ssl/ssl_lib.c:5061: error: BUFFER_OVERRUN_S2
  Offset: `s->clienthello->pre_proc_exts->received_order` Size: [0, +oo].
Showing all 8 steps of the trace


ssl/ssl_lib.c:5038:1: <Offset trace>
5036.   }
5037.   
5038. > int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen)
5039.   {
5040.       RAW_EXTENSION *ext;

ssl/ssl_lib.c:5038:1: Parameter `s->clienthello->pre_proc_exts->received_order`
5036.   }
5037.   
5038. > int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen)
5039.   {
5040.       RAW_EXTENSION *ext;

ssl/ssl_lib.c:5042:5: <Length trace>
5040.       RAW_EXTENSION *ext;
5041.       int *present;
5042.       size_t num = 0, i;
            ^
5043.   
5044.       if (s->clienthello == NULL || out == NULL || outlen == NULL)

ssl/ssl_lib.c:5042:5: Assignment
5040.       RAW_EXTENSION *ext;
5041.       int *present;
5042.       size_t num = 0, i;
            ^
5043.   
5044.       if (s->clienthello == NULL || out == NULL || outlen == NULL)

ssl/ssl_lib.c:5051:20: Call
5049.               num++;
5050.       }
5051.       if ((present = OPENSSL_malloc(sizeof(*present) * num)) == NULL) {
                           ^
5052.           SSLerr(SSL_F_SSL_CLIENT_HELLO_GET1_EXTENSIONS_PRESENT,
5053.                  ERR_R_MALLOC_FAILURE);

crypto/mem.c:201:9: Assignment
  199.   
  200.       if (num == 0)
  201.           return NULL;
                 ^
  202.   
  203.       FAILTEST();

ssl/ssl_lib.c:5051:10: Assignment
5049.               num++;
5050.       }
5051.       if ((present = OPENSSL_malloc(sizeof(*present) * num)) == NULL) {
                 ^
5052.           SSLerr(SSL_F_SSL_CLIENT_HELLO_GET1_EXTENSIONS_PRESENT,
5053.                  ERR_R_MALLOC_FAILURE);

ssl/ssl_lib.c:5061:13: Array access: Offset: s->clienthello->pre_proc_exts->received_order Size: [0, +oo]
5059.               if (ext->received_order >= num)
5060.                   goto err;
5061.               present[ext->received_order] = ext->type;
                    ^
5062.           }
5063.       }

int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen)
{
    RAW_EXTENSION *ext;
    int *present;
    size_t num = 0, i;
    if (s->clienthello == NULL || out == NULL || outlen == NULL)
        return 0;
    for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) {
        ext = s->clienthello->pre_proc_exts + i;
        if (ext->present)
            num++;
    }
    if ((present = OPENSSL_malloc(sizeof(*present) * num)) == NULL) {
        SSLerr(SSL_F_SSL_CLIENT_HELLO_GET1_EXTENSIONS_PRESENT,
               ERR_R_MALLOC_FAILURE);
        return 0;
    }
    for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) {
        ext = s->clienthello->pre_proc_exts + i;
        if (ext->present) {
            if (ext->received_order >= num)
                goto err;
            present[ext->received_order] = ext->type;
        }
    }
    *out = present;
    *outlen = num;
    return 1;
 err:
    OPENSSL_free(present);
    return 0;
}
['int SSL_client_hello_get1_extensions_present(SSL *s, int **out, size_t *outlen)\n{\n    RAW_EXTENSION *ext;\n    int *present;\n    size_t num = 0, i;\n    if (s->clienthello == NULL || out == NULL || outlen == NULL)\n        return 0;\n    for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) {\n        ext = s->clienthello->pre_proc_exts + i;\n        if (ext->present)\n            num++;\n    }\n    if ((present = OPENSSL_malloc(sizeof(*present) * num)) == NULL) {\n        SSLerr(SSL_F_SSL_CLIENT_HELLO_GET1_EXTENSIONS_PRESENT,\n               ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    for (i = 0; i < s->clienthello->pre_proc_exts_len; i++) {\n        ext = s->clienthello->pre_proc_exts + i;\n        if (ext->present) {\n            if (ext->received_order >= num)\n                goto err;\n            present[ext->received_order] = ext->type;\n        }\n    }\n    *out = present;\n    *outlen = num;\n    return 1;\n err:\n    OPENSSL_free(present);\n    return 0;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    INCREMENT(malloc_count);\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    if (allow_customize) {\n        allow_customize = 0;\n    }\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)(file); (void)(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']