apps/s_server.c:1511: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] (⇐ [0, +oo] + -1) Size: 8192 by call to `SSL_get_shared_ciphers`.
Showing all 6 steps of the trace


apps/s_server.c:1469:1: Array declaration
1467.   	}
1468.   
1469. > static int init_ssl_connection(SSL *con)
1470.   	{
1471.   	int i;

apps/s_server.c:1511:6: Call
1509.   		}
1510.   
1511.   	if (SSL_get_shared_ciphers(con,buf,sizeof buf) != NULL)
             ^
1512.   		BIO_printf(bio_s_out,"Shared ciphers:%s\n",buf);
1513.   	str=SSL_CIPHER_get_name(SSL_get_current_cipher(con));

ssl/ssl_lib.c:1172:1: <Length trace>
1170.   
1171.   /* works well for SSLv2, not so good for SSLv3 */
1172. > char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
1173.   	{
1174.   	char *p;

ssl/ssl_lib.c:1172:1: Parameter `*buf`
  1170.   
  1171.   /* works well for SSLv2, not so good for SSLv3 */
  1172. > char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
  1173.   	{
  1174.   	char *p;

ssl/ssl_lib.c:1184:2: Assignment
  1182.   		return(NULL);
  1183.   
  1184.   	p=buf;
           ^
  1185.   	sk=s->session->ciphers;
  1186.   	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)

ssl/ssl_lib.c:1203:2: Array access: Offset: [-1, +oo] (⇐ [0, +oo] + -1) Size: 8192 by call to `SSL_get_shared_ciphers` 
  1201.   		*(p++)=':';
  1202.   		}
  1203.   	p[-1]='\0';
           ^
  1204.   	return(buf);
  1205.   	}

char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
	{
	char *p;
	const char *cp;
	STACK_OF(SSL_CIPHER) *sk;
	SSL_CIPHER *c;
	int i;
	if ((s->session == NULL) || (s->session->ciphers == NULL) ||
		(len < 2))
		return(NULL);
	p=buf;
	sk=s->session->ciphers;
	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
		{
		len--;
		c=sk_SSL_CIPHER_value(sk,i);
		for (cp=c->name; *cp; )
			{
			if (len-- == 0)
				{
				*p='\0';
				return(buf);
				}
			else
				*(p++)= *(cp++);
			}
		*(p++)=':';
		}
	p[-1]='\0';
	return(buf);
	}
['static int init_ssl_connection(SSL *con)\n\t{\n\tint i;\n\tconst char *str;\n\tX509 *peer;\n\tlong verify_error;\n\tMS_STATIC char buf[BUFSIZ];\n\tif ((i=SSL_accept(con)) <= 0)\n\t\t{\n\t\tif (BIO_sock_should_retry(i))\n\t\t\t{\n\t\t\tBIO_printf(bio_s_out,"DELAY\\n");\n\t\t\treturn(1);\n\t\t\t}\n\t\tBIO_printf(bio_err,"ERROR\\n");\n\t\tverify_error=SSL_get_verify_result(con);\n\t\tif (verify_error != X509_V_OK)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"verify error:%s\\n",\n\t\t\t\tX509_verify_cert_error_string(verify_error));\n\t\t\t}\n\t\telse\n\t\t\tERR_print_errors(bio_err);\n\t\treturn(0);\n\t\t}\n\tPEM_write_bio_SSL_SESSION(bio_s_out,SSL_get_session(con));\n\tpeer=SSL_get_peer_certificate(con);\n\tif (peer != NULL)\n\t\t{\n\t\tBIO_printf(bio_s_out,"Client certificate\\n");\n\t\tPEM_write_bio_X509(bio_s_out,peer);\n\t\tX509_NAME_oneline(X509_get_subject_name(peer),buf,sizeof buf);\n\t\tBIO_printf(bio_s_out,"subject=%s\\n",buf);\n\t\tX509_NAME_oneline(X509_get_issuer_name(peer),buf,sizeof buf);\n\t\tBIO_printf(bio_s_out,"issuer=%s\\n",buf);\n\t\tX509_free(peer);\n\t\t}\n\tif (SSL_get_shared_ciphers(con,buf,sizeof buf) != NULL)\n\t\tBIO_printf(bio_s_out,"Shared ciphers:%s\\n",buf);\n\tstr=SSL_CIPHER_get_name(SSL_get_current_cipher(con));\n\tBIO_printf(bio_s_out,"CIPHER is %s\\n",(str != NULL)?str:"(NONE)");\n\tif (con->hit) BIO_printf(bio_s_out,"Reused session-id\\n");\n\tif (SSL_ctrl(con,SSL_CTRL_GET_FLAGS,0,NULL) &\n\t\tTLS1_FLAGS_TLS_PADDING_BUG)\n\t\tBIO_printf(bio_s_out,"Peer has incorrect TLSv1 block padding\\n");\n#ifndef OPENSSL_NO_KRB5\n\tif (con->kssl_ctx->client_princ != NULL)\n\t\t{\n\t\tBIO_printf(bio_s_out,"Kerberos peer principal is %s\\n",\n\t\t\tcon->kssl_ctx->client_princ);\n\t\t}\n#endif\n\treturn(1);\n\t}', "char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)\n\t{\n\tchar *p;\n\tconst char *cp;\n\tSTACK_OF(SSL_CIPHER) *sk;\n\tSSL_CIPHER *c;\n\tint i;\n\tif ((s->session == NULL) || (s->session->ciphers == NULL) ||\n\t\t(len < 2))\n\t\treturn(NULL);\n\tp=buf;\n\tsk=s->session->ciphers;\n\tfor (i=0; i<sk_SSL_CIPHER_num(sk); i++)\n\t\t{\n\t\tlen--;\n\t\tc=sk_SSL_CIPHER_value(sk,i);\n\t\tfor (cp=c->name; *cp; )\n\t\t\t{\n\t\t\tif (len-- == 0)\n\t\t\t\t{\n\t\t\t\t*p='\\0';\n\t\t\t\treturn(buf);\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t*(p++)= *(cp++);\n\t\t\t}\n\t\t*(p++)=':';\n\t\t}\n\tp[-1]='\\0';\n\treturn(buf);\n\t}"]