ssl/statem/statem_srvr.c:3381: error: BUFFER_OVERRUN_L3
  Offset added: [1, 4] Size: [0, +oo] by call to `ssl_randbytes`.
Showing all 10 steps of the trace


ssl/statem/statem_srvr.c:3381:13: Call
3379.   
3380.       if (SSL_IS_TLS13(s)) {
3381.           if (ssl_randbytes(s, age_add_u.age_add_c, sizeof(age_add_u)) <= 0)
                    ^
3382.               goto err;
3383.           s->session->ext.tick_age_add = age_add_u.age_add;

ssl/ssl_lib.c:5097:1: Parameter `size`
  5095.   }
  5096.   
  5097. > int ssl_randbytes(SSL *s, unsigned char *rnd, size_t size)
  5098.   {
  5099.       if (s->drbg != NULL)

ssl/ssl_lib.c:5100:16: Call
  5098.   {
  5099.       if (s->drbg != NULL)
  5100.           return RAND_DRBG_generate(s->drbg, rnd, size, 0, NULL, 0);
                         ^
  5101.       return RAND_bytes(rnd, (int)size);
  5102.   }

crypto/rand/drbg_lib.c:248:1: Parameter `outlen`
    246.    * sent in |adin| and |adinlen|.
    247.    */
    248. > int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,
    249.                          int prediction_resistance,
    250.                          const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_lib.c:281:10: Call
    279.       }
    280.   
    281.       if (!ctr_generate(drbg, out, outlen, adin, adinlen)) {
                    ^
    282.           drbg->state = DRBG_ERROR;
    283.           RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);

crypto/rand/drbg_rand.c:261:1: <Offset trace>
259.   }
260.   
261. > int ctr_generate(RAND_DRBG *drbg,
262.                    unsigned char *out, size_t outlen,
263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:261:1: Parameter `outlen`
      259.   }
      260.   
      261. > int ctr_generate(RAND_DRBG *drbg,
      262.                    unsigned char *out, size_t outlen,
      263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:261:1: <Length trace>
259.   }
260.   
261. > int ctr_generate(RAND_DRBG *drbg,
262.                    unsigned char *out, size_t outlen,
263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:261:1: Parameter `drbg->ctr.K[*]`
      259.   }
      260.   
      261. > int ctr_generate(RAND_DRBG *drbg,
      262.                    unsigned char *out, size_t outlen,
      263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:283:13: Array access: Offset added: [1, 4] Size: [0, +oo] by call to `ssl_randbytes` 
      281.               /* Use K as temp space as it will be updated */
      282.               AES_encrypt(ctr->V, ctr->K, &ctr->ks);
      283.               memcpy(out, ctr->K, outlen);
                         ^
      284.               break;
      285.           }

