ssl/statem/statem_dtls.c:369: error: BUFFER_OVERRUN_L3
  Offset: 11 (⇐ 9 + 2) Size: [1, 2147483644].
Showing all 11 steps of the trace


ssl/statem/statem_dtls.c:338:10: <Length trace>
336.   
337.    again:
338.       ok = dtls_get_reassembled_message(s, &tmplen);
                ^
339.       if (tmplen == DTLS1_HM_BAD_FRAGMENT || tmplen == DTLS1_HM_FRAGMENT_RETRY) {
340.           /* bad fragment received */

ssl/statem/statem_dtls.c:338:10: Call
336.   
337.    again:
338.       ok = dtls_get_reassembled_message(s, &tmplen);
                ^
339.       if (tmplen == DTLS1_HM_BAD_FRAGMENT || tmplen == DTLS1_HM_FRAGMENT_RETRY) {
340.           /* bad fragment received */

ssl/statem/statem_dtls.c:699:1: Parameter `*s->init_buf->data`
  697.   }
  698.   
  699. > static int dtls_get_reassembled_message(SSL *s, long *len)
  700.   {
  701.       unsigned char wire[DTLS1_HM_HEADER_LENGTH];

ssl/statem/statem_dtls.c:709:21: Call
  707.    redo:
  708.       /* see if we have the required fragment already */
  709.       if ((frag_len = dtls1_retrieve_buffered_fragment(s, &ok)) || ok) {
                             ^
  710.           if (ok)
  711.               s->init_num = frag_len;

ssl/statem/statem_dtls.c:432:1: Parameter `*s->init_buf->data`
    430.   }
    431.   
    432. > static int dtls1_retrieve_buffered_fragment(SSL *s, int *ok)
    433.   {
    434.       /*-

ssl/statem/statem_dtls.c:348:5: Assignment
346.       *mt = s->s3->tmp.message_type;
347.   
348.       p = (unsigned char *)s->init_buf->data;
           ^
349.   
350.       if (*mt == SSL3_MT_CHANGE_CIPHER_SPEC) {

ssl/statem/statem_dtls.c:365:7: Assignment
363.   
364.       /* reconstruct message header */
365.       *(p++) = msg_hdr->type;
             ^
366.       l2n3(msg_len, p);
367.       s2n(msg_hdr->seq, p);

ssl/statem/statem_dtls.c:366:5: Assignment
364.       /* reconstruct message header */
365.       *(p++) = msg_hdr->type;
366.       l2n3(msg_len, p);
           ^
367.       s2n(msg_hdr->seq, p);
368.       l2n3(0, p);

ssl/statem/statem_dtls.c:367:5: Assignment
365.       *(p++) = msg_hdr->type;
366.       l2n3(msg_len, p);
367.       s2n(msg_hdr->seq, p);
           ^
368.       l2n3(0, p);
369.       l2n3(msg_len, p);

ssl/statem/statem_dtls.c:368:5: Assignment
366.       l2n3(msg_len, p);
367.       s2n(msg_hdr->seq, p);
368.       l2n3(0, p);
           ^
369.       l2n3(msg_len, p);
370.       if (s->version != DTLS1_BAD_VER) {

ssl/statem/statem_dtls.c:369:5: Array access: Offset: 11 (⇐ 9 + 2) Size: [1, 2147483644]
367.       s2n(msg_hdr->seq, p);
368.       l2n3(0, p);
369.       l2n3(msg_len, p);
           ^
370.       if (s->version != DTLS1_BAD_VER) {
371.           p -= DTLS1_HM_HEADER_LENGTH;

