test/tls13encryptiontest.c:318: error: BUFFER_OVERRUN_L3
  Offset added: 8 Size: [1, +oo] by call to `load_record`.
Showing all 9 steps of the trace


test/tls13encryptiontest.c:348:13: Call
346.   
347.           /* Decrypt it */
348.           if (tls13_enc(s, &rec, 1, 0) != 1) {
                   ^
349.               fprintf(stderr, "Failed to decrypt record %"OSSLzu"\n", ctr);
350.               goto err;

ssl/record/ssl3_record_tls13.c:23:1: Parameter `recs->data->strlen`
  21.    *       an internal error occurred.
  22.    */
  23. > int tls13_enc(SSL *s, SSL3_RECORD *recs, size_t n_recs, int send)
  24.   {
  25.       EVP_CIPHER_CTX *ctx;

test/tls13encryptiontest.c:318:14: Call
316.           /* Load the record */
317.           ivlen = EVP_CIPHER_iv_length(ciph);
318.           if (!load_record(&rec, &refdata[ctr], &key, s->read_iv, ivlen,
                    ^
319.                            RECORD_LAYER_get_read_sequence(&s->rlayer))) {
320.               fprintf(stderr, "Failed loading key into EVP_CIPHER_CTX\n");

test/tls13encryptiontest.c:214:1: <Length trace>
212.   }
213.   
214. > static int load_record(SSL3_RECORD *rec, RECORD_DATA *recd, unsigned char **key,
215.                          unsigned char *iv, size_t ivlen, unsigned char *seq)
216.   {

test/tls13encryptiontest.c:214:1: Parameter `recd->seq->strlen`
  212.   }
  213.   
  214. > static int load_record(SSL3_RECORD *rec, RECORD_DATA *recd, unsigned char **key,
  215.                          unsigned char *iv, size_t ivlen, unsigned char *seq)
  216.   {

test/tls13encryptiontest.c:222:10: Call
  220.       *key = OPENSSL_hexstr2buf(recd->key, NULL);
  221.       ivtmp = OPENSSL_hexstr2buf(recd->iv, NULL);
  222.       sq = OPENSSL_hexstr2buf(recd->seq, NULL);
                  ^
  223.       pt = multihexstr2buf(recd->plaintext, &ptlen);
  224.   

crypto/o_str.c:161:9: Assignment
    159.       if ((hexbuf = OPENSSL_malloc(s >> 1)) == NULL) {
    160.           CRYPTOerr(CRYPTO_F_OPENSSL_HEXSTR2BUF, ERR_R_MALLOC_FAILURE);
    161.           return NULL;
                   ^
    162.       }
    163.       for (p = (const unsigned char *)str, q = hexbuf; *p; ) {

test/tls13encryptiontest.c:222:5: Assignment
  220.       *key = OPENSSL_hexstr2buf(recd->key, NULL);
  221.       ivtmp = OPENSSL_hexstr2buf(recd->iv, NULL);
  222.       sq = OPENSSL_hexstr2buf(recd->seq, NULL);
             ^
  223.       pt = multihexstr2buf(recd->plaintext, &ptlen);
  224.   

test/tls13encryptiontest.c:236:5: Array access: Offset added: 8 Size: [1, +oo] by call to `load_record` 
  234.       memcpy(rec->data, pt, ptlen);
  235.       OPENSSL_free(pt);
  236.       memcpy(seq, sq, SEQ_NUM_SIZE);
             ^
  237.       OPENSSL_free(sq);
  238.       memcpy(iv, ivtmp, ivlen);