int ctr_generate(RAND_DRBG *drbg,
                 unsigned char *out, size_t outlen,
                 const unsigned char *adin, size_t adinlen)
{
    RAND_DRBG_CTR *ctr = &drbg->ctr;
    if (adin != NULL && adinlen != 0) {
        ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);
        if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) {
            adin = NULL;
            adinlen = 1;
        }
    } else {
        adinlen = 0;
    }
    for ( ; ; ) {
        inc_128(ctr);
        if (outlen < 16) {
            AES_encrypt(ctr->V, ctr->K, &ctr->ks);
            memcpy(out, ctr->K, outlen);
            break;
        }
        AES_encrypt(ctr->V, out, &ctr->ks);
        out += 16;
        outlen -= 16;
        if (outlen == 0)
            break;
    }
    ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);
    return 1;
}
['int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt)\n{\n    unsigned char *senc = NULL;\n    EVP_CIPHER_CTX *ctx = NULL;\n    HMAC_CTX *hctx = NULL;\n    unsigned char *p, *encdata1, *encdata2, *macdata1, *macdata2;\n    const unsigned char *const_p;\n    int len, slen_full, slen, lenfinal;\n    SSL_SESSION *sess;\n    unsigned int hlen;\n    SSL_CTX *tctx = s->session_ctx;\n    unsigned char iv[EVP_MAX_IV_LENGTH];\n    unsigned char key_name[TLSEXT_KEYNAME_LENGTH];\n    int iv_len, al = SSL_AD_INTERNAL_ERROR;\n    size_t macoffset, macendoffset;\n    union {\n        unsigned char age_add_c[sizeof(uint32_t)];\n        uint32_t age_add;\n    } age_add_u;\n    if (SSL_IS_TLS13(s)) {\n        if (ssl_randbytes(s, age_add_u.age_add_c, sizeof(age_add_u)) <= 0)\n            goto err;\n        s->session->ext.tick_age_add = age_add_u.age_add;\n        OPENSSL_free(s->session->ext.tick_nonce);\n        s->session->ext.tick_nonce = OPENSSL_zalloc(sizeof(char));\n        if (s->session->ext.tick_nonce == NULL) {\n            SSLerr(SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,\n                   ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        s->session->ext.tick_nonce_len = 1;\n        s->session->time = (long)time(NULL);\n        if (s->s3->alpn_selected != NULL) {\n            OPENSSL_free(s->session->ext.alpn_selected);\n            s->session->ext.alpn_selected =\n                OPENSSL_memdup(s->s3->alpn_selected, s->s3->alpn_selected_len);\n            if (s->session->ext.alpn_selected == NULL) {\n                SSLerr(SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,\n                       ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            s->session->ext.alpn_selected_len = s->s3->alpn_selected_len;\n        }\n        s->session->ext.max_early_data = s->max_early_data;\n    }\n    slen_full = i2d_SSL_SESSION(s->session, NULL);\n    if (slen_full == 0 || slen_full > 0xFF00) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    senc = OPENSSL_malloc(slen_full);\n    if (senc == NULL) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    ctx = EVP_CIPHER_CTX_new();\n    hctx = HMAC_CTX_new();\n    if (ctx == NULL || hctx == NULL) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    p = senc;\n    if (!i2d_SSL_SESSION(s->session, &p))\n        goto err;\n    const_p = senc;\n    sess = d2i_SSL_SESSION(NULL, &const_p, slen_full);\n    if (sess == NULL)\n        goto err;\n    sess->session_id_length = 0;\n    slen = i2d_SSL_SESSION(sess, NULL);\n    if (slen == 0 || slen > slen_full) {\n        SSL_SESSION_free(sess);\n        goto err;\n    }\n    p = senc;\n    if (!i2d_SSL_SESSION(sess, &p)) {\n        SSL_SESSION_free(sess);\n        goto err;\n    }\n    SSL_SESSION_free(sess);\n    if (tctx->ext.ticket_key_cb) {\n        int ret = tctx->ext.ticket_key_cb(s, key_name, iv, ctx,\n                                             hctx, 1);\n        if (ret == 0) {\n            if (!WPACKET_put_bytes_u32(pkt, 0)\n                    || !WPACKET_put_bytes_u16(pkt, 0)) {\n                SSLerr(SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,\n                       ERR_R_INTERNAL_ERROR);\n                goto err;\n            }\n            OPENSSL_free(senc);\n            EVP_CIPHER_CTX_free(ctx);\n            HMAC_CTX_free(hctx);\n            return 1;\n        }\n        if (ret < 0)\n            goto err;\n        iv_len = EVP_CIPHER_CTX_iv_length(ctx);\n    } else {\n        const EVP_CIPHER *cipher = EVP_aes_256_cbc();\n        iv_len = EVP_CIPHER_iv_length(cipher);\n        if (ssl_randbytes(s, iv, iv_len) <= 0)\n            goto err;\n        if (!EVP_EncryptInit_ex(ctx, cipher, NULL,\n                                tctx->ext.tick_aes_key, iv))\n            goto err;\n        if (!HMAC_Init_ex(hctx, tctx->ext.tick_hmac_key,\n                          sizeof(tctx->ext.tick_hmac_key),\n                          EVP_sha256(), NULL))\n            goto err;\n        memcpy(key_name, tctx->ext.tick_key_name,\n               sizeof(tctx->ext.tick_key_name));\n    }\n    if (!WPACKET_put_bytes_u32(pkt,\n                               (s->hit && !SSL_IS_TLS13(s))\n                               ? 