int dtls_get_message(SSL *s, int *mt, unsigned long *len)
{
    struct hm_header_st *msg_hdr;
    unsigned char *p;
    unsigned long msg_len;
    int ok;
    long tmplen;
    msg_hdr = &s->d1->r_msg_hdr;
    memset(msg_hdr, 0, sizeof(*msg_hdr));
 again:
    ok = dtls_get_reassembled_message(s, &tmplen);
    if (tmplen == DTLS1_HM_BAD_FRAGMENT || tmplen == DTLS1_HM_FRAGMENT_RETRY) {
        goto again;
    } else if (tmplen <= 0 && !ok) {
        return 0;
    }
    *mt = s->s3->tmp.message_type;
    p = (unsigned char *)s->init_buf->data;
    if (*mt == SSL3_MT_CHANGE_CIPHER_SPEC) {
        if (s->msg_callback) {
            s->msg_callback(0, s->version, SSL3_RT_CHANGE_CIPHER_SPEC,
                            p, 1, s, s->msg_callback_arg);
        }
        *len = (unsigned long)tmplen;
        return 1;
    }
    msg_len = msg_hdr->msg_len;
    *(p++) = msg_hdr->type;
    l2n3(msg_len, p);
    s2n(msg_hdr->seq, p);
    l2n3(0, p);
    l2n3(msg_len, p);
    if (s->version != DTLS1_BAD_VER) {
        p -= DTLS1_HM_HEADER_LENGTH;
        msg_len += DTLS1_HM_HEADER_LENGTH;
    }
    if (!ssl3_finish_mac(s, p, msg_len))
        return 0;
    if (s->msg_callback)
        s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,
                        p, msg_len, s, s->msg_callback_arg);
    memset(msg_hdr, 0, sizeof(*msg_hdr));
    s->d1->handshake_read_seq++;
    s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
    *len = s->init_num;
    return 1;
}
['int dtls_get_message(SSL *s, int *mt, unsigned long *len)\n{\n    struct hm_header_st *msg_hdr;\n    unsigned char *p;\n    unsigned long msg_len;\n    int ok;\n    long tmplen;\n    msg_hdr = &s->d1->r_msg_hdr;\n    memset(msg_hdr, 0, sizeof(*msg_hdr));\n again:\n    ok = dtls_get_reassembled_message(s, &tmplen);\n    if (tmplen == DTLS1_HM_BAD_FRAGMENT || tmplen == DTLS1_HM_FRAGMENT_RETRY) {\n        goto again;\n    } else if (tmplen <= 0 && !ok) {\n        return 0;\n    }\n    *mt = s->s3->tmp.message_type;\n    p = (unsigned char *)s->init_buf->data;\n    if (*mt == SSL3_MT_CHANGE_CIPHER_SPEC) {\n        if (s->msg_callback) {\n            s->msg_callback(0, s->version, SSL3_RT_CHANGE_CIPHER_SPEC,\n                            p, 1, s, s->msg_callback_arg);\n        }\n        *len = (unsigned long)tmplen;\n        return 1;\n    }\n    msg_len = msg_hdr->msg_len;\n    *(p++) = msg_hdr->type;\n    l2n3(msg_len, p);\n    s2n(msg_hdr->seq, p);\n    l2n3(0, p);\n    l2n3(msg_len, p);\n    if (s->version != DTLS1_BAD_VER) {\n        p -= DTLS1_HM_HEADER_LENGTH;\n        msg_len += DTLS1_HM_HEADER_LENGTH;\n    }\n    if (!ssl3_finish_mac(s, p, msg_len))\n        return 0;\n    if (s->msg_callback)\n        s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,\n                        p, msg_len, s, s->msg_callback_arg);\n    memset(msg_hdr, 0, sizeof(*msg_hdr));\n    s->d1->handshake_read_seq++;\n    s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;\n    *len = s->init_num;\n    return 1;\n}', 'static int dtls_get_reassembled_message(SSL *s, long *len)\n{\n    unsigned char wire[DTLS1_HM_HEADER_LENGTH];\n    unsigned long mlen, frag_off, frag_len;\n    int i, al, recvd_type;\n    struct hm_header_st msg_hdr;\n    int ok;\n redo:\n    if ((frag_len = dtls1_retrieve_buffered_fragment(s, &ok)) || ok) {\n        if (ok)\n            s->init_num = frag_len;\n        *len = frag_len;\n        return ok;\n    }\n    i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, &recvd_type, wire,\n                                  DTLS1_HM_HEADER_LENGTH, 0);\n    if (i <= 0) {\n        s->rwstate = SSL_READING;\n        *len = i;\n        return 0;\n    }\n    if (recvd_type == SSL3_RT_CHANGE_CIPHER_SPEC) {\n        if (wire[0] != SSL3_MT_CCS) {\n            al = SSL_AD_UNEXPECTED_MESSAGE;\n            