apps/s_server.c:2120: error: BUFFER_OVERRUN_L1
  Offset: -1 Size: 8192 by call to `SSL_get_shared_ciphers`.
Showing all 6 steps of the trace


apps/s_server.c:2078:1: Array declaration
2076.   	}
2077.   
2078. > static int init_ssl_connection(SSL *con)
2079.   	{
2080.   	int i;

apps/s_server.c:2120:6: Call
2118.   		}
2119.   
2120.   	if (SSL_get_shared_ciphers(con,buf,sizeof buf) != NULL)
             ^
2121.   		BIO_printf(bio_s_out,"Shared ciphers:%s\n",buf);
2122.   	str=SSL_CIPHER_get_name(SSL_get_current_cipher(con));

ssl/ssl_lib.c:1277:1: <Length trace>
1275.   
1276.   /* works well for SSLv2, not so good for SSLv3 */
1277. > char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
1278.   	{
1279.   	char *p;

ssl/ssl_lib.c:1277:1: Parameter `*buf`
  1275.   
  1276.   /* works well for SSLv2, not so good for SSLv3 */
  1277. > char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
  1278.   	{
  1279.   	char *p;

ssl/ssl_lib.c:1288:2: Assignment
  1286.   		return(NULL);
  1287.   
  1288.   	p=buf;
           ^
  1289.   	sk=s->session->ciphers;
  1290.   	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)

ssl/ssl_lib.c:1308:2: Array access: Offset: -1 Size: 8192 by call to `SSL_get_shared_ciphers` 
  1306.   		len-=n+1;
  1307.   		}
  1308.   	p[-1]='\0';
           ^
  1309.   	return(buf);
  1310.   	}

char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)
	{
	char *p;
	STACK_OF(SSL_CIPHER) *sk;
	SSL_CIPHER *c;
	int i;
	if ((s->session == NULL) || (s->session->ciphers == NULL) ||
		(len < 2))
		return(NULL);
	p=buf;
	sk=s->session->ciphers;
	for (i=0; i<sk_SSL_CIPHER_num(sk); i++)
		{
		int n;
		c=sk_SSL_CIPHER_value(sk,i);
		n=strlen(c->name);
		if (n+1 > len)
			{
			if (p != buf)
				--p;
			*p='\0';
			return buf;
			}
		strcpy(p,c->name);
		p+=n;
		*(p++)=':';
		len-=n+1;
		}
	p[-1]='\0';
	return(buf);
	}
['static int init_ssl_connection(SSL *con)\n\t{\n\tint i;\n\tconst char *str;\n\tX509 *peer;\n\tlong verify_error;\n\tMS_STATIC char buf[BUFSIZ];\n\tif ((i=SSL_accept(con)) <= 0)\n\t\t{\n\t\tif (BIO_sock_should_retry(i))\n\t\t\t{\n\t\t\tBIO_printf(bio_s_out,"DELAY\\n");\n\t\t\treturn(1);\n\t\t\t}\n\t\tBIO_printf(bio_err,"ERROR\\n");\n\t\tverify_error=SSL_get_verify_result(con);\n\t\tif (verify_error != X509_V_OK)\n\t\t\t{\n\t\t\tBIO_printf(bio_err,"verify error:%s\\n",\n\t\t\t\tX509_verify_cert_error_string(verify_error));\n\t\t\t}\n\t\telse\n\t\t\tERR_print_errors(bio_err);\n\t\treturn(0);\n\t\t}\n\tPEM_write_bio_SSL_SESSION(bio_s_out,SSL_get_session(con));\n\tpeer=SSL_get_peer_certificate(con);\n\tif (peer != NULL)\n\t\t{\n\t\tBIO_printf(bio_s_out,"Client certificate\\n");\n\t\tPEM_write_bio_X509(bio_s_out,peer);\n\t\tX509_NAME_oneline(X509_get_subject_name(peer),buf,sizeof buf);\n\t\tBIO_printf(bio_s_out,"subject=%s\\n",buf);\n\t\tX509_NAME_oneline(X509_get_issuer_name(peer),buf,sizeof buf);\n\t\tBIO_printf(bio_s_out,"issuer=%s\\n",buf);\n\t\tX509_free(peer);\n\t\t}\n\tif (SSL_get_shared_ciphers(con,buf,sizeof buf) != NULL)\n\t\tBIO_printf(bio_s_out,"Shared ciphers:%s\\n",buf);\n\tstr=SSL_CIPHER_get_name(SSL_get_current_cipher(con));\n\tBIO_printf(bio_s_out,"CIPHER is %s\\n",(str != NULL)?str:"(NONE)");\n\tif (con->hit) BIO_printf(bio_s_out,"Reused session-id\\n");\n\tif (SSL_ctrl(con,SSL_CTRL_GET_FLAGS,0,NULL) &\n\t\tTLS1_FLAGS_TLS_PADDING_BUG)\n\t\tBIO_printf(bio_s_out,"Peer has incorrect TLSv1 block padding\\n");\n#ifndef OPENSSL_NO_KRB5\n\tif (con->kssl_ctx->client_princ != NULL)\n\t\t{\n\t\tBIO_printf(bio_s_out,"Kerberos peer principal is %s\\n",\n\t\t\tcon->kssl_ctx->client_princ);\n\t\t}\n#endif\n\treturn(1);\n\t}', "char *SSL_get_shared_ciphers(const SSL *s,char *buf,int len)\n\t{\n\tchar *p;\n\tSTACK_OF(SSL_CIPHER) *sk;\n\tSSL_CIPHER *c;\n\tint i;\n\tif ((s->session == NULL) || (s->session->ciphers == NULL) ||\n\t\t(len < 2))\n\t\treturn(NULL);\n\tp=buf;\n\tsk=s->session->ciphers;\n\tfor (i=0; i<sk_SSL_CIPHER_num(sk); i++)\n\t\t{\n\t\tint n;\n\t\tc=sk_SSL_CIPHER_value(sk,i);\n\t\tn=strlen(c->name);\n\t\tif (n+1 > len)\n\t\t\t{\n\t\t\tif (p != buf)\n\t\t\t\t--p;\n\t\t\t*p='\\0';\n\t\t\treturn buf;\n\t\t\t}\n\t\tstrcpy(p,c->name);\n\t\tp+=n;\n\t\t*(p++)=':';\n\t\tlen-=n+1;\n\t\t}\n\tp[-1]='\\0';\n\treturn(buf);\n\t}"]