static int load_record(SSL3_RECORD *rec, RECORD_DATA *recd, unsigned char **key,
                       unsigned char *iv, size_t ivlen, unsigned char *seq)
{
    unsigned char *pt = NULL, *sq = NULL, *ivtmp = NULL;
    size_t ptlen;
    *key = OPENSSL_hexstr2buf(recd->key, NULL);
    ivtmp = OPENSSL_hexstr2buf(recd->iv, NULL);
    sq = OPENSSL_hexstr2buf(recd->seq, NULL);
    pt = multihexstr2buf(recd->plaintext, &ptlen);
    if (*key == NULL || ivtmp == NULL || sq == NULL || pt == NULL)
        goto err;
    rec->data = rec->input = OPENSSL_malloc(ptlen + EVP_GCM_TLS_TAG_LEN);
    if (rec->data == NULL)
        goto err;
    rec->length = ptlen;
    memcpy(rec->data, pt, ptlen);
    OPENSSL_free(pt);
    memcpy(seq, sq, SEQ_NUM_SIZE);
    OPENSSL_free(sq);
    memcpy(iv, ivtmp, ivlen);
    OPENSSL_free(ivtmp);
    return 1;
 err:
    OPENSSL_free(*key);
    *key = NULL;
    OPENSSL_free(ivtmp);
    OPENSSL_free(sq);
    OPENSSL_free(pt);
    return 0;
}
['static int test_tls13_encryption(void)\n{\n    SSL_CTX *ctx = NULL;\n    SSL *s = NULL;\n    SSL3_RECORD rec;\n    unsigned char *key = NULL, *iv = NULL, *seq = NULL;\n    const EVP_CIPHER *ciph = EVP_aes_128_gcm();\n    int ret = 0;\n    size_t ivlen, ctr;\n    rec.data = NULL;\n    ctx = SSL_CTX_new(TLS_method());\n    if (ctx == NULL) {\n        fprintf(stderr, "Failed creating SSL_CTX\\n");\n        goto err;\n    }\n    s = SSL_new(ctx);\n    if (s == NULL) {\n        fprintf(stderr, "Failed creating SSL\\n");\n        goto err;\n    }\n    s->enc_read_ctx = EVP_CIPHER_CTX_new();\n    s->enc_write_ctx = EVP_CIPHER_CTX_new();\n    if (s->enc_read_ctx == NULL || s->enc_write_ctx == NULL) {\n        fprintf(stderr, "Failed creating EVP_CIPHER_CTX\\n");\n        goto err;\n    }\n    for (ctr = 0; ctr < OSSL_NELEM(refdata); ctr++) {\n        ivlen = EVP_CIPHER_iv_length(ciph);\n        if (!load_record(&rec, &refdata[ctr], &key, s->read_iv, ivlen,\n                         RECORD_LAYER_get_read_sequence(&s->rlayer))) {\n            fprintf(stderr, "Failed loading key into EVP_CIPHER_CTX\\n");\n            goto err;\n        }\n        memcpy(RECORD_LAYER_get_write_sequence(&s->rlayer),\n               RECORD_LAYER_get_read_sequence(&s->rlayer), SEQ_NUM_SIZE);\n        memcpy(s->write_iv, s->read_iv, ivlen);\n        if (EVP_CipherInit_ex(s->enc_write_ctx, ciph, NULL, key, NULL, 1) <= 0\n                || EVP_CipherInit_ex(s->enc_read_ctx, ciph, NULL, key, NULL, 0)\n                   <= 0) {\n            fprintf(stderr, "Failed loading key into EVP_CIPHER_CTX\\n");\n            goto err;\n        }\n        if (tls13_enc(s, &rec, 1, 1) != 1) {\n            fprintf(stderr, "Failed to encrypt record %"OSSLzu"\\n", ctr);\n            goto err;\n        }\n        if (!test_record(&rec, &refdata[ctr], 1)) {\n            fprintf(stderr, "Record %"OSSLzu" encryption test failed\\n", ctr);\n            goto err;\n        }\n        if (tls13_enc(s, &rec, 1, 0) != 1) {\n            fprintf(stderr, "Failed to decrypt record %"OSSLzu"\\n", ctr);\n            goto err;\n        }\n        if (!test_record(&rec, &refdata[ctr], 0)) {\n            fprintf(stderr, "Record %"OSSLzu" decryption test failed\\n", ctr);\n            goto err;\n        }\n        OPENSSL_free(rec.data);\n        OPENSSL_free(key);\n        OPENSSL_free(iv);\n        OPENSSL_free(seq);\n        rec.data = NULL;\n        key = NULL;\n        iv = NULL;\n        seq = NULL;\n    }\n    fprintf(stderr, "PASS: %"OSSLzu" records tested\\n", ctr);\n    ret = 1;\n err:\n    OPENSSL_free(rec.data);\n    OPENSSL_free(key);\n    OPENSSL_free(iv);\n    OPENSSL_free(seq);\n    SSL_free(s);\n    SSL_CTX_free(ctx);\n    return ret;\n}', 'int tls13_enc(SSL *s, SSL3_RECORD *recs, size_t n_recs, int send)\n{\n    EVP_CIPHER_CTX *ctx;\n    unsigned char iv[EVP_MAX_IV_LENGTH];\n    size_t ivlen, offset, loop;\n    unsigned char *staticiv;\n    unsigned