ssl/s3_clnt.c:1125: error: INTEGER_OVERFLOW_L2
  ([1, +oo] - [0, 32]):unsigned64 by call to `PACKET_get_bytes`.
Showing all 11 steps of the trace


ssl/s3_clnt.c:1079:10: Call
1077.   
1078.       /* get the session-id length */
1079.       if (!PACKET_get_1(&pkt, &j)
                 ^
1080.               || (j > sizeof s->session->session_id)
1081.               || (j > SSL3_SESSION_ID_SIZE)) {

ssl/packet_locl.h:250:10: Call
  248.   __owur static inline int PACKET_get_1(PACKET *pkt, unsigned int *data)
  249.   {
  250.       if (!PACKET_peek_1(pkt, data))
                  ^
  251.           return 0;
  252.   

ssl/packet_locl.h:237:8: Parameter `*data`
    235.   
    236.   /* Peek ahead at 1 byte from |pkt| and store the value in |*data| */
    237.   __owur static inline int PACKET_peek_1(const PACKET *pkt, unsigned int *data)
                  ^
    238.   {
    239.       if (!PACKET_remaining(pkt))

ssl/s3_clnt.c:1125:10: Call
1123.   
1124.       /* Get the session id */
1125.       if (!PACKET_get_bytes(&pkt, &session_id, j)) {
                 ^
1126.           SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_LENGTH_MISMATCH);
1127.           al = SSL_AD_DECODE_ERROR;

ssl/packet_locl.h:313:8: Parameter `len`
  311.    * freed
  312.    */
  313.   __owur static inline int PACKET_get_bytes(PACKET *pkt, unsigned char **data,
                ^
  314.                                             size_t len)
  315.   {

ssl/packet_locl.h:319:5: Call
  317.           return 0;
  318.   
  319.       packet_forward(pkt, len);
             ^
  320.   
  321.       return 1;

ssl/packet_locl.h:79:1: <LHS trace>
77.   
78.   /* Internal unchecked shorthand; don't use outside this file. */
79. > static inline void packet_forward(PACKET *pkt, size_t len)
80.   {
81.       pkt->curr += len;

ssl/packet_locl.h:79:1: Parameter `pkt->remaining`
    77.   
    78.   /* Internal unchecked shorthand; don't use outside this file. */
    79. > static inline void packet_forward(PACKET *pkt, size_t len)
    80.   {
    81.       pkt->curr += len;

ssl/packet_locl.h:79:1: <RHS trace>
77.   
78.   /* Internal unchecked shorthand; don't use outside this file. */
79. > static inline void packet_forward(PACKET *pkt, size_t len)
80.   {
81.       pkt->curr += len;

ssl/packet_locl.h:79:1: Parameter `len`
    77.   
    78.   /* Internal unchecked shorthand; don't use outside this file. */
    79. > static inline void packet_forward(PACKET *pkt, size_t len)
    80.   {
    81.       pkt->curr += len;

ssl/packet_locl.h:82:5: Binary operation: ([1, +oo] - [0, 32]):unsigned64 by call to `PACKET_get_bytes` 
    80.   {
    81.       pkt->curr += len;
    82.       pkt->remaining -= len;
              ^
    83.   }
    84.   

