ssl/ssl_lib.c:261: error: BUFFER_OVERRUN_L3
  Offset: 7 Size: [6, 25] by call to `ssl_create_cipher_list`.
Showing all 7 steps of the trace


ssl/ssl_lib.c:263:3: Array declaration
261.   	sk=ssl_create_cipher_list(ctx->method,&(ctx->cipher_list),
262.   		&(ctx->cipher_list_by_id),
263.   		meth->version == SSL2_VERSION ? "SSLv2" : SSL_DEFAULT_CIPHER_LIST);
         ^
264.   	if ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0))
265.   		{

ssl/ssl_lib.c:261:5: Call
259.   	ctx->method=meth;
260.   
261.   	sk=ssl_create_cipher_list(ctx->method,&(ctx->cipher_list),
           ^
262.   		&(ctx->cipher_list_by_id),
263.   		meth->version == SSL2_VERSION ? "SSLv2" : SSL_DEFAULT_CIPHER_LIST);

ssl/ssl_ciph.c:1276:1: <Length trace>
1274.   	}
1275.   
1276. > STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
1277.   		STACK_OF(SSL_CIPHER) **cipher_list,
1278.   		STACK_OF(SSL_CIPHER) **cipher_list_by_id,

ssl/ssl_ciph.c:1276:1: Parameter `*rule_str`
  1274.   	}
  1275.   
  1276. > STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
  1277.   		STACK_OF(SSL_CIPHER) **cipher_list,
  1278.   		STACK_OF(SSL_CIPHER) **cipher_list_by_id,

ssl/ssl_ciph.c:1389:2: Assignment
  1387.   	 */
  1388.   	ok = 1;
  1389.   	rule_p = rule_str;
           ^
  1390.   	if (strncmp(rule_str,"DEFAULT",7) == 0)
  1391.   		{

ssl/ssl_ciph.c:1394:3: Assignment
  1392.   		ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,
  1393.   			&head, &tail, ca_list);
  1394.   		rule_p += 7;
            ^
  1395.   		if (*rule_p == ':')
  1396.   			rule_p++;

ssl/ssl_ciph.c:1395:7: Array access: Offset: 7 Size: [6, 25] by call to `ssl_create_cipher_list` 
  1393.   			&head, &tail, ca_list);
  1394.   		rule_p += 7;
  1395.   		if (*rule_p == ':')
                ^
  1396.   			rule_p++;
  1397.   		}

STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,
		STACK_OF(SSL_CIPHER) **cipher_list,
		STACK_OF(SSL_CIPHER) **cipher_list_by_id,
		const char *rule_str)
	{
	int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;
	unsigned long disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl;
	STACK_OF(SSL_CIPHER) *cipherstack, *tmp_cipher_list;
	const char *rule_p;
	CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;
	const SSL_CIPHER **ca_list = NULL;
	if (rule_str == NULL || cipher_list == NULL || cipher_list_by_id == NULL)
		return NULL;
	ssl_cipher_get_disabled(&disabled_mkey, &disabled_auth, &disabled_enc, &disabled_mac, &disabled_ssl);
	num_of_ciphers = ssl_method->num_ciphers();
#ifdef KSSL_DEBUG
	printf("ssl_create_cipher_list() for %d ciphers\n", num_of_ciphers);
#endif
	co_list = (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);
	if (co_list == NULL)
		{
		SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
		return(NULL);
		}
	ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers,
	                           disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl,
	                           co_list, &head, &tail);
	ssl_cipher_apply_rule(0, SSL_kEECDH, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
	ssl_cipher_apply_rule(0, SSL_kEECDH, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);
	ssl_cipher_apply_rule(0, 0, 0, SSL_AES, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
	ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
	ssl_cipher_apply_rule(0, 0, 0, 0, SSL_MD5, 0, 0, CIPHER_ORD, -1, &head, &tail);
	ssl_cipher_apply_rule(0, 0, SSL_aNULL, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
	ssl_cipher_apply_rule(0, 0, SSL_aECDH, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
	ssl_cipher_apply_rule(0, SSL_kRSA, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
	ssl_cipher_apply_rule(0, SSL_kPSK, 0,0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
	ssl_cipher_apply_rule(0, SSL_kKRB5, 0,0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
	ssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);
	if (!ssl_cipher_strength_sort(&head, &tail))
		{
		OPENSSL_free(co_list);
		return NULL;
		}
	ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);
	num_of_group_aliases = sizeof(cipher_aliases) / sizeof(SSL_CIPHER);
	num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;
	ca_list = OPENSSL_malloc(sizeof(SSL_CIPHER *) * num_of_alias_max);
	if (ca_list == NULL)
		{
		OPENSSL_free(co_list);
		SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);
		return(NULL);
		}
	ssl_cipher_collect_aliases(ca_list, num_of_group_aliases,
	                           disabled_mkey, disabled_auth, disabled_enc,
				   disabled_mac, disabled_ssl, head);
	ok = 1;
	rule_p = rule_str;
	if (strncmp(rule_str,"DEFAULT",7) == 0)
		{
		ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,
			&head, &tail, ca_list);
		rule_p += 7;
		if (*rule_p == ':')
			rule_p++;
		}
	if (ok && (strlen(rule_p) > 0))
		ok = ssl_cipher_process_rulestr(rule_p, &head, &tail, ca_list);
	OPENSSL_free((void *)ca_list);
	if (!ok)
		{
		OPENSSL_free(co_list);
		return(NULL);
		}
	if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL)
		{
		OPENSSL_free(co_list);
		return(NULL);
		}
	for (curr = head; curr != NULL; curr = curr->next)
		{
		if (curr->active)
			{
			sk_SSL_CIPHER_push(cipherstack, curr->cipher);
#ifdef CIPHER_DEBUG
			printf("<%s>\n",curr->cipher->name);
#endif
			}
		}
	OPENSSL_free(co_list);
	tmp_cipher_list = sk_SSL_CIPHER_dup(cipherstack);
	if (tmp_cipher_list == NULL)
		{
		sk_SSL_CIPHER_free(cipherstack);
		return NULL;
		}
	if (*cipher_list != NULL)
		sk_SSL_CIPHER_free(*cipher_list);
	*cipher_list = cipherstack;
	if (*cipher_list_by_id != NULL)
		sk_SSL_CIPHER_free(*cipher_list_by_id);
	*cipher_list_by_id = tmp_cipher_list;
	(void)sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,ssl_cipher_ptr_id_cmp);
	sk_SSL_CIPHER_sort(*cipher_list_by_id);
	return(cipherstack);
	}
