ssl/statem/statem_srvr.c:3355: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [`pkt->written`, `pkt->written` + 26]):unsigned64 by call to `WPACKET_memcpy`.
Showing all 12 steps of the trace


ssl/statem/statem_srvr.c:3353:17: Call
3351.               || !WPACKET_get_total_written(pkt, &macoffset)
3352.                  /* Output key name */
3353.               || !WPACKET_memcpy(pkt, key_name, sizeof(key_name))
                        ^
3354.                  /* output IV */
3355.               || !WPACKET_memcpy(pkt, iv, iv_len)

ssl/packet.c:355:1: Parameter `pkt->buf->length`
  353.   }
  354.   
  355. > int WPACKET_memcpy(WPACKET *pkt, const void *src, size_t len)
  356.   {
  357.       unsigned char *dest;

ssl/statem/statem_srvr.c:3355:17: Call
3353.               || !WPACKET_memcpy(pkt, key_name, sizeof(key_name))
3354.                  /* output IV */
3355.               || !WPACKET_memcpy(pkt, iv, iv_len)
                        ^
3356.               || !WPACKET_reserve_bytes(pkt, slen + EVP_MAX_BLOCK_LENGTH,
3357.                                         &encdata1)

ssl/packet.c:355:1: Parameter `pkt->written`
  353.   }
  354.   
  355. > int WPACKET_memcpy(WPACKET *pkt, const void *src, size_t len)
  356.   {
  357.       unsigned char *dest;

ssl/packet.c:362:10: Call
  360.           return 1;
  361.   
  362.       if (!WPACKET_allocate_bytes(pkt, len, &dest))
                  ^
  363.           return 0;
  364.   

ssl/packet.c:15:1: Parameter `pkt->written`
    13.   #define DEFAULT_BUF_SIZE    256
    14.   
    15. > int WPACKET_allocate_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
    16.   {
    17.       if (!WPACKET_reserve_bytes(pkt, len, allocbytes))

ssl/packet.c:17:10: Call
    15.   int WPACKET_allocate_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
    16.   {
    17.       if (!WPACKET_reserve_bytes(pkt, len, allocbytes))
                   ^
    18.           return 0;
    19.   

ssl/packet.c:39:1: <LHS trace>
37.                        ? (p)->staticbuf : (unsigned char *)(p)->buf->data)
38.   
39. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
40.   {
41.       /* Internal API, so should not fail */

ssl/packet.c:39:1: Parameter `pkt->buf->length`
      37.                        ? (p)->staticbuf : (unsigned char *)(p)->buf->data)
      38.   
      39. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
      40.   {
      41.       /* Internal API, so should not fail */

ssl/packet.c:39:1: <RHS trace>
37.                        ? (p)->staticbuf : (unsigned char *)(p)->buf->data)
38.   
39. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
40.   {
41.       /* Internal API, so should not fail */

ssl/packet.c:39:1: Parameter `len`
      37.                        ? (p)->staticbuf : (unsigned char *)(p)->buf->data)
      38.   
      39. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
      40.   {
      41.       /* Internal API, so should not fail */

ssl/packet.c:49:36: Binary operation: ([0, +oo] - [pkt->written, pkt->written + 26]):unsigned64 by call to `WPACKET_memcpy` 
      47.           return 0;
      48.   
      49.       if (pkt->staticbuf == NULL && (pkt->buf->length - pkt->written < len)) {
                                               ^
      50.           size_t newlen;
      51.           size_t reflen;

