ssl/s23_srvr.c:564: error: BUFFER_OVERRUN_L2
  Offset added: [0, 4096] Size: 11.
Showing all 6 steps of the trace


ssl/s23_srvr.c:250:5: <Offset trace>
248.       unsigned int i;
249.       unsigned int csl, sil, cl;
250.       int n = 0, j;
           ^
251.       int type = 0;
252.       int v[2];

ssl/s23_srvr.c:250:5: Assignment
248.       unsigned int i;
249.       unsigned int csl, sil, cl;
250.       int n = 0, j;
           ^
251.       int type = 0;
252.       int v[2];

ssl/s23_srvr.c:229:1: <Length trace>
227.   }
228.   
229. > int ssl23_get_client_hello(SSL *s)
230.   {
231.       /*-

ssl/s23_srvr.c:229:1: Array declaration
227.   }
228.   
229. > int ssl23_get_client_hello(SSL *s)
230.   {
231.       /*-

ssl/s23_srvr.c:246:5: Assignment
244.        */
245.       char buf_space[11];
246.       char *buf = &(buf_space[0]);
           ^
247.       unsigned char *p, *d, *d_len, *dd;
248.       unsigned int i;

ssl/s23_srvr.c:564:13: Array access: Offset added: [0, 4096] Size: 11
562.   
563.               s->packet = &(s->s3->rbuf.buf[0]);
564.               memcpy(s->packet, buf, n);
                   ^
565.               s->s3->rbuf.left = n;
566.               s->s3->rbuf.offset = 0;

int ssl23_get_client_hello(SSL *s)
{
    char buf_space[11];
    char *buf = &(buf_space[0]);
    unsigned char *p, *d, *d_len, *dd;
    unsigned int i;
    unsigned int csl, sil, cl;
    int n = 0, j;
    int type = 0;
    int v[2];
    if (s->state == SSL23_ST_SR_CLNT_HELLO_A) {
        v[0] = v[1] = 0;
        if (!ssl3_setup_buffers(s))
            goto err;
        n = ssl23_read_bytes(s, sizeof buf_space);
        if (n != sizeof buf_space)
            return (n);
        p = s->packet;
        memcpy(buf, p, n);
        if ((p[0] & 0x80) && (p[2] == SSL2_MT_CLIENT_HELLO)) {
            if ((p[3] == 0x00) && (p[4] == 0x02)) {
                v[0] = p[3];
                v[1] = p[4];
            } else if (p[3] == SSL3_VERSION_MAJOR) {
                v[0] = p[3];
                v[1] = p[4];
                if (p[4] >= TLS1_VERSION_MINOR) {
                    if (p[4] >= TLS1_2_VERSION_MINOR &&
                        !(s->options & SSL_OP_NO_TLSv1_2)) {
                        s->version = TLS1_2_VERSION;
                        s->state = SSL23_ST_SR_CLNT_HELLO_B;
                    } else if (p[4] >= TLS1_1_VERSION_MINOR &&
                               !(s->options & SSL_OP_NO_TLSv1_1)) {
                        s->version = TLS1_1_VERSION;
                        s->state = SSL23_ST_SR_CLNT_HELLO_B;
                    } else if (!(s->options & SSL_OP_NO_TLSv1)) {
                        s->version = TLS1_VERSION;
                        s->state = SSL23_ST_SR_CLNT_HELLO_B;
                    } else if (!(s->options & SSL_OP_NO_SSLv3)) {
                        s->version = SSL3_VERSION;
                        s->state = SSL23_ST_SR_CLNT_HELLO_B;
                    }
                } else if (!(s->options & SSL_OP_NO_SSLv3)) {
                    s->version = SSL3_VERSION;
                    s->state = SSL23_ST_SR_CLNT_HELLO_B;
                }
            }
        }
        else if ((p[0] == SSL3_RT_HANDSHAKE) &&
                 (p[1] == SSL3_VERSION_MAJOR) &&
                 (p[5] == SSL3_MT_CLIENT_HELLO) && ((p[3] == 0 && p[4] < 5)
                                                    || (p[9] >= p[1]))) {
            v[0] = p[1];
            if (p[3] == 0 && p[4] < 6) {
                SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_RECORD_TOO_SMALL);
                goto err;
