ssl/statem/extensions_cust.c:357: error: BUFFER_OVERRUN_S2
  Offset added: [`ctx->cert->custext.meths_count` + 56, `ctx->cert->custext.meths_count` + 56] (⇐ `ctx->cert->custext.meths_count` + 56) Size: [1, 56⋅`ctx->cert->custext.meths_count` + 56].
Showing all 6 steps of the trace


ssl/statem/extensions_cust.c:305:1: <Length trace>
303.   }
304.   
305. > static int add_custom_ext_intern(SSL_CTX *ctx, ENDPOINT role,
306.                                    unsigned int ext_type,
307.                                    unsigned int context,

ssl/statem/extensions_cust.c:305:1: Parameter `ctx->cert->custext.meths_count`
303.   }
304.   
305. > static int add_custom_ext_intern(SSL_CTX *ctx, ENDPOINT role,
306.                                    unsigned int ext_type,
307.                                    unsigned int context,

ssl/statem/extensions_cust.c:348:9: Call
346.           return 0;
347.       /* Search for duplicate */
348.       if (custom_ext_find(exts, role, ext_type, NULL))
               ^
349.           return 0;
350.       tmp = OPENSSL_realloc(exts->meths,

ssl/statem/extensions_cust.c:78:1: Parameter `exts->meths_count`
  76.    * client, or ENDPOINT_BOTH for either
  77.    */
  78. > custom_ext_method *custom_ext_find(const custom_ext_methods *exts,
  79.                                      ENDPOINT role, unsigned int ext_type,
  80.                                      size_t *idx)

ssl/statem/extensions_cust.c:356:5: Assignment
354.   
355.       exts->meths = tmp;
356.       meth = exts->meths + exts->meths_count;
           ^
357.       memset(meth, 0, sizeof(*meth));
358.       meth->role = role;

ssl/statem/extensions_cust.c:357:5: Array access: Offset added: [ctx->cert->custext.meths_count + 56, ctx->cert->custext.meths_count + 56] (⇐ ctx->cert->custext.meths_count + 56) Size: [1, 56⋅ctx->cert->custext.meths_count + 56]
355.       exts->meths = tmp;
356.       meth = exts->meths + exts->meths_count;
357.       memset(meth, 0, sizeof(*meth));
           ^
358.       meth->role = role;
359.       meth->context = context;

static int add_custom_ext_intern(SSL_CTX *ctx, ENDPOINT role,
                                 unsigned int ext_type,
                                 unsigned int context,
                                 SSL_custom_ext_add_cb_ex add_cb,
                                 SSL_custom_ext_free_cb_ex free_cb,
                                 void *add_arg,
                                 SSL_custom_ext_parse_cb_ex parse_cb,
                                 void *parse_arg)
{
    custom_ext_methods *exts = &ctx->cert->custext;
    custom_ext_method *meth, *tmp;
    if (add_cb == NULL && free_cb != NULL)
        return 0;
#ifndef OPENSSL_NO_CT
    if (ext_type == TLSEXT_TYPE_signed_certificate_timestamp
            && (context & SSL_EXT_CLIENT_HELLO) != 0
            && SSL_CTX_ct_is_enabled(ctx))
        return 0;
#endif
    if (SSL_extension_supported(ext_type)
            && ext_type != TLSEXT_TYPE_signed_certificate_timestamp)
        return 0;
    if (ext_type > 0xffff)
        return 0;
    if (custom_ext_find(exts, role, ext_type, NULL))
        return 0;
    tmp = OPENSSL_realloc(exts->meths,
                          (exts->meths_count + 1) * sizeof(custom_ext_method));
    if (tmp == NULL)
        return 0;
    exts->meths = tmp;
    meth = exts->meths + exts->meths_count;
    memset(meth, 0, sizeof(*meth));
    meth->role = role;
    meth->context = context;
    meth->parse_cb = parse_cb;
    meth->add_cb = add_cb;
    meth->free_cb = free_cb;
    meth->ext_type = ext_type;
    meth->add_arg = add_arg;
    meth->parse_arg = parse_arg;
    exts->meths_count++;
    return 1;
}
['static int add_custom_ext_intern(SSL_CTX *ctx, ENDPOINT role,\n                                 unsigned int ext_type,\n                                 unsigned int context,\n                                 SSL_custom_ext_add_cb_ex add_cb,\n                                 SSL_custom_ext_free_cb_ex free_cb,\n                                 void *add_arg,\n                                 SSL_custom_ext_parse_cb_ex parse_cb,\n                                 void *parse_arg)\n{\n    custom_ext_methods *exts = &ctx->cert->custext;\n    custom_ext_method *meth, *tmp;\n    if (add_cb == NULL && free_cb != NULL)\n        return 0;\n#ifndef OPENSSL_NO_CT\n    if (ext_type == TLSEXT_TYPE_signed_certificate_timestamp\n            && (context & SSL_EXT_CLIENT_HELLO) != 0\n            && SSL_CTX_ct_is_enabled(ctx))\n        return 0;\n#endif\n    if (SSL_extension_supported(ext_type)\n            && ext_type != TLSEXT_TYPE_signed_certificate_timestamp)\n        return 0;\n    if (ext_type > 0xffff)\n        return 0;\n    if (custom_ext_find(exts, role, ext_type, NULL))\n        return 0;\n    tmp = OPENSSL_realloc(exts->meths,\n                          (exts->meths_count + 1) * sizeof(custom_ext_method));\n    if (tmp == NULL)\n        return 0;\n    exts->meths = tmp;\n    meth = exts->meths + exts->meths_count;\n    memset(meth, 0, sizeof(*meth));\n    meth->role = role;\n    meth->context = context;\n    meth->parse_cb = parse_cb;\n    meth->add_cb = add_cb;\n    meth->free_cb = free_cb;\n    meth->ext_type = ext_type;\n    meth->add_arg = add_arg;\n    meth->parse_arg = parse_arg;\n    exts->meths_count++;\n    return 1;\n}', 'custom_ext_method *custom_ext_find(const custom_ext_methods *exts,\n                                   ENDPOINT role, unsigned int ext_type,\n                                   size_t *idx)\n{\n    size_t i;\n    custom_ext_method *meth = exts->meths;\n    for (i = 0; i < exts->meths_count; i++, meth++) {\n        if (ext_type == meth->ext_type\n                && (role == ENDPOINT_BOTH || role == meth->role\n                    || meth->role == ENDPOINT_BOTH)) {\n            if (idx != NULL)\n                *idx = i;\n            return meth;\n        }\n    }\n    return NULL;\n}']