apps/s_server.c:2791: error: BUFFER_OVERRUN_L1
  Offset: -1 Size: [max(1, `bufsize`), max(0, `bufsize`)] by call to `SSL_get_shared_ciphers`.
Showing all 13 steps of the trace


apps/s_server.c:2586:1: Global `bufsize`
2584.   #endif
2585.   
2586. > static int www_body(char *hostname, int s, int stype, unsigned char *context)
2587.   {
2588.       char *buf = NULL;

apps/s_server.c:2603:11: Call
2601.       width = s + 1;
2602.   
2603.       buf = app_malloc(bufsize, "server www buffer");
                  ^
2604.       io = BIO_new(BIO_f_buffer());
2605.       ssl_bio = BIO_new(BIO_f_ssl());

apps/apps.c:976:1: Parameter `sz`
  974.   }
  975.   
  976. > void* app_malloc(int sz, const char *what)
  977.   {
  978.       void *vp = OPENSSL_malloc(sz);

apps/apps.c:978:16: Call
  976.   void* app_malloc(int sz, const char *what)
  977.   {
  978.       void *vp = OPENSSL_malloc(sz);
                        ^
  979.   
  980.       if (vp == NULL) {

crypto/mem.c:125:9: Assignment
    123.   
    124.       if (num <= 0)
    125.           return NULL;
                   ^
    126.   
    127.       allow_customize = 0;

apps/apps.c:978:5: Assignment
  976.   void* app_malloc(int sz, const char *what)
  977.   {
  978.       void *vp = OPENSSL_malloc(sz);
             ^
  979.   
  980.       if (vp == NULL) {

apps/apps.c:986:5: Assignment
  984.           exit(1);
  985.       }
  986.       return vp;
             ^
  987.   }
  988.   

apps/s_server.c:2603:5: Assignment
2601.       width = s + 1;
2602.   
2603.       buf = app_malloc(bufsize, "server www buffer");
            ^
2604.       io = BIO_new(BIO_f_buffer());
2605.       ssl_bio = BIO_new(BIO_f_ssl());

apps/s_server.c:2791:17: Call
2789.               }
2790.               BIO_puts(io, "\n");
2791.               p = SSL_get_shared_ciphers(con, buf, bufsize);
                        ^
2792.               if (p != NULL) {
2793.                   BIO_printf(io,

ssl/ssl_lib.c:1940:1: <Length trace>
1938.   }
1939.   
1940. > char *SSL_get_shared_ciphers(const SSL *s, char *buf, int len)
1941.   {
1942.       char *p;

ssl/ssl_lib.c:1940:1: Parameter `*buf`
  1938.   }
  1939.   
  1940. > char *SSL_get_shared_ciphers(const SSL *s, char *buf, int len)
  1941.   {
  1942.       char *p;

ssl/ssl_lib.c:1950:5: Assignment
  1948.           return (NULL);
  1949.   
  1950.       p = buf;
              ^
  1951.       sk = s->session->ciphers;
  1952.   

ssl/ssl_lib.c:1972:5: Array access: Offset: -1 Size: [max(1, bufsize), max(0, bufsize)] by call to `SSL_get_shared_ciphers` 
  1970.           len -= n + 1;
  1971.       }
  1972.       p[-1] = '\0';
              ^
  1973.       return (buf);
  1974.   }