0 : s->session->timeout)\n            || (SSL_IS_TLS13(s)\n                && (!WPACKET_put_bytes_u32(pkt, age_add_u.age_add)\n                    || !WPACKET_sub_memcpy_u8(pkt, s->session->ext.tick_nonce,\n                                              s->session->ext.tick_nonce_len)))\n            || !WPACKET_start_sub_packet_u16(pkt)\n            || !WPACKET_get_total_written(pkt, &macoffset)\n            || !WPACKET_memcpy(pkt, key_name, sizeof(key_name))\n            || !WPACKET_memcpy(pkt, iv, iv_len)\n            || !WPACKET_reserve_bytes(pkt, slen + EVP_MAX_BLOCK_LENGTH,\n                                      &encdata1)\n            || !EVP_EncryptUpdate(ctx, encdata1, &len, senc, slen)\n            || !WPACKET_allocate_bytes(pkt, len, &encdata2)\n            || encdata1 != encdata2\n            || !EVP_EncryptFinal(ctx, encdata1 + len, &lenfinal)\n            || !WPACKET_allocate_bytes(pkt, lenfinal, &encdata2)\n            || encdata1 + len != encdata2\n            || len + lenfinal > slen + EVP_MAX_BLOCK_LENGTH\n            || !WPACKET_get_total_written(pkt, &macendoffset)\n            || !HMAC_Update(hctx,\n                            (unsigned char *)s->init_buf->data + macoffset,\n                            macendoffset - macoffset)\n            || !WPACKET_reserve_bytes(pkt, EVP_MAX_MD_SIZE, &macdata1)\n            || !HMAC_Final(hctx, macdata1, &hlen)\n            || hlen > EVP_MAX_MD_SIZE\n            || !WPACKET_allocate_bytes(pkt, hlen, &macdata2)\n            || macdata1 != macdata2\n            || !WPACKET_close(pkt)\n            || (SSL_IS_TLS13(s)\n                && !tls_construct_extensions(s, pkt,\n                                             SSL_EXT_TLS1_3_NEW_SESSION_TICKET,\n                                             NULL, 0, &al))) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    EVP_CIPHER_CTX_free(ctx);\n    HMAC_CTX_free(hctx);\n    OPENSSL_free(senc);\n    return 1;\n err:\n    ossl_statem_set_error(s);\n    OPENSSL_free(senc);\n    EVP_CIPHER_CTX_free(ctx);\n    HMAC_CTX_free(hctx);\n    ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);\n    return 0;\n}', 'int ssl_randbytes(SSL *s, unsigned char *rnd, size_t size)\n{\n    if (s->drbg != NULL)\n        return RAND_DRBG_generate(s->drbg, rnd, size, 0, NULL, 0);\n    return RAND_bytes(rnd, (int)size);\n}', 'int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,\n                       int prediction_resistance,\n                       const unsigned char *adin, size_t adinlen)\n{\n    if (drbg->state == DRBG_ERROR) {\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_IN_ERROR_STATE);\n        return 0;\n    }\n    if (drbg->state == DRBG_UNINITIALISED) {\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_NOT_INSTANTIATED);\n        return 0;\n    }\n    if (outlen > drbg->max_request) {\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_REQUEST_TOO_LARGE_FOR_DRBG);\n        return 0;\n    }\n    if (adinlen > drbg->max_adin) {\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_ADDITIONAL_INPUT_TOO_LONG);\n        return 0;\n    }\n    if (drbg->reseed_counter >= drbg->reseed_interval)\n        drbg->state = DRBG_RESEED;\n    if (drbg->state == DRBG_RESEED || prediction_resistance) {\n        if (!RAND_DRBG_reseed(drbg, adin, adinlen)) {\n            RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_RESEED_ERROR);\n            return 0;\n        }\n        adin = NULL;\n        adinlen = 0;\n    }\n    if (!ctr_generate(drbg, out, outlen, adin, adinlen)) {\n        drbg->state = DRBG_ERROR;\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);\n        return 0;\n    }\n    if (drbg->reseed_counter >= drbg->reseed_interval)\n        drbg->state = DRBG_RESEED;\n    else\n        drbg->reseed_counter++;\n    return 1;\n}', 'int ctr_generate(RAND_DRBG *drbg,\n                 unsigned char *out, size_t outlen,\n                 const unsigned char *adin, size_t adinlen)\n{\n    RAND_DRBG_CTR *ctr = &drbg->ctr;\n    if (adin != NULL && adinlen != 0) {\n        ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);\n        if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) {\n            adin = NULL;\n            adinlen = 1;\n        }\n    } else {\n        adinlen = 0;\n    }\n    for ( ; ; ) {\n        inc_128(ctr);\n        if (outlen < 16) {\n            AES_encrypt(ctr->V, ctr->K, &ctr->ks);\n            memcpy(out, ctr->K, outlen);\n            break;\n        }\n        AES_encrypt(ctr->V, out, &ctr->ks);\n        out += 16;\n        outlen -= 16;\n        if (outlen == 0)\n            break;\n    }\n    ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);\n    return 1;\n}']