ssl/t1_lib.c:1989: error: INTEGER_OVERFLOW_L2
  ([4, +oo] - [0, 255]):unsigned64 by call to `PACKET_copy_bytes`.
Showing all 11 steps of the trace


ssl/t1_lib.c:1969:29: Call
1967.               while (PACKET_remaining(&ssubpkt) > 3) {
1968.                   if (!PACKET_get_1(&ssubpkt, &servname_type)
1969.                           || !PACKET_get_net_2(&ssubpkt, &len)
                                    ^
1970.                           || PACKET_remaining(&ssubpkt) < len)
1971.                       goto err;

ssl/packet_locl.h:195:10: Call
  193.                                                  unsigned int *data)
  194.   {
  195.       if (!PACKET_peek_net_2(pkt, data))
                  ^
  196.           return 0;
  197.   

ssl/packet_locl.h:178:8: Parameter `*data`
    176.    * |*data|
    177.    */
    178.   __owur static ossl_inline int PACKET_peek_net_2(const PACKET *pkt,
                  ^
    179.                                                   unsigned int *data)
    180.   {

ssl/t1_lib.c:1989:34: Call
1987.                                   return 0;
1988.                               }
1989.                               if (!PACKET_copy_bytes(&ssubpkt,
                                         ^
1990.                                       (unsigned char *)s->session
1991.                                           ->tlsext_hostname,

ssl/packet_locl.h:373:8: Parameter `len`
  371.    * The caller is responsible for ensuring that |data| can hold |len| bytes.
  372.    */
  373.   __owur static ossl_inline int PACKET_copy_bytes(PACKET *pkt,
                ^
  374.                                                   unsigned char *data,
  375.                                                   size_t len)

ssl/packet_locl.h:380:5: Call
  378.           return 0;
  379.   
  380.       packet_forward(pkt, len);
             ^
  381.   
  382.       return 1;

ssl/packet_locl.h:80:1: <LHS trace>
78.   
79.   /* Internal unchecked shorthand; don't use outside this file. */
80. > static ossl_inline void packet_forward(PACKET *pkt, size_t len)
81.   {
82.       pkt->curr += len;

ssl/packet_locl.h:80:1: Parameter `pkt->remaining`
    78.   
    79.   /* Internal unchecked shorthand; don't use outside this file. */
    80. > static ossl_inline void packet_forward(PACKET *pkt, size_t len)
    81.   {
    82.       pkt->curr += len;

ssl/packet_locl.h:80:1: <RHS trace>
78.   
79.   /* Internal unchecked shorthand; don't use outside this file. */
80. > static ossl_inline void packet_forward(PACKET *pkt, size_t len)
81.   {
82.       pkt->curr += len;

ssl/packet_locl.h:80:1: Parameter `len`
    78.   
    79.   /* Internal unchecked shorthand; don't use outside this file. */
    80. > static ossl_inline void packet_forward(PACKET *pkt, size_t len)
    81.   {
    82.       pkt->curr += len;

ssl/packet_locl.h:83:5: Binary operation: ([4, +oo] - [0, 255]):unsigned64 by call to `PACKET_copy_bytes` 
    81.   {
    82.       pkt->curr += len;
    83.       pkt->remaining -= len;
              ^
    84.   }
    85.   

