ssl/ssl_lib.c:5134: error: BUFFER_OVERRUN_S2
  Offset: [`prefix->strlen` + 1, +oo] Size: [1, 2⋅`parameter_2_len` + 2⋅`parameter_1_len` + `prefix->strlen` + 3].
Showing all 6 steps of the trace


ssl/ssl_lib.c:5094:1: <Length trace>
5092.   }
5093.   
5094. > static int nss_keylog_int(const char *prefix,
5095.                             SSL *ssl,
5096.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:5094:1: Parameter `prefix->strlen`
5092.   }
5093.   
5094. > static int nss_keylog_int(const char *prefix,
5095.                             SSL *ssl,
5096.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:5118:5: Assignment
5116.        * hexadecimal, so we need a buffer that is twice their lengths.
5117.        */
5118.       prefix_len = strlen(prefix);
            ^
5119.       out_len = prefix_len + (2 * parameter_1_len) + (2 * parameter_2_len) + 3;
5120.       if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {

ssl/ssl_lib.c:5127:5: Assignment
5125.   
5126.       strcpy(cursor, prefix);
5127.       cursor += prefix_len;
            ^
5128.       *cursor++ = ' ';
5129.   

ssl/ssl_lib.c:5128:6: Assignment
5126.       strcpy(cursor, prefix);
5127.       cursor += prefix_len;
5128.       *cursor++ = ' ';
             ^
5129.   
5130.       for (i = 0; i < parameter_1_len; i++) {

ssl/ssl_lib.c:5134:5: Array access: Offset: [prefix->strlen + 1, +oo] Size: [1, 2⋅parameter_2_len + 2⋅parameter_1_len + prefix->strlen + 3]
5132.           cursor += 2;
5133.       }
5134.       *cursor++ = ' ';
            ^
5135.   
5136.       for (i = 0; i < parameter_2_len; i++) {

static int nss_keylog_int(const char *prefix,
                          SSL *ssl,
                          const uint8_t *parameter_1,
                          size_t parameter_1_len,
                          const uint8_t *parameter_2,
                          size_t parameter_2_len)
{
    char *out = NULL;
    char *cursor = NULL;
    size_t out_len = 0;
    size_t i;
    size_t prefix_len;
    if (ssl->ctx->keylog_callback == NULL)
        return 1;
    prefix_len = strlen(prefix);
    out_len = prefix_len + (2 * parameter_1_len) + (2 * parameter_2_len) + 3;
    if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
        SSLfatal(ssl, SSL_AD_INTERNAL_ERROR, SSL_F_NSS_KEYLOG_INT,
                 ERR_R_MALLOC_FAILURE);
        return 0;
    }
    strcpy(cursor, prefix);
    cursor += prefix_len;
    *cursor++ = ' ';
    for (i = 0; i < parameter_1_len; i++) {
        sprintf(cursor, "%02x", parameter_1[i]);
        cursor += 2;
    }
    *cursor++ = ' ';
    for (i = 0; i < parameter_2_len; i++) {
        sprintf(cursor, "%02x", parameter_2[i]);
        cursor += 2;
    }
    *cursor = '\0';
    ssl->ctx->keylog_callback(ssl, (const char *)out);
    OPENSSL_clear_free(out, out_len);
    return 1;
}
['static int nss_keylog_int(const char *prefix,\n                          SSL *ssl,\n                          const uint8_t *parameter_1,\n                          size_t parameter_1_len,\n                          const uint8_t *parameter_2,\n                          size_t parameter_2_len)\n{\n    char *out = NULL;\n    char *cursor = NULL;\n    size_t out_len = 0;\n    size_t i;\n    size_t prefix_len;\n    if (ssl->ctx->keylog_callback == NULL)\n        return 1;\n    prefix_len = strlen(prefix);\n    out_len = prefix_len + (2 * parameter_1_len) + (2 * parameter_2_len) + 3;\n    if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {\n        SSLfatal(ssl, SSL_AD_INTERNAL_ERROR, SSL_F_NSS_KEYLOG_INT,\n                 ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    strcpy(cursor, prefix);\n    cursor += prefix_len;\n    *cursor++ = \' \';\n    for (i = 0; i < parameter_1_len; i++) {\n        sprintf(cursor, "%02x", parameter_1[i]);\n        cursor += 2;\n    }\n    *cursor++ = \' \';\n    for (i = 0; i < parameter_2_len; i++) {\n        sprintf(cursor, "%02x", parameter_2[i]);\n        cursor += 2;\n    }\n    *cursor = \'\\0\';\n    ssl->ctx->keylog_callback(ssl, (const char *)out);\n    OPENSSL_clear_free(out, out_len);\n    return 1;\n}']