ssl/statem/statem_lib.c:256: error: BUFFER_OVERRUN_S2
  Offset: [`s->method->ssl3_enc->hhlen` + 3, `s->method->ssl3_enc->hhlen` + 3] Size: [1, 2147483644] by call to `ssl_add_cert_chain`.
Showing all 9 steps of the trace


ssl/statem/statem_lib.c:251:1: Parameter `s->method->ssl3_enc->hhlen`
249.   }
250.   
251. > unsigned long ssl3_output_cert_chain(SSL *s, CERT_PKEY *cpk)
252.   {
253.       unsigned char *p;

ssl/statem/statem_lib.c:254:5: Assignment
252.   {
253.       unsigned char *p;
254.       unsigned long l = 3 + SSL_HM_HEADER_LENGTH(s);
           ^
255.   
256.       if (!ssl_add_cert_chain(s, cpk, &l))

ssl/statem/statem_lib.c:256:10: Call
254.       unsigned long l = 3 + SSL_HM_HEADER_LENGTH(s);
255.   
256.       if (!ssl_add_cert_chain(s, cpk, &l))
                ^
257.           return 0;
258.   

ssl/ssl_cert.c:771:1: Parameter `*l`
  769.   
  770.   /* Add certificate chain to internal SSL BUF_MEM structure */
  771. > int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l)
  772.   {
  773.       BUF_MEM *buf = s->init_buf;

ssl/ssl_cert.c:856:14: Call
  854.               return 0;
  855.           }
  856.           if (!ssl_add_cert_to_buf(buf, l, x))
                      ^
  857.               return 0;
  858.           for (i = 0; i < sk_X509_num(extra_certs); i++) {

ssl/ssl_cert.c:747:1: <Length trace>
745.   /* Add a certificate to a BUF_MEM structure */
746.   
747. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
748.   {
749.       int n;

ssl/ssl_cert.c:747:1: Parameter `*l`
    745.   /* Add a certificate to a BUF_MEM structure */
    746.   
    747. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
    748.   {
    749.       int n;

ssl/ssl_cert.c:757:5: Assignment
    755.           return 0;
    756.       }
    757.       p = (unsigned char *)&(buf->data[*l]);
               ^
    758.       l2n3(n, p);
    759.       n = i2d_X509(x, &p);

ssl/ssl_cert.c:758:5: Array access: Offset: [s->method->ssl3_enc->hhlen + 3, s->method->ssl3_enc->hhlen + 3] Size: [1, 2147483644] by call to `ssl_add_cert_chain` 
    756.       }
    757.       p = (unsigned char *)&(buf->data[*l]);
    758.       l2n3(n, p);
               ^
    759.       n = i2d_X509(x, &p);
    760.       if (n < 0) {

static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
{
    int n;
    unsigned char *p;
    n = i2d_X509(x, NULL);
    if (n < 0 || !BUF_MEM_grow_clean(buf, (int)(n + (*l) + 3))) {
        SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);
        return 0;
    }
    p = (unsigned char *)&(buf->data[*l]);
    l2n3(n, p);
    n = i2d_X509(x, &p);
    if (n < 0) {
        SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);
        return 0;
    }
    *l += n + 3;
    return 1;
}
['unsigned long ssl3_output_cert_chain(SSL *s, CERT_PKEY *cpk)\n{\n    unsigned char *p;\n    unsigned long l = 3 + SSL_HM_HEADER_LENGTH(s);\n    if (!ssl_add_cert_chain(s, cpk, &l))\n        return 0;\n    l -= 3 + SSL_HM_HEADER_LENGTH(s);\n    p = ssl_handshake_start(s);\n    l2n3(l, p);\n    l += 3;\n    if (!ssl_set_handshake_header(s, SSL3_MT_CERTIFICATE, l)) {\n        SSLerr(SSL_F_SSL3_OUTPUT_CERT_CHAIN, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    return l + SSL_HM_HEADER_LENGTH(s);\n}', 'int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l)\n{\n    BUF_MEM *buf = s->init_buf;\n    int i, chain_count;\n    X509 *x;\n    STACK_OF(X509) *extra_certs;\n    STACK_OF(X509) *chain = NULL;\n    X509_STORE *chain_store;\n    if (!BUF_MEM_grow_clean(buf, 10)) {\n        SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, ERR_R_BUF_LIB);\n        return 0;\n    }\n    if (!cpk || !cpk->x509)\n        return 1;\n    x = cpk->x509;\n    if (cpk->chain)\n        extra_certs = cpk->chain;\n    else\n        extra_certs = s->ctx->extra_certs;\n    if ((s->mode & SSL_MODE_NO_AUTO_CHAIN) || extra_certs)\n        chain_store = NULL;\n    else if (s->cert->chain_store)\n        chain_store = s->cert->chain_store;\n    else\n        chain_store = s->ctx->cert_store;\n    if (chain_store) {\n        X509_STORE_CTX* xs_ctx = X509_STORE_CTX_new();\n        if (xs_ctx == NULL) {\n            SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, ERR_R_MALLOC_FAILURE);\n            return (0);\n        }\n        if (!X509_STORE_CTX_init(xs_ctx, chain_store, x, NULL)) {\n            X509_STORE_CTX_free(xs_ctx);\n            SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, ERR_R_X509_LIB);\n            return (0);\n        }\n        (void) X509_verify_cert(xs_ctx);\n        ERR_clear_error();\n        chain =  X509_STORE_CTX_get0_chain(xs_ctx);\n        i = ssl_security_cert_chain(s, chain, NULL, 0);\n        if (i != 1) {\n#if 0\n            SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, SSL_R_EE_KEY_TOO_SMALL);\n            SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, SSL_R_CA_KEY_TOO_SMALL);\n            SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, SSL_R_CA_MD_TOO_WEAK);\n#endif\n            X509_STORE_CTX_free(xs_ctx);\n            SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, i);\n            return 0;\n        }\n        chain_count = sk_X509_num(chain);\n        for (i = 0; i < chain_count; i++) {\n            x = sk_X509_value(chain, i);\n            if (!ssl_add_cert_to_buf(buf, l, x)) {\n                X509_STORE_CTX_free(xs_ctx);\n                return 0;\n            }\n        }\n        X509_STORE_CTX_free(xs_ctx);\n    } else {\n        i = ssl_security_cert_chain(s, extra_certs, x, 0);\n        if (i != 1) {\n            SSLerr(SSL_F_SSL_ADD_CERT_CHAIN, i);\n            return 0;\n        }\n        if (!ssl_add_cert_to_buf(buf, l, x))\n            return 0;\n        for (i = 0; i < sk_X509_num(extra_certs); i++) {\n            x = sk_X509_value(extra_certs, i);\n            if (!ssl_add_cert_to_buf(buf, l, x))\n                return 0;\n        }\n    }\n    return 1;\n}', 'static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)\n{\n    int n;\n    unsigned char *p;\n    n = i2d_X509(x, NULL);\n    if (n < 0 || !BUF_MEM_grow_clean(buf, (int)(n + (*l) + 3))) {\n        SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);\n        return 0;\n    }\n    p = (unsigned char *)&(buf->data[*l]);\n    l2n3(n, p);\n    n = i2d_X509(x, &p);\n    if (n < 0) {\n        SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);\n        return 0;\n    }\n    *l += n + 3;\n    return 1;\n}']