static ossl_inline void packet_forward(PACKET *pkt, size_t len)
{
    pkt->curr += len;
    pkt->remaining -= len;
}
["static int ssl_scan_clienthello_tlsext(SSL *s, PACKET *pkt, int *al)\n{\n    unsigned int type;\n    unsigned int size;\n    unsigned int len;\n    unsigned char *data;\n    int renegotiate_seen = 0;\n    s->servername_done = 0;\n    s->tlsext_status_type = -1;\n#ifndef OPENSSL_NO_NEXTPROTONEG\n    s->s3->next_proto_neg_seen = 0;\n#endif\n    OPENSSL_free(s->s3->alpn_selected);\n    s->s3->alpn_selected = NULL;\n#ifndef OPENSSL_NO_HEARTBEATS\n    s->tlsext_heartbeat &= ~(SSL_TLSEXT_HB_ENABLED |\n                             SSL_TLSEXT_HB_DONT_SEND_REQUESTS);\n#endif\n#ifndef OPENSSL_NO_EC\n    if (s->options & SSL_OP_SAFARI_ECDHE_ECDSA_BUG)\n        ssl_check_for_safari(s, pkt);\n# endif\n    OPENSSL_free(s->s3->tmp.peer_sigalgs);\n    s->s3->tmp.peer_sigalgs = NULL;\n#ifdef TLSEXT_TYPE_encrypt_then_mac\n    s->s3->flags &= ~TLS1_FLAGS_ENCRYPT_THEN_MAC;\n#endif\n#ifndef OPENSSL_NO_SRP\n    OPENSSL_free(s->srp_ctx.login);\n    s->srp_ctx.login = NULL;\n#endif\n    s->srtp_profile = NULL;\n    if (PACKET_remaining(pkt) == 0)\n        goto ri_check;\n    if (!PACKET_get_net_2(pkt, &len))\n        goto err;\n    if (PACKET_remaining(pkt) != len)\n        goto err;\n    while (PACKET_get_net_2(pkt, &type) && PACKET_get_net_2(pkt, &size)) {\n        PACKET subpkt;\n        if (!PACKET_peek_bytes(pkt, &data, size))\n            goto err;\n        if (s->tlsext_debug_cb)\n            s->tlsext_debug_cb(s, 0, type, data, size, s->tlsext_debug_arg);\n        if (!PACKET_get_sub_packet(pkt, &subpkt, size))\n            goto err;\n        if (type == TLSEXT_TYPE_renegotiate) {\n            if (!ssl_parse_clienthello_renegotiate_ext(s, &subpkt, al))\n                return 0;\n            renegotiate_seen = 1;\n        } else if (s->version == SSL3_VERSION) {\n        }\n        else if (type == TLSEXT_TYPE_server_name) {\n            unsigned char *sdata;\n            unsigned int servname_type;\n            unsigned int dsize;\n            PACKET ssubpkt;\n            if (!PACKET_get_net_2(&subpkt, &dsize)\n                    || !PACKET_get_sub_packet(&subpkt, &ssubpkt, dsize))\n                goto err;\n            while (PACKET_remaining(&ssubpkt) > 3) {\n                if (!PACKET_get_1(&ssubpkt, &servname_type)\n                        || !PACKET_get_net_2(&ssubpkt, &len)\n                        || PACKET_remaining(&ssubpkt) < len)\n                    goto err;\n                if (s->servername_done == 0)\n                    switch (servname_type) {\n                    case TLSEXT_NAMETYPE_host_name:\n                        if (!s->hit) {\n                            if (s->session->tlsext_hostname)\n                                goto err;\n                            if (len > TLSEXT_MAXLEN_host_name) {\n                                *al = TLS1_AD_UNRECOGNIZED_NAME;\n                                return 0;\n                            }\n                            if ((s->session->tlsext_hostname =\n                                 OPENSSL_malloc(len + 1)) == NULL) {\n                                *al = TLS1_AD_INTERNAL_ERROR;\n                                return 0;\n                            }\n                            if (!PACKET_copy_bytes(&ssubpkt,\n                                    (unsigned char *)s->session\n                                        ->tlsext_hostname,\n                                    len)) {\n                                *al = SSL_AD_DECODE_ERROR;\n                                return 0;\n                            }\n                            s->session->tlsext_hostname[len] = '\\0';\n                            if (strlen(s->session->tlsext_hostname) != len) {\n                                OPENSSL_free(s->session->tlsext_hostname);\n                                s->session->tlsext_hostname = NULL;\n                                *al = TLS1_AD_UNRECOGNIZED_NAME;\n                                return 0;\n                            }\n                            s->servername_done = 1;\n                        } else {\n                            if (!PACKET_get_bytes(&ssubpkt, &sdata, len)) {\n                                *al = SSL_AD_DECODE_ERROR;\n                                return 0;\n                            }\n                            s->servername_done = s->session->tlsext_hostname\n                                && strlen(s->session->tlsext_hostname) == len\n                                && strncmp(s->session->tlsext_hostname,\n                                           (char *)sdata, len) == 0;\n                        }\n                        