static inline void packet_forward(PACKET *pkt, size_t len)
{
    pkt->curr += len;
    pkt->remaining -= len;
}
['int ssl3_get_server_hello(SSL *s)\n{\n    STACK_OF(SSL_CIPHER) *sk;\n    const SSL_CIPHER *c;\n    PACKET pkt;\n    unsigned char *session_id, *cipherchars;\n    int i, al = SSL_AD_INTERNAL_ERROR, ok;\n    unsigned int j;\n    long n;\n#ifndef OPENSSL_NO_COMP\n    SSL_COMP *comp;\n#endif\n    s->first_packet = 1;\n    n = s->method->ssl_get_message(s,\n                                   SSL3_ST_CR_SRVR_HELLO_A,\n                                   SSL3_ST_CR_SRVR_HELLO_B, -1, 20000, &ok);\n    if (!ok)\n        return ((int)n);\n    s->first_packet = 0;\n    if (SSL_IS_DTLS(s)) {\n        if (s->s3->tmp.message_type == DTLS1_MT_HELLO_VERIFY_REQUEST) {\n            if (s->d1->send_cookie == 0) {\n                s->s3->tmp.reuse_message = 1;\n                return 1;\n            } else {\n                al = SSL_AD_UNEXPECTED_MESSAGE;\n                SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_BAD_MESSAGE_TYPE);\n                goto f_err;\n            }\n        }\n    }\n    if (s->s3->tmp.message_type != SSL3_MT_SERVER_HELLO) {\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_BAD_MESSAGE_TYPE);\n        goto f_err;\n    }\n    if (!PACKET_buf_init(&pkt, s->init_msg, n)) {\n        al = SSL_AD_INTERNAL_ERROR;\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, ERR_R_INTERNAL_ERROR);\n        goto f_err;\n    }\n    if (s->method->version == TLS_ANY_VERSION) {\n        unsigned int sversion;\n        if (!PACKET_get_net_2(&pkt, &sversion)) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_LENGTH_MISMATCH);\n            goto f_err;\n        }\n#if TLS_MAX_VERSION != TLS1_2_VERSION\n#error Code needs updating for new TLS version\n#endif\n#ifndef OPENSSL_NO_SSL3\n        if ((sversion == SSL3_VERSION) && !(s->options & SSL_OP_NO_SSLv3)) {\n            if (FIPS_mode()) {\n                SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,\n                       SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);\n                al = SSL_AD_PROTOCOL_VERSION;\n                goto f_err;\n            }\n            s->method = SSLv3_client_method();\n        } else\n#endif\n        if ((sversion == TLS1_VERSION) && !(s->options & SSL_OP_NO_TLSv1)) {\n            s->method = TLSv1_client_method();\n        } else if ((sversion == TLS1_1_VERSION) &&\n                   !(s->options & SSL_OP_NO_TLSv1_1)) {\n            s->method = TLSv1_1_client_method();\n        } else if ((sversion == TLS1_2_VERSION) &&\n                   !(s->options & SSL_OP_NO_TLSv1_2)) {\n            s->method = TLSv1_2_client_method();\n        } else {\n            SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_UNSUPPORTED_PROTOCOL);\n            al = SSL_AD_PROTOCOL_VERSION;\n            goto f_err;\n        }\n        s->session->ssl_version = s->version = s->method->version;\n        if (!ssl_security(s, SSL_SECOP_VERSION, 0, s->version, NULL)) {\n            SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_VERSION_TOO_LOW);\n            al = SSL_AD_PROTOCOL_VERSION;\n            goto f_err;\n        }\n    } else if (s->method->version == DTLS_ANY_VERSION) {\n        unsigned int hversion;\n        int options;\n        if (!PACKET_get_net_2(&pkt, &hversion)) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_LENGTH_MISMATCH);\n            goto f_err;\n        }\n        options = s->options;\n        if (hversion == DTLS1_2_VERSION && !(options & SSL_OP_NO_DTLSv1_2))\n            s->method = DTLSv1_2_client_method();\n        else if (tls1_suiteb(s)) {\n            SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,\n                   SSL_R_ONLY_DTLS_1_2_ALLOWED_IN_SUITEB_MODE);\n            s->version = hversion;\n            al = SSL_AD_PROTOCOL_VERSION;\n            goto f_err;\n        } else if (hversion == DTLS1_VERSION && !(options & SSL_OP_NO_DTLSv1))\n            s->method = DTLSv1_client_method();\n        else {\n            SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_WRONG_SSL_VERSION);\n            s->version = hversion;\n            al = SSL_AD_PROTOCOL_VERSION;\n            goto f_err;\n        }\n        s->session->ssl_version = s->version = s->method->version;\n    } else {\n        unsigned char *vers;\n        if (!PACKET_get_bytes(&pkt, &vers, 2)) {\n            al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_LENGTH_MISMATCH);\n            goto f_err;\n        }\n        if ((vers[0] != (s->version >> 8))\n                || (vers[1] != (s->version & 0xff))) {\n            SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_WRONG_SSL_VERSION);\n            s->version = (s->version & 0xff00) | vers[1];\n            al = SSL_AD_PROTOCOL_VERSION;\n            goto f_err;\n        }\n    }\n    if (!PACKET_copy_bytes(&pkt, s->s3->server_random, SSL3_RANDOM_SIZE)) {\n        al = SSL_AD_DECODE_ERROR;\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_LENGTH_MISMATCH);\n        goto f_err;\n    }\n    s->hit = 0;\n    if (!PACKET_get_1(&pkt, &j)\n            || (j > sizeof s->session->session_id)\n            || (j > SSL3_SESSION_ID_SIZE)) {\n        al = SSL_AD_ILLEGAL_PARAMETER;\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_SSL3_SESSION_ID_TOO_LONG);\n        goto f_err;\n    }\n    if (s->version >= TLS1_VERSION && s->tls_session_secret_cb &&\n        s->session->tlsext_tick) {\n        SSL_CIPHER *pref_cipher = NULL;\n        PACKET bookmark = pkt;\n        if (!PACKET_forward(&pkt, j)\n            || !PACKET_get_bytes(&pkt, &cipherchars, TLS_CIPHER_LEN)) {\n            SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_LENGTH_MISMATCH);\n            al = SSL_AD_DECODE_ERROR;\n            goto f_err;\n        }\n        s->session->master_key_length = sizeof(s->session->master_key);\n        if (s->tls_session_secret_cb(s, s->session->master_key,\n                                     &s->session->master_key_length,\n                                     NULL, &pref_cipher,\n                                     s->tls_session_secret_cb_arg)) {\n            s->session->cipher = pref_cipher ?