int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
{
    assert(pkt->subs != NULL && len != 0);
    if (pkt->subs == NULL || len == 0)
        return 0;
    if (pkt->maxsize - pkt->written < len)
        return 0;
    if (pkt->staticbuf == NULL && (pkt->buf->length - pkt->written < len)) {
        size_t newlen;
        size_t reflen;
        reflen = (len > pkt->buf->length) ? len : pkt->buf->length;
        if (reflen > SIZE_MAX / 2) {
            newlen = SIZE_MAX;
        } else {
            newlen = reflen * 2;
            if (newlen < DEFAULT_BUF_SIZE)
                newlen = DEFAULT_BUF_SIZE;
        }
        if (BUF_MEM_grow(pkt->buf, newlen) == 0)
            return 0;
    }
    if (allocbytes != NULL)
        *allocbytes = WPACKET_get_curr(pkt);
    return 1;
}
['int tls_construct_new_session_ticket(SSL *s, WPACKET *pkt)\n{\n    unsigned char *senc = NULL;\n    EVP_CIPHER_CTX *ctx = NULL;\n    HMAC_CTX *hctx = NULL;\n    unsigned char *p, *encdata1, *encdata2, *macdata1, *macdata2;\n    const unsigned char *const_p;\n    int len, slen_full, slen, lenfinal;\n    SSL_SESSION *sess;\n    unsigned int hlen;\n    SSL_CTX *tctx = s->initial_ctx;\n    unsigned char iv[EVP_MAX_IV_LENGTH];\n    unsigned char key_name[TLSEXT_KEYNAME_LENGTH];\n    int iv_len, al = SSL_AD_INTERNAL_ERROR;\n    size_t macoffset, macendoffset;\n    union {\n        unsigned char age_add_c[sizeof(uint32_t)];\n        uint32_t age_add;\n    } age_add_u;\n    if (SSL_IS_TLS13(s)) {\n        if (RAND_bytes(age_add_u.age_add_c, sizeof(age_add_u)) <= 0)\n            goto err;\n        s->session->ext.tick_age_add = age_add_u.age_add;\n    }\n    slen_full = i2d_SSL_SESSION(s->session, NULL);\n    if (slen_full == 0 || slen_full > 0xFF00) {\n        ossl_statem_set_error(s);\n        return 0;\n    }\n    senc = OPENSSL_malloc(slen_full);\n    if (senc == NULL) {\n        ossl_statem_set_error(s);\n        return 0;\n    }\n    ctx = EVP_CIPHER_CTX_new();\n    hctx = HMAC_CTX_new();\n    if (ctx == NULL || hctx == NULL) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    p = senc;\n    if (!i2d_SSL_SESSION(s->session, &p))\n        goto err;\n    const_p = senc;\n    sess = d2i_SSL_SESSION(NULL, &const_p, slen_full);\n    if (sess == NULL)\n        goto err;\n    sess->session_id_length = 0;\n    slen = i2d_SSL_SESSION(sess, NULL);\n    if (slen == 0 || slen > slen_full) {\n        SSL_SESSION_free(sess);\n        goto err;\n    }\n    p = senc;\n    if (!i2d_SSL_SESSION(sess, &p)) {\n        SSL_SESSION_free(sess);\n        goto err;\n    }\n    SSL_SESSION_free(sess);\n    if (tctx->ext.ticket_key_cb) {\n        int ret = tctx->ext.ticket_key_cb(s, key_name, iv, ctx,\n                                             hctx, 1);\n        if (ret == 0) {\n            if (!WPACKET_put_bytes_u32(pkt, 0)\n                    || !WPACKET_put_bytes_u16(pkt, 0)) {\n                SSLerr(SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET,\n                       ERR_R_INTERNAL_ERROR);\n                goto err;\n            }\n            OPENSSL_free(senc);\n            EVP_CIPHER_CTX_free(ctx);\n            HMAC_CTX_free(hctx);\n            return 1;\n        }\n        if (ret < 0)\n            goto err;\n        iv_len = EVP_CIPHER_CTX_iv_length(ctx);\n    } else {\n        const EVP_CIPHER *cipher = EVP_aes_256_cbc();\n        iv_len = EVP_CIPHER_iv_length(cipher);\n        if (RAND_bytes(iv, iv_len) <= 0)\n            goto err;\n        if (!EVP_EncryptInit_ex(ctx, cipher, NULL,\n                                tctx->ext.tick_aes_key, iv))\n            goto err;\n        if (!HMAC_Init_ex(hctx, tctx->ext.tick_hmac_key,\n                          sizeof(tctx->ext.tick_hmac_key),\n                          EVP_sha256(), NULL))\n            goto err;\n        memcpy(key_name, tctx->ext.tick_key_name,\n               sizeof(tctx->ext.tick_key_name));\n    }\n    if (!WPACKET_put_bytes_u32(pkt, s->hit ? 