SSLerr(SSL_F_DTLS_GET_REASSEMBLED_MESSAGE,\n                   SSL_R_BAD_CHANGE_CIPHER_SPEC);\n            goto f_err;\n        }\n        memcpy(s->init_buf->data, wire, i);\n        s->init_num = i - 1;\n        s->init_msg = s->init_buf->data + 1;\n        s->s3->tmp.message_type = SSL3_MT_CHANGE_CIPHER_SPEC;\n        s->s3->tmp.message_size = i - 1;\n        *len = i - 1;\n        return 1;\n    }\n    if (i != DTLS1_HM_HEADER_LENGTH) {\n        al = SSL_AD_UNEXPECTED_MESSAGE;\n        SSLerr(SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);\n        goto f_err;\n    }\n    dtls1_get_message_header(wire, &msg_hdr);\n    mlen = msg_hdr.msg_len;\n    frag_off = msg_hdr.frag_off;\n    frag_len = msg_hdr.frag_len;\n    if (frag_len > RECORD_LAYER_get_rrec_length(&s->rlayer)) {\n        al = SSL3_AD_ILLEGAL_PARAMETER;\n        SSLerr(SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, SSL_R_BAD_LENGTH);\n        goto f_err;\n    }\n    if (msg_hdr.seq != s->d1->handshake_read_seq) {\n        *len = dtls1_process_out_of_seq_message(s, &msg_hdr, &ok);\n        return ok;\n    }\n    if (frag_len && frag_len < mlen) {\n        *len = dtls1_reassemble_fragment(s, &msg_hdr, &ok);\n        return ok;\n    }\n    if (!s->server && s->d1->r_msg_hdr.frag_off == 0 &&\n        wire[0] == SSL3_MT_HELLO_REQUEST) {\n        if (wire[1] == 0 && wire[2] == 0 && wire[3] == 0) {\n            if (s->msg_callback)\n                s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,\n                                wire, DTLS1_HM_HEADER_LENGTH, s,\n                                s->msg_callback_arg);\n            s->init_num = 0;\n            goto redo;\n        } else {\n            al = SSL_AD_UNEXPECTED_MESSAGE;\n            SSLerr(SSL_F_DTLS_GET_REASSEMBLED_MESSAGE,\n                   SSL_R_UNEXPECTED_MESSAGE);\n            goto f_err;\n        }\n    }\n    if ((al = dtls1_preprocess_fragment(s, &msg_hdr)))\n        goto f_err;\n    if (frag_len > 0) {\n        unsigned char *p =\n            (unsigned char *)s->init_buf->data + DTLS1_HM_HEADER_LENGTH;\n        i = s->method->ssl_read_bytes(s, SSL3_RT_HANDSHAKE, NULL,\n                                      &p[frag_off], frag_len, 0);\n        if (i <= 0) {\n            s->rwstate = SSL_READING;\n            *len = i;\n            return 0;\n        }\n    } else\n        i = 0;\n    if (i != (int)frag_len) {\n        al = SSL3_AD_ILLEGAL_PARAMETER;\n        SSLerr(SSL_F_DTLS_GET_REASSEMBLED_MESSAGE, SSL3_AD_ILLEGAL_PARAMETER);\n        goto f_err;\n    }\n    *len = s->init_num = frag_len;\n    return 1;\n f_err:\n    ssl3_send_alert(s, SSL3_AL_FATAL, al);\n    s->init_num = 0;\n    *len = -1;\n    return 0;\n}', 'static int dtls1_retrieve_buffered_fragment(SSL *s, int *ok)\n{\n    pitem *item;\n    hm_fragment *frag;\n    int al;\n    *ok = 0;\n    item = pqueue_peek(s->d1->buffered_messages);\n    if (item == NULL)\n        return 0;\n    frag = (hm_fragment *)item->data;\n    if (frag->reassembly != NULL)\n        return 0;\n    if (s->d1->handshake_read_seq == frag->msg_header.seq) {\n        unsigned long frag_len = frag->msg_header.frag_len;\n        pqueue_pop(s->d1->buffered_messages);\n        al = dtls1_preprocess_fragment(s, &frag->msg_header);\n        if (al == 0) {\n            unsigned char *p =\n                (unsigned char *)s->init_buf->data + DTLS1_HM_HEADER_LENGTH;\n            memcpy(&p[frag->msg_header.frag_off], frag->fragment,\n                   frag->msg_header.frag_len);\n        }\n        dtls1_hm_fragment_free(frag);\n        pitem_free(item);\n        if (al == 0) {\n            *ok = 1;\n            return frag_len;\n        }\n        ssl3_send_alert(s, SSL3_AL_FATAL, al);\n        s->init_num = 0;\n        *ok = 0;\n        return -1;\n    } else\n        return 0;\n}']