\n                pref_cipher : ssl_get_cipher_by_char(s, cipherchars);\n        } else {\n            SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, ERR_R_INTERNAL_ERROR);\n            al = SSL_AD_INTERNAL_ERROR;\n            goto f_err;\n        }\n        pkt = bookmark;\n    }\n    if (!PACKET_get_bytes(&pkt, &session_id, j)) {\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_LENGTH_MISMATCH);\n        al = SSL_AD_DECODE_ERROR;\n        goto f_err;\n    }\n    if (j != 0 && j == s->session->session_id_length\n        && memcmp(session_id, s->session->session_id, j) == 0) {\n        if (s->sid_ctx_length != s->session->sid_ctx_length\n            || memcmp(s->session->sid_ctx, s->sid_ctx, s->sid_ctx_length)) {\n            al = SSL_AD_ILLEGAL_PARAMETER;\n            SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,\n                   SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);\n            goto f_err;\n        }\n        s->hit = 1;\n    } else {\n        if (s->session->session_id_length > 0) {\n            if (!ssl_get_new_session(s, 0)) {\n                goto f_err;\n            }\n        }\n        s->session->session_id_length = j;\n        memcpy(s->session->session_id, session_id, j);\n    }\n    if (!PACKET_get_bytes(&pkt, &cipherchars, TLS_CIPHER_LEN)) {\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_LENGTH_MISMATCH);\n        al = SSL_AD_DECODE_ERROR;\n        goto f_err;\n    }\n    c = ssl_get_cipher_by_char(s, cipherchars);\n    if (c == NULL) {\n        al = SSL_AD_ILLEGAL_PARAMETER;\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_UNKNOWN_CIPHER_RETURNED);\n        goto f_err;\n    }\n    if (!SSL_USE_TLS1_2_CIPHERS(s))\n        s->s3->tmp.mask_ssl = SSL_TLSV1_2;\n    else\n        s->s3->tmp.mask_ssl = 0;\n    if (ssl_cipher_disabled(s, c, SSL_SECOP_CIPHER_CHECK)) {\n        al = SSL_AD_ILLEGAL_PARAMETER;\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_WRONG_CIPHER_RETURNED);\n        goto f_err;\n    }\n    sk = ssl_get_ciphers_by_id(s);\n    i = sk_SSL_CIPHER_find(sk, c);\n    if (i < 0) {\n        al = SSL_AD_ILLEGAL_PARAMETER;\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_WRONG_CIPHER_RETURNED);\n        goto f_err;\n    }\n    if (s->session->cipher)\n        s->session->cipher_id = s->session->cipher->id;\n    if (s->hit && (s->session->cipher_id != c->id)) {\n        al = SSL_AD_ILLEGAL_PARAMETER;\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,\n               SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);\n        goto f_err;\n    }\n    s->s3->tmp.new_cipher = c;\n    if (!SSL_USE_SIGALGS(s) && !ssl3_digest_cached_records(s, 0))\n        goto f_err;\n    if (!PACKET_get_1(&pkt, &j)) {\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_LENGTH_MISMATCH);\n        al = SSL_AD_DECODE_ERROR;\n        goto f_err;\n    }\n#ifdef OPENSSL_NO_COMP\n    if (j != 0) {\n        al = SSL_AD_ILLEGAL_PARAMETER;\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,\n               SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);\n        goto f_err;\n    }\n    if (s->session->compress_meth != 0) {\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_INCONSISTENT_COMPRESSION);\n        goto f_err;\n    }\n#else\n    if (s->hit && j != s->session->compress_meth) {\n        al = SSL_AD_ILLEGAL_PARAMETER;\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,\n               SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED);\n        goto f_err;\n    }\n    if (j == 0)\n        comp = NULL;\n    else if (!ssl_allow_compression(s)) {\n        al = SSL_AD_ILLEGAL_PARAMETER;\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_COMPRESSION_DISABLED);\n        goto f_err;\n    } else\n        comp = ssl3_comp_find(s->ctx->comp_methods, j);\n    if ((j != 0) && (comp == NULL)) {\n        al = SSL_AD_ILLEGAL_PARAMETER;\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,\n               SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM);\n        goto f_err;\n    } else {\n        s->s3->tmp.new_compression = comp;\n    }\n#endif\n    if (!ssl_parse_serverhello_tlsext(s, &pkt)) {\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_PARSE_TLSEXT);\n        goto err;\n    }\n    if (PACKET_remaining(&pkt) != 0) {\n        al = SSL_AD_DECODE_ERROR;\n        SSLerr(SSL_F_SSL3_GET_SERVER_HELLO, SSL_R_BAD_PACKET_LENGTH);\n        goto f_err;\n    }\n    return (1);\n f_err:\n    ssl3_send_alert(s, SSL3_AL_FATAL, al);\n err:\n    s->state = SSL_ST_ERR;\n    return (-1);\n}', 'static inline void packet_forward(PACKET *pkt, size_t len)\n{\n    pkt->curr += len;\n    pkt->remaining -= len;\n}']