            }
            if (p[9] > SSL3_VERSION_MAJOR)
                v[1] = 0xff;
            else
                v[1] = p[10];
            if (v[1] >= TLS1_VERSION_MINOR) {
                if (v[1] >= TLS1_2_VERSION_MINOR &&
                    !(s->options & SSL_OP_NO_TLSv1_2)) {
                    s->version = TLS1_2_VERSION;
                    type = 3;
                } else if (v[1] >= TLS1_1_VERSION_MINOR &&
                           !(s->options & SSL_OP_NO_TLSv1_1)) {
                    s->version = TLS1_1_VERSION;
                    type = 3;
                } else if (!(s->options & SSL_OP_NO_TLSv1)) {
                    s->version = TLS1_VERSION;
                    type = 3;
                } else if (!(s->options & SSL_OP_NO_SSLv3)) {
                    s->version = SSL3_VERSION;
                    type = 3;
                }
            } else {
                if (!(s->options & SSL_OP_NO_SSLv3)) {
                    s->version = SSL3_VERSION;
                    type = 3;
                } else if (!(s->options & SSL_OP_NO_TLSv1)) {
                    s->version = TLS1_VERSION;
                    type = 3;
                }
            }
        } else if ((strncmp("GET ", (char *)p, 4) == 0) ||
                   (strncmp("POST ", (char *)p, 5) == 0) ||
                   (strncmp("HEAD ", (char *)p, 5) == 0) ||
                   (strncmp("PUT ", (char *)p, 4) == 0)) {
            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_HTTP_REQUEST);
            goto err;
        } else if (strncmp("CONNECT", (char *)p, 7) == 0) {
            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_HTTPS_PROXY_REQUEST);
            goto err;
        }
    }
    OPENSSL_assert(s->version <= TLS_MAX_VERSION);
    if (s->version < TLS1_2_VERSION && tls1_suiteb(s)) {
        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,
               SSL_R_ONLY_TLS_1_2_ALLOWED_IN_SUITEB_MODE);
        goto err;
    }
    if (FIPS_mode() && (s->version < TLS1_VERSION)) {
        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,
               SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);
        goto err;
    }
    if (!ssl_security(s, SSL_SECOP_VERSION, 0, s->version, NULL)) {
        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_VERSION_TOO_LOW);
        goto err;
    }
    if (s->state == SSL23_ST_SR_CLNT_HELLO_B) {
        type = 2;
        p = s->packet;
        v[0] = p[3];
        v[1] = p[4];
        n = ((p[0] & 0x7f) << 8) | p[1];
        if (n > (1024 * 4)) {
            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_RECORD_TOO_LARGE);
            goto err;
        }
        if (n < 9) {
            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,
                   SSL_R_RECORD_LENGTH_MISMATCH);
            goto err;
        }
        j = ssl23_read_bytes(s, n + 2);
        if (j <= 0)
            return (j);
        ssl3_finish_mac(s, s->packet + 2, s->packet_length - 2);
        if (s->msg_callback)
            s->msg_callback(0, SSL2_VERSION, 0, s->packet + 2,
                            s->packet_length - 2, s, s->msg_callback_arg);
        p = s->packet;
        p += 5;
        n2s(p, csl);
        n2s(p, sil);
        n2s(p, cl);
        d = (unsigned char *)s->init_buf->data;
        if ((csl + sil + cl + 11) != s->packet_length) {
            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,
                   SSL_R_RECORD_LENGTH_MISMATCH);
            goto err;
        }
        *(d++) = SSL3_MT_CLIENT_HELLO;
        d_len = d;
