof buf) != NULL)\n\t\tBIO_printf(bio_s_out,"Shared ciphers:%s\\n",buf);\n\tstr=SSL_CIPHER_get_name(SSL_get_current_cipher(con));\n\tssl_print_sigalgs(bio_s_out, con);\n#ifndef OPENSSL_NO_EC\n\tssl_print_point_formats(bio_s_out, con);\n\tssl_print_curves(bio_s_out, con, 0);\n#endif\n\tBIO_printf(bio_s_out,"CIPHER is %s\\n",(str != NULL)?str:"(NONE)");\n#if !defined(OPENSSL_NO_TLSEXT) && !defined(OPENSSL_NO_NEXTPROTONEG)\n\tSSL_get0_next_proto_negotiated(con, &next_proto_neg, &next_proto_neg_len);\n\tif (next_proto_neg)\n\t\t{\n\t\tBIO_printf(bio_s_out,"NEXTPROTO is ");\n\t\tBIO_write(bio_s_out, next_proto_neg, next_proto_neg_len);\n\t\tBIO_printf(bio_s_out, "\\n");\n\t\t}\n#endif\n\t{\n\tSRTP_PROTECTION_PROFILE *srtp_profile\n\t  = SSL_get_selected_srtp_profile(con);\n\tif(srtp_profile)\n\t\tBIO_printf(bio_s_out,"SRTP Extension negotiated, profile=%s\\n",\n\t\t\t   srtp_profile->name);\n\t}\n\tif (SSL_cache_hit(con)) BIO_printf(bio_s_out,"Reused session-id\\n");\n\tif (SSL_ctrl(con,SSL_CTRL_GET_FLAGS,0,NULL) &\n\t\tTLS1_FLAGS_TLS_PADDING_BUG)\n\t\tBIO_printf(bio_s_out,\n\t\t\t   "Peer has incorrect TLSv1 block padding\\n");\n#ifndef OPENSSL_NO_KRB5\n\tclient_princ = kssl_ctx_get0_client_princ(SSL_get0_kssl_ctx(con));\n\tif (client_princ != NULL)\n\t\t{\n\t\tBIO_printf(bio_s_out,"Kerberos peer principal is %s\\n",\n\t\t\t\t\t\t\t\tclient_princ);\n\t\t}\n#endif\n\tBIO_printf(bio_s_out, "Secure Renegotiation IS%s supported\\n",\n\t\t      SSL_get_secure_renegotiation_support(con) ? "" : " NOT");\n\tif (keymatexportlabel != NULL)\n\t\t{\n\t\tBIO_printf(bio_s_out, "Keying material exporter:\\n");\n\t\tBIO_printf(bio_s_out, "    Label: \'%s\'\\n", keymatexportlabel);\n\t\tBIO_printf(bio_s_out, "    Length: %i bytes\\n",\n\t\t\t   keymatexportlen);\n\t\texportedkeymat = OPENSSL_malloc(keymatexportlen);\n\t\tif (exportedkeymat != NULL)\n\t\t\t{\n\t\t\tif (!SSL_export_keying_material(con, exportedkeymat,\n\t\t\t\t\t\t        keymatexportlen,\n\t\t\t\t\t\t        keymatexportlabel,\n\t\t\t\t\t\t        strlen(keymatexportlabel),\n\t\t\t\t\t\t        NULL, 0, 0))\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_s_out, "    Error\\n");\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\tBIO_printf(bio_s_out, "    Keying material: ");\n\t\t\t\tfor (i=0; i<keymatexportlen; i++)\n\t\t\t\t\tBIO_printf(bio_s_out, "%02X",\n\t\t\t\t\t\t   exportedkeymat[i]);\n\t\t\t\tBIO_printf(bio_s_out, "\\n");\n\t\t\t\t}\n\t\t\tOPENSSL_free(exportedkeymat);\n\t\t\t}\n\t\t}\n\treturn(1);\n\t}', "char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)\n\t{\n\tchar *p;\n\tSTACK_OF(SSL_CIPHER) *sk;\n\tSSL_CIPHER *c;\n\tint i;\n\tif ((s->session == NULL) || (s->session->ciphers == NULL) ||\n\t\t(len < 2))\n\t\treturn(NULL);\n\tif (sk_SSL_CIPHER_num(sk) == 0)\n\t\treturn NULL;\n\tp=buf;\n\tsk=s->session->ciphers;\n\tfor (i=0; i<sk_SSL_CIPHER_num(sk); i++)\n\t\t{\n\t\tint n;\n\t\tc=sk_SSL_CIPHER_value(sk,i);\n\t\tn=strlen(c->name);\n\t\tif (n+1 > len)\n\t\t\t{\n\t\t\tif (p != buf)\n\t\t\t\t--p;\n\t\t\t*p='\\0';\n\t\t\treturn buf;\n\t\t\t}\n\t\tstrcpy(p,c->name);\n\t\tp+=n;\n\t\t*(p++)=':';\n\t\tlen-=n+1;\n\t\t}\n\tp[-1]='\\0';\n\treturn(buf);\n\t}"]