char *seq;\n    int lenu, lenf;\n    SSL3_RECORD *rec = &recs[0];\n    if (n_recs != 1) {\n        return -1;\n    }\n    if (send) {\n        ctx = s->enc_write_ctx;\n        staticiv = s->write_iv;\n        seq = RECORD_LAYER_get_write_sequence(&s->rlayer);\n    } else {\n        ctx = s->enc_read_ctx;\n        staticiv = s->read_iv;\n        seq = RECORD_LAYER_get_read_sequence(&s->rlayer);\n    }\n    if (ctx == NULL) {\n        memmove(rec->data, rec->input, rec->length);\n        rec->input = rec->data;\n        return 1;\n    }\n    ivlen = EVP_CIPHER_CTX_iv_length(ctx);\n    if (!send) {\n        if (rec->length < EVP_GCM_TLS_TAG_LEN)\n            return 0;\n        rec->length -= EVP_GCM_TLS_TAG_LEN;\n    }\n    if (ivlen < SEQ_NUM_SIZE) {\n        return -1;\n    }\n    offset = ivlen - SEQ_NUM_SIZE;\n    memcpy(iv, staticiv, offset);\n    for (loop = 0; loop < SEQ_NUM_SIZE; loop++)\n        iv[offset + loop] = staticiv[offset + loop] ^ seq[loop];\n    if (EVP_CipherInit_ex(ctx, NULL, NULL, NULL, iv, send) <= 0\n            || EVP_CipherUpdate(ctx, rec->data, &lenu, rec->input,\n                                (unsigned int)rec->length) <= 0\n            || (!send && EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,\n                                             EVP_GCM_TLS_TAG_LEN,\n                                             rec->data + rec->length) <= 0)\n            || EVP_CipherFinal_ex(ctx, rec->data + lenu, &lenf) <= 0\n            || (size_t)(lenu + lenf) != rec->length) {\n        return -1;\n    }\n    if (send) {\n        if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, EVP_GCM_TLS_TAG_LEN,\n                                rec->data + rec->length) <= 0)\n            return -1;\n        rec->length += EVP_GCM_TLS_TAG_LEN;\n    }\n    return 1;\n}', 'static int load_record(SSL3_RECORD *rec, RECORD_DATA *recd, unsigned char **key,\n                       unsigned char *iv, size_t ivlen, unsigned char *seq)\n{\n    unsigned char *pt = NULL, *sq = NULL, *ivtmp = NULL;\n    size_t ptlen;\n    *key = OPENSSL_hexstr2buf(recd->key, NULL);\n    ivtmp = OPENSSL_hexstr2buf(recd->iv, NULL);\n    sq = OPENSSL_hexstr2buf(recd->seq, NULL);\n    pt = multihexstr2buf(recd->plaintext, &ptlen);\n    if (*key == NULL || ivtmp == NULL || sq == NULL || pt == NULL)\n        goto err;\n    rec->data = rec->input = OPENSSL_malloc(ptlen + EVP_GCM_TLS_TAG_LEN);\n    if (rec->data == NULL)\n        goto err;\n    rec->length = ptlen;\n    memcpy(rec->data, pt, ptlen);\n    OPENSSL_free(pt);\n    memcpy(seq, sq, SEQ_NUM_SIZE);\n    OPENSSL_free(sq);\n    memcpy(iv, ivtmp, ivlen);\n    OPENSSL_free(ivtmp);\n    return 1;\n err:\n    OPENSSL_free(*key);\n    *key = NULL;\n    OPENSSL_free(ivtmp);\n    OPENSSL_free(sq);\n    OPENSSL_free(pt);\n    return 0;\n}', "unsigned char *OPENSSL_hexstr2buf(const char *str, long *len)\n{\n    unsigned char *hexbuf, *q;\n    unsigned char ch, cl;\n    int chi, cli;\n    const unsigned char *p;\n    size_t s;\n    s = strlen(str);\n    if ((hexbuf = OPENSSL_malloc(s >> 1)) == NULL) {\n        CRYPTOerr(CRYPTO_F_OPENSSL_HEXSTR2BUF, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    for (p = (const unsigned char *)str, q = hexbuf; *p; ) {\n        ch = *p++;\n        if (ch == ':')\n            continue;\n        cl = *p++;\n        if (!cl) {\n            CRYPTOerr(CRYPTO_F_OPENSSL_HEXSTR2BUF,\n                      CRYPTO_R_ODD_NUMBER_OF_DIGITS);\n            OPENSSL_free(hexbuf);\n            return NULL;\n        }\n        cli = OPENSSL_hexchar2int(cl);\n        chi = OPENSSL_hexchar2int(ch);\n        if (cli < 0 || chi < 0) {\n            OPENSSL_free(hexbuf);\n            CRYPTOerr(CRYPTO_F_OPENSSL_HEXSTR2BUF, CRYPTO_R_ILLEGAL_HEX_DIGIT);\n            return NULL;\n        }\n        *q++ = (unsigned char)((chi << 4) | cli);\n    }\n    if (len)\n        *len = q - hexbuf;\n    return hexbuf;\n}"]