        d += 3;
        *(d++) = SSL3_VERSION_MAJOR;
        *(d++) = v[1];
        i = (cl > SSL3_RANDOM_SIZE) ? SSL3_RANDOM_SIZE : cl;
        memset(d, 0, SSL3_RANDOM_SIZE);
        memcpy(&(d[SSL3_RANDOM_SIZE - i]), &(p[csl + sil]), i);
        d += SSL3_RANDOM_SIZE;
        *(d++) = 0;
        j = 0;
        dd = d;
        d += 2;
        for (i = 0; i < csl; i += 3) {
            if (p[i] != 0)
                continue;
            *(d++) = p[i + 1];
            *(d++) = p[i + 2];
            j += 2;
        }
        s2n(j, dd);
        *(d++) = 1;
        *(d++) = 0;
#if 0
        p = p + csl + sil + cl;
        while (p < s->packet + s->packet_length) {
            *(d++) = *(p++);
        }
#endif
        i = (d - (unsigned char *)s->init_buf->data) - 4;
        l2n3((long)i, d_len);
        s->s3->tmp.reuse_message = 1;
        s->s3->tmp.message_type = SSL3_MT_CLIENT_HELLO;
        s->s3->tmp.message_size = i;
    }
    if ((type == 2) || (type == 3)) {
        const SSL_METHOD *new_method;
        new_method = ssl23_get_server_method(s->version);
        if (new_method == NULL) {
            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNSUPPORTED_PROTOCOL);
            goto err;
        }
        s->method = new_method;
        if (!ssl_init_wbio_buffer(s, 1))
            goto err;
        s->state = SSL3_ST_SR_CLNT_HELLO_A;
        if (type == 3) {
            s->rstate = SSL_ST_READ_HEADER;
            s->packet_length = n;
            if (s->s3->rbuf.buf == NULL)
                if (!ssl3_setup_read_buffer(s))
                    goto err;
            s->packet = &(s->s3->rbuf.buf[0]);
            memcpy(s->packet, buf, n);
            s->s3->rbuf.left = n;
            s->s3->rbuf.offset = 0;
        } else {
            s->packet_length = 0;
            s->s3->rbuf.left = 0;
            s->s3->rbuf.offset = 0;
        }
#if 0
        s->client_version = (v[0] << 8) | v[1];
#endif
        s->handshake_func = s->method->ssl_accept;
    } else {
        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL);
        goto err;
    }
    s->init_num = 0;
    if (buf != buf_space)
        OPENSSL_free(buf);
    return (SSL_accept(s));
 err:
    if (buf != buf_space)
        OPENSSL_free(buf);
    return (-1);
}
['int ssl23_get_client_hello(SSL *s)\n{\n    char buf_space[11];\n    char *buf = &(buf_space[0]);\n    unsigned char *p, *d, *d_len, *dd;\n    unsigned int i;\n    unsigned int csl, sil, cl;\n    int n = 0, j;\n    int type = 0;\n    int v[2];\n    if (s->state == SSL23_ST_SR_CLNT_HELLO_A) {\n        v[0] = v[1] = 0;\n        if (!ssl3_setup_buffers(s))\n            goto err;\n        n = ssl23_read_bytes(s, sizeof buf_space);\n        if (n != sizeof buf_space)\n            return (n);\n        p = s->packet;\n        memcpy(buf, p, n);\n        if ((p[0] & 0x80) && (p[2] == SSL2_MT_CLIENT_HELLO)) {\n            if ((p[3] == 0x00) && (p[4] == 0x02)) {\n                v[0] = p[3];\n                v[1] = p[4];\n            } else if (p[3] == SSL3_VERSION_MAJOR) {\n                v[0] = p[3];\n                v[1] = p[4];\n                if (p[4] >= TLS1_VERSION_MINOR) {\n                    if (p[4] >= TLS1_2_VERSION_MINOR &&\n                        !(s->options & SSL_OP_NO_TLSv1_2)) {\n                        s->version = TLS1_2_VERSION;\n                        s->state = SSL23_ST_SR_CLNT_HELLO_B;\n                    } else if (p[4] >= TLS1_1_VERSION_MINOR &&\n                               !