ssl/ssl_lib.c:245: error: BUFFER_OVERRUN_S2
  Offset: [`dctx->mdmax` + 1, `mtype` - 1] Size: [1, 8⋅`mtype` + 8].
Showing all 8 steps of the trace


ssl/ssl_lib.c:214:1: <Offset trace>
212.   }
213.   
214. > static int dane_mtype_set(struct dane_ctx_st *dctx,
215.                             const EVP_MD *md, uint8_t mtype, uint8_t ord)
216.   {

ssl/ssl_lib.c:214:1: Parameter `mtype`
212.   }
213.   
214. > static int dane_mtype_set(struct dane_ctx_st *dctx,
215.                             const EVP_MD *md, uint8_t mtype, uint8_t ord)
216.   {

ssl/ssl_lib.c:214:1: <Length trace>
212.   }
213.   
214. > static int dane_mtype_set(struct dane_ctx_st *dctx,
215.                             const EVP_MD *md, uint8_t mtype, uint8_t ord)
216.   {

ssl/ssl_lib.c:214:1: Parameter `*dctx->mdevp`
212.   }
213.   
214. > static int dane_mtype_set(struct dane_ctx_st *dctx,
215.                             const EVP_MD *md, uint8_t mtype, uint8_t ord)
216.   {

ssl/ssl_lib.c:229:17: Call
227.           int n = ((int)mtype) + 1;
228.   
229.           mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp));
                       ^
230.           if (mdevp == NULL) {
231.               SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);

crypto/mem.c:117:9: Assignment
  115.       if (num == 0) {
  116.           CRYPTO_free(str, file, line);
  117.           return NULL;
                 ^
  118.       }
  119.   

ssl/ssl_lib.c:229:9: Assignment
227.           int n = ((int)mtype) + 1;
228.   
229.           mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp));
               ^
230.           if (mdevp == NULL) {
231.               SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);

ssl/ssl_lib.c:245:13: Array access: Offset: [dctx->mdmax + 1, mtype - 1] Size: [1, 8⋅mtype + 8]
243.           /* Zero-fill any gaps */
244.           for (i = dctx->mdmax + 1; i < mtype; ++i) {
245.               mdevp[i] = NULL;
                   ^
246.               mdord[i] = 0;
247.           }

static int dane_mtype_set(struct dane_ctx_st *dctx,
                          const EVP_MD *md, uint8_t mtype, uint8_t ord)
{
    int i;
    if (mtype == DANETLS_MATCHING_FULL && md != NULL) {
        SSLerr(SSL_F_DANE_MTYPE_SET, SSL_R_DANE_CANNOT_OVERRIDE_MTYPE_FULL);
        return 0;
    }
    if (mtype > dctx->mdmax) {
        const EVP_MD **mdevp;
        uint8_t *mdord;
        int n = ((int)mtype) + 1;
        mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp));
        if (mdevp == NULL) {
            SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);
            return -1;
        }
        dctx->mdevp = mdevp;
        mdord = OPENSSL_realloc(dctx->mdord, n * sizeof(*mdord));
        if (mdord == NULL) {
            SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);
            return -1;
        }
        dctx->mdord = mdord;
        for (i = dctx->mdmax + 1; i < mtype; ++i) {
            mdevp[i] = NULL;
            mdord[i] = 0;
        }
        dctx->mdmax = mtype;
    }
    dctx->mdevp[mtype] = md;
    dctx->mdord[mtype] = (md == NULL) ? 0 : ord;
    return 1;
}
['static int dane_mtype_set(struct dane_ctx_st *dctx,\n                          const EVP_MD *md, uint8_t mtype, uint8_t ord)\n{\n    int i;\n    if (mtype == DANETLS_MATCHING_FULL && md != NULL) {\n        SSLerr(SSL_F_DANE_MTYPE_SET, SSL_R_DANE_CANNOT_OVERRIDE_MTYPE_FULL);\n        return 0;\n    }\n    if (mtype > dctx->mdmax) {\n        const EVP_MD **mdevp;\n        uint8_t *mdord;\n        int n = ((int)mtype) + 1;\n        mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp));\n        if (mdevp == NULL) {\n            SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);\n            return -1;\n        }\n        dctx->mdevp = mdevp;\n        mdord = OPENSSL_realloc(dctx->mdord, n * sizeof(*mdord));\n        if (mdord == NULL) {\n            SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);\n            return -1;\n        }\n        dctx->mdord = mdord;\n        for (i = dctx->mdmax + 1; i < mtype; ++i) {\n            mdevp[i] = NULL;\n            mdord[i] = 0;\n        }\n        dctx->mdmax = mtype;\n    }\n    dctx->mdevp[mtype] = md;\n    dctx->mdord[mtype] = (md == NULL) ? 0 : ord;\n    return 1;\n}', 'void *CRYPTO_realloc(void *str, size_t num, const char *file, int line)\n{\n    if (realloc_impl != NULL && realloc_impl != &CRYPTO_realloc)\n        return realloc_impl(str, num, file, line);\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_free(str, file, line);\n        return NULL;\n    }\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        void *ret;\n        CRYPTO_mem_debug_realloc(str, NULL, num, 0, file, line);\n        ret = realloc(str, num);\n        CRYPTO_mem_debug_realloc(str, ret, num, 1, file, line);\n        return ret;\n    }\n#else\n    osslargused(file); osslargused(line);\n#endif\n    return realloc(str, num);\n}']