['int SSL_CTX_set_ssl_version(SSL_CTX *ctx,const SSL_METHOD *meth)\n\t{\n\tSTACK_OF(SSL_CIPHER) *sk;\n\tctx->method=meth;\n\tsk=ssl_create_cipher_list(ctx->method,&(ctx->cipher_list),\n\t\t&(ctx->cipher_list_by_id),\n\t\tmeth->version == SSL2_VERSION ? "SSLv2" : SSL_DEFAULT_CIPHER_LIST);\n\tif ((sk == NULL) || (sk_SSL_CIPHER_num(sk) <= 0))\n\t\t{\n\t\tSSLerr(SSL_F_SSL_CTX_SET_SSL_VERSION,SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS);\n\t\treturn(0);\n\t\t}\n\treturn(1);\n\t}', 'STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method,\n\t\tSTACK_OF(SSL_CIPHER) **cipher_list,\n\t\tSTACK_OF(SSL_CIPHER) **cipher_list_by_id,\n\t\tconst char *rule_str)\n\t{\n\tint ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;\n\tunsigned long disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl;\n\tSTACK_OF(SSL_CIPHER) *cipherstack, *tmp_cipher_list;\n\tconst char *rule_p;\n\tCIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;\n\tconst SSL_CIPHER **ca_list = NULL;\n\tif (rule_str == NULL || cipher_list == NULL || cipher_list_by_id == NULL)\n\t\treturn NULL;\n\tssl_cipher_get_disabled(&disabled_mkey, &disabled_auth, &disabled_enc, &disabled_mac, &disabled_ssl);\n\tnum_of_ciphers = ssl_method->num_ciphers();\n#ifdef KSSL_DEBUG\n\tprintf("ssl_create_cipher_list() for %d ciphers\\n", num_of_ciphers);\n#endif\n\tco_list = (CIPHER_ORDER *)OPENSSL_malloc(sizeof(CIPHER_ORDER) * num_of_ciphers);\n\tif (co_list == NULL)\n\t\t{\n\t\tSSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);\n\t\treturn(NULL);\n\t\t}\n\tssl_cipher_collect_ciphers(ssl_method, num_of_ciphers,\n\t                           disabled_mkey, disabled_auth, disabled_enc, disabled_mac, disabled_ssl,\n\t                           co_list, &head, &tail);\n\tssl_cipher_apply_rule(0, SSL_kEECDH, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, SSL_kEECDH, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, 0, 0, SSL_AES, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, 0, 0, 0, SSL_MD5, 0, 0, CIPHER_ORD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, 0, SSL_aNULL, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, 0, SSL_aECDH, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, SSL_kRSA, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, SSL_kPSK, 0,0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, SSL_kKRB5, 0,0, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);\n\tssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head, &tail);\n\tif (!ssl_cipher_strength_sort(&head, &tail))\n\t\t{\n\t\tOPENSSL_free(co_list);\n\t\treturn NULL;\n\t\t}\n\tssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);\n\tnum_of_group_aliases = sizeof(cipher_aliases) / sizeof(SSL_CIPHER);\n\tnum_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;\n\tca_list = OPENSSL_malloc(sizeof(SSL_CIPHER *) * num_of_alias_max);\n\tif (ca_list == NULL)\n\t\t{\n\t\tOPENSSL_free(co_list);\n\t\tSSLerr(SSL_F_SSL_CREATE_CIPHER_LIST,ERR_R_MALLOC_FAILURE);\n\t\treturn(NULL);\n\t\t}\n\tssl_cipher_collect_aliases(ca_list, num_of_group_aliases,\n\t                           disabled_mkey, disabled_auth, disabled_enc,\n\t\t\t\t   disabled_mac, disabled_ssl, head);\n\tok = 1;\n\trule_p = rule_str;\n\tif (strncmp(rule_str,"DEFAULT",7) == 0)\n\t\t{\n\t\tok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,\n\t\t\t&head, &tail, ca_list);\n\t\trule_p += 7;\n\t\tif (*rule_p == \':\')\n\t\t\trule_p++;\n\t\t}\n\tif (ok && (strlen(rule_p) > 0))\n\t\tok = ssl_cipher_process_rulestr(rule_p, &head, &tail, ca_list);\n\tOPENSSL_free((void *)ca_list);\n\tif (!ok)\n\t\t{\n\t\tOPENSSL_free(co_list);\n\t\treturn(NULL);\n\t\t}\n\tif ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL)\n\t\t{\n\t\tOPENSSL_free(co_list);\n\t\treturn(NULL);\n\t\t}\n\tfor (curr = head; curr != NULL; curr = curr->next)\n\t\t{\n\t\tif (curr->active)\n\t\t\t{\n\t\t\tsk_SSL_CIPHER_push(cipherstack, curr->cipher);\n#ifdef CIPHER_DEBUG\n\t\t\tprintf("<%s>\\n",curr->cipher->name);\n#endif\n\t\t\t}\n\t\t}\n\tOPENSSL_free(co_list);\n\ttmp_cipher_list = sk_SSL_CIPHER_dup(cipherstack);\n\tif (tmp_cipher_list == NULL)\n\t\t{\n\t\tsk_SSL_CIPHER_free(cipherstack);\n\t\treturn NULL;\n\t\t}\n\tif (*cipher_list != NULL)\n\t\tsk_SSL_CIPHER_free(*cipher_list);\n\t*cipher_list = cipherstack;\n\tif (*cipher_list_by_id != NULL)\n\t\tsk_SSL_CIPHER_free(*cipher_list_by_id);\n\t*cipher_list_by_id = tmp_cipher_list;\n\t(void)sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id,ssl_cipher_ptr_id_cmp);\n\tsk_SSL_CIPHER_sort(*cipher_list_by_id);\n\treturn(cipherstack);\n\t}']