(s->options & SSL_OP_NO_TLSv1_1)) {\n                        s->version = TLS1_1_VERSION;\n                        s->state = SSL23_ST_SR_CLNT_HELLO_B;\n                    } else if (!(s->options & SSL_OP_NO_TLSv1)) {\n                        s->version = TLS1_VERSION;\n                        s->state = SSL23_ST_SR_CLNT_HELLO_B;\n                    } else if (!(s->options & SSL_OP_NO_SSLv3)) {\n                        s->version = SSL3_VERSION;\n                        s->state = SSL23_ST_SR_CLNT_HELLO_B;\n                    }\n                } else if (!(s->options & SSL_OP_NO_SSLv3)) {\n                    s->version = SSL3_VERSION;\n                    s->state = SSL23_ST_SR_CLNT_HELLO_B;\n                }\n            }\n        }\n        else if ((p[0] == SSL3_RT_HANDSHAKE) &&\n                 (p[1] == SSL3_VERSION_MAJOR) &&\n                 (p[5] == SSL3_MT_CLIENT_HELLO) && ((p[3] == 0 && p[4] < 5)\n                                                    || (p[9] >= p[1]))) {\n            v[0] = p[1];\n            if (p[3] == 0 && p[4] < 6) {\n                SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_RECORD_TOO_SMALL);\n                goto err;\n            }\n            if (p[9] > SSL3_VERSION_MAJOR)\n                v[1] = 0xff;\n            else\n                v[1] = p[10];\n            if (v[1] >= TLS1_VERSION_MINOR) {\n                if (v[1] >= TLS1_2_VERSION_MINOR &&\n                    !(s->options & SSL_OP_NO_TLSv1_2)) {\n                    s->version = TLS1_2_VERSION;\n                    type = 3;\n                } else if (v[1] >= TLS1_1_VERSION_MINOR &&\n                           !(s->options & SSL_OP_NO_TLSv1_1)) {\n                    s->version = TLS1_1_VERSION;\n                    type = 3;\n                } else if (!(s->options & SSL_OP_NO_TLSv1)) {\n                    s->version = TLS1_VERSION;\n                    type = 3;\n                } else if (!(s->options & SSL_OP_NO_SSLv3)) {\n                    s->version = SSL3_VERSION;\n                    type = 3;\n                }\n            } else {\n                if (!(s->options & SSL_OP_NO_SSLv3)) {\n                    s->version = SSL3_VERSION;\n                    type = 3;\n                } else if (!(s->options & SSL_OP_NO_TLSv1)) {\n                    s->version = TLS1_VERSION;\n                    type = 3;\n                }\n            }\n        } else if ((strncmp("GET ", (char *)p, 4) == 0) ||\n                   (strncmp("POST ", (char *)p, 5) == 0) ||\n                   (strncmp("HEAD ", (char *)p, 5) == 0) ||\n                   (strncmp("PUT ", (char *)p, 4) == 0)) {\n            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_HTTP_REQUEST);\n            goto err;\n        } else if (strncmp("CONNECT", (char *)p, 7) == 0) {\n            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_HTTPS_PROXY_REQUEST);\n            goto err;\n        }\n    }\n    OPENSSL_assert(s->version <= TLS_MAX_VERSION);\n    if (s->version < TLS1_2_VERSION && tls1_suiteb(s)) {\n        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,\n               SSL_R_ONLY_TLS_1_2_ALLOWED_IN_SUITEB_MODE);\n        goto err;\n    }\n    if (FIPS_mode() && (s->version < TLS1_VERSION)) {\n        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,\n               SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE);\n        goto err;\n    }\n    if (!ssl_security(s, SSL_SECOP_VERSION, 0, s->version, NULL)) {\n        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_VERSION_TOO_LOW);\n        goto err;\n    }\n    if (s->state == SSL23_ST_SR_CLNT_HELLO_B) {\n        