0 : s->session->timeout)\n            || (SSL_IS_TLS13(s)\n                && !WPACKET_put_bytes_u32(pkt, age_add_u.age_add))\n            || !WPACKET_start_sub_packet_u16(pkt)\n            || !WPACKET_get_total_written(pkt, &macoffset)\n            || !WPACKET_memcpy(pkt, key_name, sizeof(key_name))\n            || !WPACKET_memcpy(pkt, iv, iv_len)\n            || !WPACKET_reserve_bytes(pkt, slen + EVP_MAX_BLOCK_LENGTH,\n                                      &encdata1)\n            || !EVP_EncryptUpdate(ctx, encdata1, &len, senc, slen)\n            || !WPACKET_allocate_bytes(pkt, len, &encdata2)\n            || encdata1 != encdata2\n            || !EVP_EncryptFinal(ctx, encdata1 + len, &lenfinal)\n            || !WPACKET_allocate_bytes(pkt, lenfinal, &encdata2)\n            || encdata1 + len != encdata2\n            || len + lenfinal > slen + EVP_MAX_BLOCK_LENGTH\n            || !WPACKET_get_total_written(pkt, &macendoffset)\n            || !HMAC_Update(hctx,\n                            (unsigned char *)s->init_buf->data + macoffset,\n                            macendoffset - macoffset)\n            || !WPACKET_reserve_bytes(pkt, EVP_MAX_MD_SIZE, &macdata1)\n            || !HMAC_Final(hctx, macdata1, &hlen)\n            || hlen > EVP_MAX_MD_SIZE\n            || !WPACKET_allocate_bytes(pkt, hlen, &macdata2)\n            || macdata1 != macdata2\n            || !WPACKET_close(pkt)\n            || (SSL_IS_TLS13(s)\n                && !tls_construct_extensions(s, pkt,\n                                             EXT_TLS1_3_NEW_SESSION_TICKET,\n                                             NULL, 0, &al))) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_NEW_SESSION_TICKET, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    EVP_CIPHER_CTX_free(ctx);\n    HMAC_CTX_free(hctx);\n    OPENSSL_free(senc);\n    return 1;\n err:\n    OPENSSL_free(senc);\n    EVP_CIPHER_CTX_free(ctx);\n    HMAC_CTX_free(hctx);\n    ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);\n    return 0;\n}', 'int WPACKET_memcpy(WPACKET *pkt, const void *src, size_t len)\n{\n    unsigned char *dest;\n    if (len == 0)\n        return 1;\n    if (!WPACKET_allocate_bytes(pkt, len, &dest))\n        return 0;\n    memcpy(dest, src, len);\n    return 1;\n}', 'int WPACKET_allocate_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)\n{\n    if (!WPACKET_reserve_bytes(pkt, len, allocbytes))\n        return 0;\n    pkt->written += len;\n    pkt->curr += len;\n    return 1;\n}', 'int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)\n{\n    assert(pkt->subs != NULL && len != 0);\n    if (pkt->subs == NULL || len == 0)\n        return 0;\n    if (pkt->maxsize - pkt->written < len)\n        return 0;\n    if (pkt->staticbuf == NULL && (pkt->buf->length - pkt->written < len)) {\n        size_t newlen;\n        size_t reflen;\n        reflen = (len > pkt->buf->length) ? len : pkt->buf->length;\n        if (reflen > SIZE_MAX / 2) {\n            newlen = SIZE_MAX;\n        } else {\n            newlen = reflen * 2;\n            if (newlen < DEFAULT_BUF_SIZE)\n                newlen = DEFAULT_BUF_SIZE;\n        }\n        if (BUF_MEM_grow(pkt->buf, newlen) == 0)\n            return 0;\n    }\n    if (allocbytes != NULL)\n        *allocbytes = WPACKET_get_curr(pkt);\n    return 1;\n}']