apps/s_server.c:1132: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] (⇐ [0, +oo] + -1) Size: 8192 by call to `SSL_get_shared_ciphers`.
Showing all 6 steps of the trace


apps/s_server.c:1090:1: Array declaration
1088.   	}
1089.   
1090. > static int init_ssl_connection(SSL *con)
1091.   	{
1092.   	int i;

apps/s_server.c:1132:6: Call
1130.   		}
1131.   
1132.   	if (SSL_get_shared_ciphers(con,buf,BUFSIZ) != NULL)
             ^
1133.   		BIO_printf(bio_s_out,"Shared ciphers:%s\n",buf);
1134.   	str=SSL_CIPHER_get_name(SSL_get_current_cipher(con));

ssl/ssl_lib.c:986:1: <Length trace>
984.   
985.   /* works well for SSLv2, not so good for SSLv3 */
986. > char *SSL_get_shared_ciphers(SSL *s,char *buf,int len)
987.   	{
988.   	char *p;

ssl/ssl_lib.c:986:1: Parameter `*buf`
  984.   
  985.   /* works well for SSLv2, not so good for SSLv3 */
  986. > char *SSL_get_shared_ciphers(SSL *s,char *buf,int len)
  987.   	{
  988.   	char *p;

ssl/ssl_lib.c:998:2: Assignment
  996.   		return(NULL);
  997.   
  998.   	p=buf;
           ^
  999.   	sk=s->session->ciphers;
  1000.   	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)

ssl/ssl_lib.c:1017:2: Array access: Offset: [-1, +oo] (⇐ [0, +oo] + -1) Size: 8192 by call to `SSL_get_shared_ciphers` 
  1015.   		*(p++)=':';
  1016.   		}
  1017.   	p[-1]='\0';
           ^
  1018.   	return(buf);
  1019.   	}

char *SSL_get_shared_ciphers(SSL *s,char *buf,int len)
	{
	char *p;
	const char *cp;
	STACK_OF(SSL_CIPHER) *sk;
	SSL_CIPHER *c;
	int i;
	if ((s->session == NULL) || (s->session->ciphers == NULL) ||
		(len < 2))
		return(NULL);
	p=buf;
	sk=s->session->ciphers;
	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
		{
		len--;
		c=sk_SSL_CIPHER_value(sk,i);
		for (cp=c->name; *cp; )
			{
			if (len-- == 0)
				{
				*p='\0';
				return(buf);
				}
			else
				*(p++)= *(cp++);
			}
		*(p++)=':';
		}
	p[-1]='\0';
	return(buf);
	}
['static int init_ssl_connection(SSL *con)\n\t{\n\tint i;\n\tconst char *str;\n\tX509 *peer;\n\tlong verify_error;\n\tMS_STATIC char buf[BUFSIZ];\n\tif ((i=SSL_accept(con)) <= 0)\n\t\t{\n\t\tif (BIO_sock_should_retry(i))\n\t\t\t{\n\t\t\tBIO_printf(bio_s_out,"DELAY\\n");\n\t\t\treturn(1);\n\t\t\t}\n\t\tBIO_printf(bio_err,"ERROR\\n");\n\t\tverify_error=SSL_get_verify_result(con);\n\t\tif (verify_error != X509_V_OK)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"verify error:%s\\n",\n\t\t\t\tX509_verify_cert_error_string(verify_error));\n\t\t\t}\n\t\telse\n\t\t\tERR_print_errors(bio_err);\n\t\treturn(0);\n\t\t}\n\tPEM_write_bio_SSL_SESSION(bio_s_out,SSL_get_session(con));\n\tpeer=SSL_get_peer_certificate(con);\n\tif (peer != NULL)\n\t\t{\n\t\tBIO_printf(bio_s_out,"Client certificate\\n");\n\t\tPEM_write_bio_X509(bio_s_out,peer);\n\t\tX509_NAME_oneline(X509_get_subject_name(peer),buf,BUFSIZ);\n\t\tBIO_printf(bio_s_out,"subject=%s\\n",buf);\n\t\tX509_NAME_oneline(X509_get_issuer_name(peer),buf,BUFSIZ);\n\t\tBIO_printf(bio_s_out,"issuer=%s\\n",buf);\n\t\tX509_free(peer);\n\t\t}\n\tif (SSL_get_shared_ciphers(con,buf,BUFSIZ) != NULL)\n\t\tBIO_printf(bio_s_out,"Shared ciphers:%s\\n",buf);\n\tstr=SSL_CIPHER_get_name(SSL_get_current_cipher(con));\n\tBIO_printf(bio_s_out,"CIPHER is %s\\n",(str != NULL)?str:"(NONE)");\n\tif (con->hit) BIO_printf(bio_s_out,"Reused session-id\\n");\n\tif (SSL_ctrl(con,SSL_CTRL_GET_FLAGS,0,NULL) &\n\t\tTLS1_FLAGS_TLS_PADDING_BUG)\n\t\tBIO_printf(bio_s_out,"Peer has incorrect TLSv1 block padding\\n");\n\treturn(1);\n\t}', "char *SSL_get_shared_ciphers(SSL *s,char *buf,int len)\n\t{\n\tchar *p;\n\tconst char *cp;\n\tSTACK_OF(SSL_CIPHER) *sk;\n\tSSL_CIPHER *c;\n\tint i;\n\tif ((s->session == NULL) || (s->session->ciphers == NULL) ||\n\t\t(len < 2))\n\t\treturn(NULL);\n\tp=buf;\n\tsk=s->session->ciphers;\n\tfor (i=0; i<sk_SSL_CIPHER_num(sk); i++)\n\t\t{\n\t\tlen--;\n\t\tc=sk_SSL_CIPHER_value(sk,i);\n\t\tfor (cp=c->name; *cp; )\n\t\t\t{\n\t\t\tif (len-- == 0)\n\t\t\t\t{\n\t\t\t\t*p='\\0';\n\t\t\t\treturn(buf);\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t*(p++)= *(cp++);\n\t\t\t}\n\t\t*(p++)=':';\n\t\t}\n\tp[-1]='\\0';\n\treturn(buf);\n\t}"]