type = 2;\n        p = s->packet;\n        v[0] = p[3];\n        v[1] = p[4];\n        n = ((p[0] & 0x7f) << 8) | p[1];\n        if (n > (1024 * 4)) {\n            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_RECORD_TOO_LARGE);\n            goto err;\n        }\n        if (n < 9) {\n            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,\n                   SSL_R_RECORD_LENGTH_MISMATCH);\n            goto err;\n        }\n        j = ssl23_read_bytes(s, n + 2);\n        if (j <= 0)\n            return (j);\n        ssl3_finish_mac(s, s->packet + 2, s->packet_length - 2);\n        if (s->msg_callback)\n            s->msg_callback(0, SSL2_VERSION, 0, s->packet + 2,\n                            s->packet_length - 2, s, s->msg_callback_arg);\n        p = s->packet;\n        p += 5;\n        n2s(p, csl);\n        n2s(p, sil);\n        n2s(p, cl);\n        d = (unsigned char *)s->init_buf->data;\n        if ((csl + sil + cl + 11) != s->packet_length) {\n            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,\n                   SSL_R_RECORD_LENGTH_MISMATCH);\n            goto err;\n        }\n        *(d++) = SSL3_MT_CLIENT_HELLO;\n        d_len = d;\n        d += 3;\n        *(d++) = SSL3_VERSION_MAJOR;\n        *(d++) = v[1];\n        i = (cl > SSL3_RANDOM_SIZE) ? SSL3_RANDOM_SIZE : cl;\n        memset(d, 0, SSL3_RANDOM_SIZE);\n        memcpy(&(d[SSL3_RANDOM_SIZE - i]), &(p[csl + sil]), i);\n        d += SSL3_RANDOM_SIZE;\n        *(d++) = 0;\n        j = 0;\n        dd = d;\n        d += 2;\n        for (i = 0; i < csl; i += 3) {\n            if (p[i] != 0)\n                continue;\n            *(d++) = p[i + 1];\n            *(d++) = p[i + 2];\n            j += 2;\n        }\n        s2n(j, dd);\n        *(d++) = 1;\n        *(d++) = 0;\n#if 0\n        p = p + csl + sil + cl;\n        while (p < s->packet + s->packet_length) {\n            *(d++) = *(p++);\n        }\n#endif\n        i = (d - (unsigned char *)s->init_buf->data) - 4;\n        l2n3((long)i, d_len);\n        s->s3->tmp.reuse_message = 1;\n        s->s3->tmp.message_type = SSL3_MT_CLIENT_HELLO;\n        s->s3->tmp.message_size = i;\n    }\n    if ((type == 2) || (type == 3)) {\n        const SSL_METHOD *new_method;\n        new_method = ssl23_get_server_method(s->version);\n        if (new_method == NULL) {\n            SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNSUPPORTED_PROTOCOL);\n            goto err;\n        }\n        s->method = new_method;\n        if (!ssl_init_wbio_buffer(s, 1))\n            goto err;\n        s->state = SSL3_ST_SR_CLNT_HELLO_A;\n        if (type == 3) {\n            s->rstate = SSL_ST_READ_HEADER;\n            s->packet_length = n;\n            if (s->s3->rbuf.buf == NULL)\n                if (!ssl3_setup_read_buffer(s))\n                    goto err;\n            s->packet = &(s->s3->rbuf.buf[0]);\n            memcpy(s->packet, buf, n);\n            s->s3->rbuf.left = n;\n            s->s3->rbuf.offset = 0;\n        } else {\n            s->packet_length = 0;\n            s->s3->rbuf.left = 0;\n            s->s3->rbuf.offset = 0;\n        }\n#if 0\n        s->client_version = (v[0] << 8) | v[1];\n#endif\n        s->handshake_func = s->method->ssl_accept;\n    } else {\n        SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO, SSL_R_UNKNOWN_PROTOCOL);\n        goto err;\n    }\n    s->init_num = 0;\n    if (buf != buf_space)\n        OPENSSL_free(buf);\n    return (SSL_accept(s));\n err:\n    if (buf != buf_space)\n        OPENSSL_free(buf);\n    return (-1);\n}']