break;\n                    default:\n                        break;\n                    }\n            }\n            if (PACKET_remaining(&ssubpkt) != 0)\n                goto err;\n        }\n#ifndef OPENSSL_NO_SRP\n        else if (type == TLSEXT_TYPE_srp) {\n            if (!PACKET_get_1(&subpkt, &len)\n                    || s->srp_ctx.login != NULL)\n                goto err;\n            if ((s->srp_ctx.login = OPENSSL_malloc(len + 1)) == NULL)\n                return -1;\n            if (!PACKET_copy_bytes(&subpkt, (unsigned char *)s->srp_ctx.login,\n                                   len))\n                goto err;\n            s->srp_ctx.login[len] = '\\0';\n            if (strlen(s->srp_ctx.login) != len\n                    || PACKET_remaining(&subpkt))\n                goto err;\n        }\n#endif\n#ifndef OPENSSL_NO_EC\n        else if (type == TLSEXT_TYPE_ec_point_formats) {\n            unsigned int ecpointformatlist_length;\n            if (!PACKET_get_1(&subpkt, &ecpointformatlist_length)\n                    || ecpointformatlist_length == 0)\n                goto err;\n            if (!s->hit) {\n                OPENSSL_free(s->session->tlsext_ecpointformatlist);\n                s->session->tlsext_ecpointformatlist = NULL;\n                s->session->tlsext_ecpointformatlist_length = 0;\n                if ((s->session->tlsext_ecpointformatlist =\n                     OPENSSL_malloc(ecpointformatlist_length)) == NULL) {\n                    *al = TLS1_AD_INTERNAL_ERROR;\n                    return 0;\n                }\n                s->session->tlsext_ecpointformatlist_length =\n                    ecpointformatlist_length;\n                if (!PACKET_copy_bytes(&subpkt,\n                        s->session->tlsext_ecpointformatlist,\n                        ecpointformatlist_length))\n                    goto err;\n            } else if (!PACKET_forward(&subpkt, ecpointformatlist_length)) {\n                goto err;\n            }\n            if (PACKET_remaining(&subpkt)) {\n                *al = TLS1_AD_DECODE_ERROR;\n                return 0;\n            }\n        } else if (type == TLSEXT_TYPE_elliptic_curves) {\n            unsigned int ellipticcurvelist_length;\n            if (!PACKET_get_net_2(&subpkt, &ellipticcurvelist_length)\n                    || ellipticcurvelist_length == 0\n                    || (ellipticcurvelist_length & 1) != 0)\n                goto err;\n            if (!s->hit) {\n                if (s->session->tlsext_ellipticcurvelist)\n                    goto err;\n                s->session->tlsext_ellipticcurvelist_length = 0;\n                if ((s->session->tlsext_ellipticcurvelist =\n                     OPENSSL_malloc(ellipticcurvelist_length)) == NULL) {\n                    *al = TLS1_AD_INTERNAL_ERROR;\n                    return 0;\n                }\n                s->session->tlsext_ellipticcurvelist_length =\n                    ellipticcurvelist_length;\n                if (!PACKET_copy_bytes(&subpkt,\n                        s->session->tlsext_ellipticcurvelist,\n                        ellipticcurvelist_length))\n                    goto err;\n            } else if (!PACKET_forward(&subpkt, ellipticcurvelist_length)) {\n                goto err;\n            }\n            if (PACKET_remaining(&subpkt)) {\n                goto err;\n            }\n        }\n#endif\n        else if (type == TLSEXT_TYPE_session_ticket) {\n            if (!PACKET_forward(&subpkt, size)\n                || (s->tls_session_ticket_ext_cb &&\n                    !s->tls_session_ticket_ext_cb(s, data, size,\n                                        s->tls_session_ticket_ext_cb_arg))) {\n                *al = TLS1_AD_INTERNAL_ERROR;\n                return 0;\n            }\n        } else if (type == TLSEXT_TYPE_signature_algorithms) {\n            unsigned int dsize;\n            if (s->s3->tmp.peer_sigalgs\n                    || !PACKET_get_net_2(&subpkt, &dsize)\n                    || (dsize & 1) != 0\n                    || (dsize == 0)\n                    || !PACKET_get_bytes(&subpkt, &data, dsize)\n                    || PACKET_remaining(&subpkt) != 0\n                    || !tls1_save_sigalgs(s, data, dsize)) {\n                goto err;\n            }\n        } else if (type == TLSEXT_TYPE_status_request) {\n            PACKET ssubpkt;\n            if (!PACKET_get_1(&subpkt,\n                              (unsigned int *)&s->tlsext_status_type))\n                goto err;\n            if (s->tlsext_status_type == TLSEXT_STATUSTYPE_ocsp) {\n                const unsigned char *sdata;\n                unsigned int dsize;\n                if (!PACKET_get_net_2(&subpkt, &dsize)\n                        || !PACKET_get_sub_packet(&subpkt, &ssubpkt, dsize))\n                    goto err;\n                while (PACKET_remaining(&ssubpkt)) {\n                    OCSP_RESPID *id;\n                    unsigned int idsize;\n                    if (PACKET_remaining(&ssubpkt) < 4\n                            || !PACKET_get_net_2(&ssubpkt, &idsize)\n                            || !PACKET_get_bytes(&ssubpkt, &data, idsize)) {\n                        goto err;\n                    }\n                    sdata = data;\n                    data += idsize;\n                    id = d2i_OCSP_RESPID(NULL, &sdata, idsize);\n                    if (!id)\n                        goto err;\n                    if (data != sdata) {\n                        OCSP_RESPID_free(id);\n                        goto err;\n                    }\n                    if (!s->tlsext_ocsp_ids\n                        && !(s->tlsext_ocsp_ids =\n                             sk_OCSP_RESPID_new_null())) {\n                        OCSP_RESPID_free(id);\n                        *al = SSL_AD_INTERNAL_ERROR;\n                        return 0;\n                    }\n                    if (!sk_OCSP_RESPID_push(s->tlsext_ocsp_ids, id)) {\n                        OCSP_RESPID_free(id);\n                        *al = SSL_AD_INTERNAL_ERROR;\n                        return 0;\n                    }\n                }\n                if (!PACKET_get_net_2(&subpkt, &dsize)\n                        || !PACKET_get_bytes(&subpkt, &data, dsize)\n                        || PACKET_remaining(&subpkt)) {\n                    goto err;\n                }\n                sdata = data;\n                if (dsize > 0) {\n                    sk_X509_EXTENSION_pop_free(s->tlsext_ocsp_exts,\n                                               X509_EXTENSION_free);\n                    s->tlsext_ocsp_exts =\n                        d2i_X509_EXTENSIONS(NULL, &sdata, dsize);\n                    if (!s->tlsext_ocsp_exts || (data + dsize != sdata))\n                        goto err;\n                }\n            }\n            else\n                s->tlsext_status_type = -1;\n        }\n#ifndef OPENSSL_NO_HEARTBEATS\n        else if (type == TLSEXT_TYPE_heartbeat) {\n            unsigned int hbtype;\n            if (!PACKET_get_1(&subpkt, &hbtype)\n                    || PACKET_remaining(&subpkt)) {\n                *al = SSL_AD_DECODE_ERROR;\n                return 0;\n            }\n            switch (hbtype) {\n            case 0x01:\n                s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;\n                break;\n            case 0x02:\n                s->tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED;\n                s->tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS;\n                break;\n            default:\n                *al = SSL_AD_ILLEGAL_PARAMETER;\n                return 0;\n            }\n        }\n#endif\n#ifndef OPENSSL_NO_NEXTPROTONEG\n        else if (type == TLSEXT_TYPE_next_proto_neg &&\n                 s->s3->tmp.finish_md_len == 0 &&\n                 s->s3->alpn_selected == NULL) {\n            s->s3->next_proto_neg_seen = 1;\n        }\n#endif\n        else if (type == TLSEXT_TYPE_application_layer_protocol_negotiation &&\n                 s->ctx->alpn_select_cb && s->s3->tmp.finish_md_len == 0) {\n            if (tls1_alpn_handle_client_hello(s, &subpkt, al) != 0)\n                return 0;\n#ifndef OPENSSL_NO_NEXTPROTONEG\n            s->s3->next_proto_neg_seen = 0;\n#endif\n        }\n#ifndef OPENSSL_NO_SRTP\n        else if (SSL_IS_DTLS(s) && SSL_get_srtp_profiles(s)\n                 && type == TLSEXT_TYPE_use_srtp) {\n            if (ssl_parse_clienthello_use_srtp_ext(s, &subpkt, al))\n                return 0;\n        }\n#endif\n#ifdef TLSEXT_TYPE_encrypt_then_mac\n        else if (type == TLSEXT_TYPE_encrypt_then_mac)\n            s->s3->flags |= TLS1_FLAGS_ENCRYPT_THEN_MAC;\n#endif\n        else if (!s->hit) {\n            if (custom_ext_parse(s, 1, type, data, size, al) <= 0)\n                return 0;\n        }\n    }\n    if (PACKET_remaining(pkt) != 0)\n        goto err;\n ri_check:\n    if (!renegotiate_seen && s->renegotiate &&\n        !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) {\n        *al = SSL_AD_HANDSHAKE_FAILURE;\n        SSLerr(SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT,\n               SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);\n        return 0;\n    }\n    return 1;\nerr:\n    *al = SSL_AD_DECODE_ERROR;\n    return 0;\n}", 'static ossl_inline void packet_forward(PACKET *pkt, size_t len)\n{\n    pkt->curr += len;\n    pkt->remaining -= len;\n}']