ssl/statem/statem_clnt.c:2831: error: BUFFER_OVERRUN_L3
  Offset added: [1, 15] Size: [0, +oo] by call to `ssl_randbytes`.
Showing all 11 steps of the trace


ssl/statem/statem_clnt.c:2820:5: Assignment
2818.       }
2819.   
2820.       pmslen = SSL_MAX_MASTER_KEY_LENGTH;
            ^
2821.       pms = OPENSSL_malloc(pmslen);
2822.       if (pms == NULL) {

ssl/statem/statem_clnt.c:2831:9: Call
2829.       pms[1] = s->client_version & 0xff;
2830.       /* TODO(size_t): Convert this function */
2831.       if (ssl_randbytes(s, pms + 2, (int)(pmslen - 2)) <= 0) {
                ^
2832.           SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,
2833.                    ERR_R_MALLOC_FAILURE);

ssl/ssl_lib.c:5172:1: Parameter `size`
  5170.   }
  5171.   
  5172. > int ssl_randbytes(SSL *s, unsigned char *rnd, size_t size)
  5173.   {
  5174.       if (s->drbg != NULL) {

ssl/ssl_lib.c:5187:17: Call
  5185.            * here.
  5186.            */
  5187.            return RAND_DRBG_generate(s->drbg, rnd, size, 0, NULL, 0);
                          ^
  5188.       }
  5189.       return RAND_bytes(rnd, (int)size);

crypto/rand/drbg_lib.c:363:1: Parameter `outlen`
    361.    *
    362.    */
    363. > int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,
    364.                          int prediction_resistance,
    365.                          const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_lib.c:409:10: Call
    407.       }
    408.   
    409.       if (!ctr_generate(drbg, out, outlen, adin, adinlen)) {
                    ^
    410.           drbg->state = DRBG_ERROR;
    411.           RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);

crypto/rand/drbg_rand.c:266:1: <Offset trace>
264.   }
265.   
266. > int ctr_generate(RAND_DRBG *drbg,
267.                    unsigned char *out, size_t outlen,
268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: Parameter `outlen`
      264.   }
      265.   
      266. > int ctr_generate(RAND_DRBG *drbg,
      267.                    unsigned char *out, size_t outlen,
      268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: <Length trace>
264.   }
265.   
266. > int ctr_generate(RAND_DRBG *drbg,
267.                    unsigned char *out, size_t outlen,
268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: Parameter `drbg->ctr.K[*]`
      264.   }
      265.   
      266. > int ctr_generate(RAND_DRBG *drbg,
      267.                    unsigned char *out, size_t outlen,
      268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:288:13: Array access: Offset added: [1, 15] Size: [0, +oo] by call to `ssl_randbytes` 
      286.               /* Use K as temp space as it will be updated */
      287.               AES_encrypt(ctr->V, ctr->K, &ctr->ks);
      288.               memcpy(out, ctr->K, outlen);
                         ^
      289.               break;
      290.           }