char *SSL_get_shared_ciphers(const SSL *s, char *buf, int len)
{
    char *p;
    STACK_OF(SSL_CIPHER) *sk;
    const SSL_CIPHER *c;
    int i;
    if ((s->session == NULL) || (s->session->ciphers == NULL) || (len < 2))
        return (NULL);
    p = buf;
    sk = s->session->ciphers;
    if (sk_SSL_CIPHER_num(sk) == 0)
        return NULL;
    for (i = 0; i < sk_SSL_CIPHER_num(sk); i++) {
        int n;
        c = sk_SSL_CIPHER_value(sk, i);
        n = strlen(c->name);
        if (n + 1 > len) {
            if (p != buf)
                --p;
            *p = '\0';
            return buf;
        }
        strcpy(p, c->name);
        p += n;
        *(p++) = ':';
        len -= n + 1;
    }
    p[-1] = '\0';
    return (buf);
}
['static int www_body(char *hostname, int s, int stype, unsigned char *context)\n{\n    char *buf = NULL;\n    int ret = 1;\n    int i, j, k, dot;\n    SSL *con;\n    const SSL_CIPHER *c;\n    BIO *io, *ssl_bio, *sbio;\n#ifdef RENEG\n    int total_bytes = 0;\n#endif\n    int width;\n    fd_set readfds;\n    width = s + 1;\n    buf = app_malloc(bufsize, "server www buffer");\n    io = BIO_new(BIO_f_buffer());\n    ssl_bio = BIO_new(BIO_f_ssl());\n    if ((io == NULL) || (ssl_bio == NULL))\n        goto err;\n#ifdef FIONBIO\n    if (s_nbio) {\n        unsigned long sl = 1;\n        if (!s_quiet)\n            BIO_printf(bio_err, "turning on non blocking io\\n");\n        if (BIO_socket_ioctl(s, FIONBIO, &sl) < 0)\n            ERR_print_errors(bio_err);\n    }\n#endif\n    if (!BIO_set_write_buffer_size(io, bufsize))\n        goto err;\n    if ((con = SSL_new(ctx)) == NULL)\n        goto err;\n    if (s_tlsextdebug) {\n        SSL_set_tlsext_debug_callback(con, tlsext_cb);\n        SSL_set_tlsext_debug_arg(con, bio_s_out);\n    }\n    if (context && !SSL_set_session_id_context(con, context,\n                        strlen((char *)context)))\n        goto err;\n    sbio = BIO_new_socket(s, BIO_NOCLOSE);\n    if (s_nbio_test) {\n        BIO *test;\n        test = BIO_new(BIO_f_nbio_test());\n        sbio = BIO_push(test, sbio);\n    }\n    SSL_set_bio(con, sbio, sbio);\n    SSL_set_accept_state(con);\n    BIO_set_ssl(ssl_bio, con, BIO_CLOSE);\n    BIO_push(io, ssl_bio);\n#ifdef CHARSET_EBCDIC\n    io = BIO_push(BIO_new(BIO_f_ebcdic_filter()), io);\n#endif\n    if (s_debug) {\n        SSL_set_debug(con, 1);\n        BIO_set_callback(SSL_get_rbio(con), bio_dump_callback);\n        BIO_set_callback_arg(SSL_get_rbio(con), (char *)bio_s_out);\n    }\n    if (s_msg) {\n#ifndef OPENSSL_NO_SSL_TRACE\n        if (s_msg == 2)\n            SSL_set_msg_callback(con, SSL_trace);\n        else\n#endif\n            SSL_set_msg_callback(con, msg_cb);\n        SSL_set_msg_callback_arg(con, bio_s_msg ? bio_s_msg : bio_s_out);\n    }\n    for (;;) {\n        i = BIO_gets(io, buf, bufsize - 1);\n        if (i < 0) {\n            if (!BIO_should_retry(io) && !SSL_waiting_for_async(con)) {\n                if (!s_quiet)\n                    ERR_print_errors(bio_err);\n                goto err;\n            } else {\n                BIO_printf(bio_s_out, "read R BLOCK\\n");\n#ifndef OPENSSL_NO_SRP\n                if (BIO_should_io_special(io)\n                    && BIO_get_retry_reason(io) == BIO_RR_SSL_X509_LOOKUP) {\n                    BIO_printf(bio_s_out, "LOOKUP renego during read\\n");\n                    srp_callback_parm.user =\n                        SRP_VBASE_get_by_user(srp_callback_parm.vb,\n                                              srp_callback_parm.login);\n                    if (srp_callback_parm.user)\n                        BIO_printf(bio_s_out, "LOOKUP done %s\\n",\n                                   srp_callback_parm.user->info);\n                    else\n                        BIO_printf(bio_s_out, "LOOKUP not successful\\n");\n                    continue;\n                }\n#endif\n#if defined(OPENSSL_SYS_NETWARE)\n                delay(1000);\n#elif !defined(OPENSSL_SYS_MSDOS)\n                sleep(1);\n#endif\n                continue;\n            }\n        } else if (i == 0) {\n            ret = 1;\n            goto end;\n        }\n        if (((www == 1) && (strncmp("GET ", buf, 4) == 0)) ||\n            ((www == 2) && (strncmp("GET /stats ", buf, 11) == 0))) {\n            char *p;\n            X509 *peer;\n            STACK_OF(SSL_CIPHER) *sk;\n            static const char *space = "                          ";\n            if (www == 1 && strncmp("GET /reneg", buf, 10) == 0) {\n                if (strncmp("GET /renegcert", buf, 14) == 0)\n                    SSL_set_verify(con,\n                                   SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE,\n                                   NULL);\n                i = SSL_renegotiate(con);\n                BIO_printf(bio_s_out, "SSL_renegotiate -> %d\\n", i);\n                i = SSL_do_handshake(con);\n                if (i <= 0) {\n                    BIO_printf(bio_s_out, "SSL_do_handshake() Retval %d\\n",\n                               SSL_get_error(con, i));\n                    ERR_print_errors(bio_err);\n                    goto err;\n                }\n                FD_ZERO(&readfds);\n                openssl_fdset(s, &readfds);\n                i = select(width, (void *)&readfds, NULL, NULL, NULL);\n                if (i <= 0 || !FD_ISSET(s, &readfds)) {\n                    BIO_printf(bio_s_out, "Error waiting for client response\\n");\n                    ERR_print_errors(bio_err);\n                    goto err;\n                }\n                BIO_gets(io, buf, bufsize - 1);\n            }\n            BIO_puts(io,\n                     "HTTP/1.0 200 ok\\r\\nContent-type: text/html\\r\\n\\r\\n");\n            BIO_puts(io, "<HTML><BODY BGCOLOR=\\"#ffffff\\">\\n");\n            BIO_puts(io, "<pre>\\n");\n            BIO_puts(io, "\\n");\n            for (i = 0; i < local_argc; i++) {\n                const char *myp;\n                for (myp = local_argv[i]; *myp; myp++)\n                    switch (*myp) {\n                    case \'<\':\n                        BIO_puts(io, "&lt;");\n                        break;\n                    case \'>\':\n                        BIO_puts(io, "&gt;");\n                        break;\n                    case \'&\':\n                        BIO_puts(io, "&amp;");\n                        break;\n                    default:\n                        BIO_write(io, myp, 1);\n                        break;\n                    }\n                BIO_write(io, " ", 1);\n            }\n            BIO_puts(io, "\\n");\n            BIO_printf(io,\n                       "Secure Renegotiation IS%s supported\\n",\n                       SSL_get_secure_renegotiation_support(con) ?\n                       "" : " NOT");\n            BIO_printf(io, "Ciphers supported in s_server binary\\n");\n            sk = SSL_get_ciphers(con);\n            j = sk_SSL_CIPHER_num(sk);\n            for (i = 0; i < j; i++) {\n                c = sk_SSL_CIPHER_value(sk, i);\n                BIO_printf(io, "%-11s:%-25s ",\n                           SSL_CIPHER_get_version(c), SSL_CIPHER_get_name(c));\n                if ((((i + 1) % 2) == 0) && (i + 1 != j))\n                    BIO_puts(io, "\\n");\n            }\n            BIO_puts(io, "\\n");\n            p = SSL_get_shared_ciphers(con, buf, bufsize);\n            if (p != NULL) {\n                BIO_printf(io,\n                           "---\\nCiphers common between both SSL end points:\\n");\n                j = i = 0;\n                while (*p) {\n                    if (*p == \':\') {\n                        BIO_write(io, space, 26 - j);\n                        i++;\n                        j = 0;\n                        BIO_write(io, ((i % 3) ? " " : "\\n"), 1);\n                    } else {\n                        BIO_write(io, p, 1);\n                        j++;\n                    }\n                    p++;\n                }\n                BIO_puts(io, "\\n");\n            }\n            ssl_print_sigalgs(io, con);\n#ifndef OPENSSL_NO_EC\n            ssl_print_curves(io, con, 0);\n#endif\n            BIO_printf(io, (SSL_cache_hit(con)\n                            ? "---\\nReused, " : "---\\nNew, "));\n            c = SSL_get_current_cipher(con);\n            BIO_printf(io, "%s, Cipher is %s\\n",\n                       SSL_CIPHER_get_version(c), SSL_CIPHER_get_name(c));\n            SSL_SESSION_print(io, SSL_get_session(con));\n            BIO_printf(io, "---\\n");\n            print_stats(io, SSL_get_SSL_CTX(con));\n            BIO_printf(io, "---\\n");\n            peer = SSL_get_peer_certificate(con);\n            if (peer != NULL) {\n                BIO_printf(io, "Client certificate\\n");\n                X509_print(io, peer);\n                PEM_write_bio_X509(io, peer);\n            } else\n                BIO_puts(io, "no client certificate available\\n");\n            BIO_puts(io, "</BODY></HTML>\\r\\n\\r\\n");\n            break;\n        } else if ((www == 2 || www == 3)\n                   && (strncmp("GET /", buf, 5) == 0)) {\n            BIO *file;\n            char *p, *e;\n            static const char *text =\n                "HTTP/1.0 200 ok\\r\\nContent-type: text/plain\\r\\n\\r\\n";\n            p = &(buf[5]);\n            dot = 1;\n            for (e = p; *e != \'\\0\'; e++) {\n                if (e[0] == \' \')\n                    break;\n                switch (dot) {\n                case 1:\n                    dot = (e[0] == \'.\') ? 2 : 0;\n                    break;\n                case 2:\n                    dot = (e[0] == \'.