ssl/t1_ext.c:195: error: BUFFER_OVERRUN_S2
  Offset added: [`exts->meths_count` + 48, `exts->meths_count` + 48] (⇐ `exts->meths_count` + 48) Size: [1, 48⋅`exts->meths_count` + 48].
Showing all 6 steps of the trace


ssl/t1_ext.c:156:1: <Length trace>
154.   
155.   /* Set callbacks for a custom extension. */
156. > static int custom_ext_meth_add(custom_ext_methods *exts,
157.                                  unsigned int ext_type,
158.                                  custom_ext_add_cb add_cb,

ssl/t1_ext.c:156:1: Parameter `exts->meths_count`
154.   
155.   /* Set callbacks for a custom extension. */
156. > static int custom_ext_meth_add(custom_ext_methods *exts,
157.                                  unsigned int ext_type,
158.                                  custom_ext_add_cb add_cb,

ssl/t1_ext.c:181:9: Call
179.           return 0;
180.       /* Search for duplicate */
181.       if (custom_ext_find(exts, ext_type))
               ^
182.           return 0;
183.       tmp = OPENSSL_realloc(exts->meths,

ssl/t1_ext.c:17:1: Parameter `exts->meths_count`
  15.   
  16.   /* Find a custom extension from the list. */
  17. > static custom_ext_method *custom_ext_find(const custom_ext_methods *exts,
  18.                                             unsigned int ext_type)
  19.   {

ssl/t1_ext.c:194:5: Assignment
192.   
193.       exts->meths = tmp;
194.       meth = exts->meths + exts->meths_count;
           ^
195.       memset(meth, 0, sizeof(*meth));
196.       meth->parse_cb = parse_cb;

ssl/t1_ext.c:195:5: Array access: Offset added: [exts->meths_count + 48, exts->meths_count + 48] (⇐ exts->meths_count + 48) Size: [1, 48⋅exts->meths_count + 48]
193.       exts->meths = tmp;
194.       meth = exts->meths + exts->meths_count;
195.       memset(meth, 0, sizeof(*meth));
           ^
196.       meth->parse_cb = parse_cb;
197.       meth->add_cb = add_cb;

static int custom_ext_meth_add(custom_ext_methods *exts,
                               unsigned int ext_type,
                               custom_ext_add_cb add_cb,
                               custom_ext_free_cb free_cb,
                               void *add_arg,
                               custom_ext_parse_cb parse_cb, void *parse_arg)
{
    custom_ext_method *meth, *tmp;
    if (!add_cb && free_cb)
        return 0;
    if (SSL_extension_supported(ext_type) &&
        ext_type != TLSEXT_TYPE_signed_certificate_timestamp)
        return 0;
    if (ext_type > 0xffff)
        return 0;
    if (custom_ext_find(exts, ext_type))
        return 0;
    tmp = OPENSSL_realloc(exts->meths,
                          (exts->meths_count + 1) * sizeof(custom_ext_method));
    if (tmp == NULL) {
        OPENSSL_free(exts->meths);
        exts->meths = NULL;
        exts->meths_count = 0;
        return 0;
    }
    exts->meths = tmp;
    meth = exts->meths + exts->meths_count;
    memset(meth, 0, sizeof(*meth));
    meth->parse_cb = parse_cb;
    meth->add_cb = add_cb;
    meth->free_cb = free_cb;
    meth->ext_type = ext_type;
    meth->add_arg = add_arg;
    meth->parse_arg = parse_arg;
    exts->meths_count++;
    return 1;
}
['static int custom_ext_meth_add(custom_ext_methods *exts,\n                               unsigned int ext_type,\n                               custom_ext_add_cb add_cb,\n                               custom_ext_free_cb free_cb,\n                               void *add_arg,\n                               custom_ext_parse_cb parse_cb, void *parse_arg)\n{\n    custom_ext_method *meth, *tmp;\n    if (!add_cb && free_cb)\n        return 0;\n    if (SSL_extension_supported(ext_type) &&\n        ext_type != TLSEXT_TYPE_signed_certificate_timestamp)\n        return 0;\n    if (ext_type > 0xffff)\n        return 0;\n    if (custom_ext_find(exts, ext_type))\n        return 0;\n    tmp = OPENSSL_realloc(exts->meths,\n                          (exts->meths_count + 1) * sizeof(custom_ext_method));\n    if (tmp == NULL) {\n        OPENSSL_free(exts->meths);\n        exts->meths = NULL;\n        exts->meths_count = 0;\n        return 0;\n    }\n    exts->meths = tmp;\n    meth = exts->meths + exts->meths_count;\n    memset(meth, 0, sizeof(*meth));\n    meth->parse_cb = parse_cb;\n    meth->add_cb = add_cb;\n    meth->free_cb = free_cb;\n    meth->ext_type = ext_type;\n    meth->add_arg = add_arg;\n    meth->parse_arg = parse_arg;\n    exts->meths_count++;\n    return 1;\n}', 'static custom_ext_method *custom_ext_find(const custom_ext_methods *exts,\n                                          unsigned int ext_type)\n{\n    size_t i;\n    custom_ext_method *meth = exts->meths;\n    for (i = 0; i < exts->meths_count; i++, meth++) {\n        if (ext_type == meth->ext_type)\n            return meth;\n    }\n    return NULL;\n}']