int ctr_generate(RAND_DRBG *drbg,
                 unsigned char *out, size_t outlen,
                 const unsigned char *adin, size_t adinlen)
{
    RAND_DRBG_CTR *ctr = &drbg->ctr;
    if (adin != NULL && adinlen != 0) {
        ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);
        if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) {
            adin = NULL;
            adinlen = 1;
        }
    } else {
        adinlen = 0;
    }
    for ( ; ; ) {
        inc_128(ctr);
        if (outlen < 16) {
            AES_encrypt(ctr->V, ctr->K, &ctr->ks);
            memcpy(out, ctr->K, outlen);
            break;
        }
        AES_encrypt(ctr->V, out, &ctr->ks);
        out += 16;
        outlen -= 16;
        if (outlen == 0)
            break;
    }
    ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);
    return 1;
}
['static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt)\n{\n#ifndef OPENSSL_NO_RSA\n    unsigned char *encdata = NULL;\n    EVP_PKEY *pkey = NULL;\n    EVP_PKEY_CTX *pctx = NULL;\n    size_t enclen;\n    unsigned char *pms = NULL;\n    size_t pmslen = 0;\n    if (s->session->peer == NULL) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n                 ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    pkey = X509_get0_pubkey(s->session->peer);\n    if (EVP_PKEY_get0_RSA(pkey) == NULL) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n                 ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    pmslen = SSL_MAX_MASTER_KEY_LENGTH;\n    pms = OPENSSL_malloc(pmslen);\n    if (pms == NULL) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n                 ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    pms[0] = s->client_version >> 8;\n    pms[1] = s->client_version & 0xff;\n    if (ssl_randbytes(s, pms + 2, (int)(pmslen - 2)) <= 0) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n                 ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    if (s->version > SSL3_VERSION && !WPACKET_start_sub_packet_u16(pkt)) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n                 ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    pctx = EVP_PKEY_CTX_new(pkey, NULL);\n    if (pctx == NULL || EVP_PKEY_encrypt_init(pctx) <= 0\n        || EVP_PKEY_encrypt(pctx, NULL, &enclen, pms, pmslen) <= 0) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n                 ERR_R_EVP_LIB);\n        goto err;\n    }\n    if (!WPACKET_allocate_bytes(pkt, enclen, &encdata)\n            || EVP_PKEY_encrypt(pctx, encdata, &enclen, pms, pmslen) <= 0) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n                 SSL_R_BAD_RSA_ENCRYPT);\n        goto err;\n    }\n    EVP_PKEY_CTX_free(pctx);\n    pctx = NULL;\n    if (s->version > SSL3_VERSION && !WPACKET_close(pkt)) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n                 ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    if (!ssl_log_rsa_client_key_exchange(s, encdata, enclen, pms, pmslen)) {\n        goto err;\n    }\n    s->s3->tmp.pms = pms;\n    s->s3->tmp.pmslen = pmslen;\n    return 1;\n err:\n    OPENSSL_clear_free(pms, pmslen);\n    EVP_PKEY_CTX_free(pctx);\n    return 0;\n#else\n    SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_CKE_RSA,\n             ERR_R_INTERNAL_ERROR);\n    return 0;\n#endif\n}', 'int ssl_randbytes(SSL *s, unsigned char *rnd, size_t size)\n{\n    if (s->drbg != NULL) {\n         return RAND_DRBG_generate(s->drbg, rnd, size, 0, NULL, 0);\n    }\n    return RAND_bytes(rnd, (int)size);\n}', 'int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,\n                       int prediction_resistance,\n                       const unsigned char *adin, size_t adinlen)\n{\n    int reseed_required = 0;\n    if (drbg->state != DRBG_READY) {\n        rand_drbg_restart(drbg, NULL, 0, 0);\n        if (drbg->state == DRBG_ERROR) {\n            RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_IN_ERROR_STATE);\n            return 0;\n        }\n        if (drbg->state == DRBG_UNINITIALISED) {\n            RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_NOT_INSTANTIATED);\n            return 0;\n        }\n    }\n    if (outlen > drbg->max_request) {\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_REQUEST_TOO_LARGE_FOR_DRBG);\n        return 0;\n    }\n    if (adinlen > drbg->max_adinlen) {\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_ADDITIONAL_INPUT_TOO_LONG);\n        return 0;\n    }\n    if (drbg->fork_count != rand_fork_count) {\n        drbg->fork_count = rand_fork_count;\n        reseed_required = 1;\n    }\n    if (drbg->reseed_counter >= drbg->reseed_interval)\n        reseed_required = 1;\n    if (reseed_required || prediction_resistance) {\n        if (!RAND_DRBG_reseed(drbg, adin, adinlen)) {\n            RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_RESEED_ERROR);\n            return 0;\n        }\n        adin = NULL;\n        adinlen = 0;\n    }\n    if (!ctr_generate(drbg, out, outlen, adin, adinlen)) {\n        drbg->state = DRBG_ERROR;\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);\n        return 0;\n    }\n    drbg->reseed_counter++;\n    return 1;\n}', 'int ctr_generate(RAND_DRBG *drbg,\n                 unsigned char *out, size_t outlen,\n                 const unsigned char *adin, size_t adinlen)\n{\n    RAND_DRBG_CTR *ctr = &drbg->ctr;\n    if (adin != NULL && adinlen != 0) {\n        ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);\n        if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) {\n            adin = NULL;\n            adinlen = 1;\n        }\n    } else {\n        adinlen = 0;\n    }\n    for ( ; ; ) {\n        inc_128(ctr);\n        if (outlen < 16) {\n            AES_encrypt(ctr->V, ctr->K, &ctr->ks);\n            memcpy(out, ctr->K, outlen);\n            break;\n        }\n        AES_encrypt(ctr->V, out, &ctr->ks);\n        out += 16;\n        outlen -= 16;\n        if (outlen == 0)\n            break;\n    }\n    ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);\n    return 1;\n}']