\') ? 3 : 0;\n                    break;\n                case 3:\n                    dot = (e[0] == \'/\') ? -1 : 0;\n                    break;\n                }\n                if (dot == 0)\n                    dot = (e[0] == \'/\') ? 1 : 0;\n            }\n            dot = (dot == 3) || (dot == -1);\n            if (*e == \'\\0\') {\n                BIO_puts(io, text);\n                BIO_printf(io, "\'%s\' is an invalid file name\\r\\n", p);\n                break;\n            }\n            *e = \'\\0\';\n            if (dot) {\n                BIO_puts(io, text);\n                BIO_printf(io, "\'%s\' contains \'..\' reference\\r\\n", p);\n                break;\n            }\n            if (*p == \'/\') {\n                BIO_puts(io, text);\n                BIO_printf(io, "\'%s\' is an invalid path\\r\\n", p);\n                break;\n            }\n            if (app_isdir(p) > 0) {\n                BIO_puts(io, text);\n                BIO_printf(io, "\'%s\' is a directory\\r\\n", p);\n                break;\n            }\n            if ((file = BIO_new_file(p, "r")) == NULL) {\n                BIO_puts(io, text);\n                BIO_printf(io, "Error opening \'%s\'\\r\\n", p);\n                ERR_print_errors(io);\n                break;\n            }\n            if (!s_quiet)\n                BIO_printf(bio_err, "FILE:%s\\n", p);\n            if (www == 2) {\n                i = strlen(p);\n                if (((i > 5) && (strcmp(&(p[i - 5]), ".html") == 0)) ||\n                    ((i > 4) && (strcmp(&(p[i - 4]), ".php") == 0)) ||\n                    ((i > 4) && (strcmp(&(p[i - 4]), ".htm") == 0)))\n                    BIO_puts(io,\n                             "HTTP/1.0 200 ok\\r\\nContent-type: text/html\\r\\n\\r\\n");\n                else\n                    BIO_puts(io,\n                             "HTTP/1.0 200 ok\\r\\nContent-type: text/plain\\r\\n\\r\\n");\n            }\n            for (;;) {\n                i = BIO_read(file, buf, bufsize);\n                if (i <= 0)\n                    break;\n#ifdef RENEG\n                total_bytes += i;\n                BIO_printf(bio_err, "%d\\n", i);\n                if (total_bytes > 3 * 1024) {\n                    total_bytes = 0;\n                    BIO_printf(bio_err, "RENEGOTIATE\\n");\n                    SSL_renegotiate(con);\n                }\n#endif\n                for (j = 0; j < i;) {\n#ifdef RENEG\n                    {\n                        static count = 0;\n                        if (++count == 13) {\n                            SSL_renegotiate(con);\n                        }\n                    }\n#endif\n                    k = BIO_write(io, &(buf[j]), i - j);\n                    if (k <= 0) {\n                        if (!BIO_should_retry(io)  && !SSL_waiting_for_async(con))\n                            goto write_error;\n                        else {\n                            BIO_printf(bio_s_out, "rwrite W BLOCK\\n");\n                        }\n                    } else {\n                        j += k;\n                    }\n                }\n            }\n write_error:\n            BIO_free(file);\n            break;\n        }\n    }\n    for (;;) {\n        i = (int)BIO_flush(io);\n        if (i <= 0) {\n            if (!BIO_should_retry(io))\n                break;\n        } else\n            break;\n    }\n end:\n    SSL_set_shutdown(con, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);\n err:\n    if (ret >= 0)\n        BIO_printf(bio_s_out, "ACCEPT\\n");\n    OPENSSL_free(buf);\n    BIO_free_all(io);\n    return (ret);\n}', 'void* app_malloc(int sz, const char *what)\n{\n    void *vp = OPENSSL_malloc(sz);\n    if (vp == NULL) {\n        BIO_printf(bio_err, "%s: Could not allocate %d bytes for %s\\n",\n                opt_getprog(), sz, what);\n        ERR_print_errors(bio_err);\n        exit(1);\n    }\n    return vp;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifdef CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}', "char *SSL_get_shared_ciphers(const SSL *s, char *buf, int len)\n{\n    char *p;\n    STACK_OF(SSL_CIPHER) *sk;\n    const SSL_CIPHER *c;\n    int i;\n    if ((s->session == NULL) || (s->session->ciphers == NULL) || (len < 2))\n        return (NULL);\n    p = buf;\n    sk = s->session->ciphers;\n    if (sk_SSL_CIPHER_num(sk) == 0)\n        return NULL;\n    for (i = 0; i < sk_SSL_CIPHER_num(sk); i++) {\n        int n;\n        c = sk_SSL_CIPHER_value(sk, i);\n        n = strlen(c->name);\n        if (n + 1 > len) {\n            if (p != buf)\n                --p;\n            *p = '\\0';\n            return buf;\n        }\n        strcpy(p, c->name);\n        p += n;\n        *(p++) = ':';\n        len -= n + 1;\n    }\n    p[-1] = '\\0';\n    return (buf);\n}"]