ssl/statem/statem_clnt.c:1042: error: BUFFER_OVERRUN_L3
  Offset added: [1, 15] Size: [0, +oo] by call to `ssl_fill_hello_random`.
Showing all 12 steps of the trace


ssl/statem/statem_clnt.c:1042:14: Call
1040.       }
1041.   
1042.       if (i && ssl_fill_hello_random(s, 0, p, sizeof(s->s3->client_random),
                     ^
1043.                                      DOWNGRADE_NONE) <= 0)
1044.           return 0;

ssl/s3_lib.c:4471:1: Parameter `len`
  4469.    * failure, 1 on success.
  4470.    */
  4471. > int ssl_fill_hello_random(SSL *s, int server, unsigned char *result, size_t len,
  4472.                             DOWNGRADE dgrd)
  4473.   {

ssl/s3_lib.c:4489:15: Call
  4487.           ret = ssl_randbytes(s, p, len - 4);
  4488.       } else {
  4489.           ret = ssl_randbytes(s, result, len);
                        ^
  4490.       }
  4491.   #ifndef OPENSSL_NO_TLS13DOWNGRADE

ssl/ssl_lib.c:5128:1: Parameter `size`
    5126.   }
    5127.   
    5128. > int ssl_randbytes(SSL *s, unsigned char *rnd, size_t size)
    5129.   {
    5130.       if (s->drbg != NULL) {

ssl/ssl_lib.c:5143:17: Call
    5141.            * here.
    5142.            */
    5143.            return RAND_DRBG_generate(s->drbg, rnd, size, 0, NULL, 0);
                            ^
    5144.       }
    5145.       return RAND_bytes(rnd, (int)size);

crypto/rand/drbg_lib.c:363:1: Parameter `outlen`
      361.    *
      362.    */
      363. > int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,
      364.                          int prediction_resistance,
      365.                          const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_lib.c:409:10: Call
      407.       }
      408.   
      409.       if (!ctr_generate(drbg, out, outlen, adin, adinlen)) {
                      ^
      410.           drbg->state = DRBG_ERROR;
      411.           RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);

crypto/rand/drbg_rand.c:266:1: <Offset trace>
264.   }
265.   
266. > int ctr_generate(RAND_DRBG *drbg,
267.                    unsigned char *out, size_t outlen,
268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: Parameter `outlen`
        264.   }
        265.   
        266. > int ctr_generate(RAND_DRBG *drbg,
        267.                    unsigned char *out, size_t outlen,
        268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: <Length trace>
264.   }
265.   
266. > int ctr_generate(RAND_DRBG *drbg,
267.                    unsigned char *out, size_t outlen,
268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: Parameter `drbg->ctr.K[*]`
        264.   }
        265.   
        266. > int ctr_generate(RAND_DRBG *drbg,
        267.                    unsigned char *out, size_t outlen,
        268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:288:13: Array access: Offset added: [1, 15] Size: [0, +oo] by call to `ssl_fill_hello_random` 
        286.               /* Use K as temp space as it will be updated */
        287.               AES_encrypt(ctr->V, ctr->K, &ctr->ks);
        288.               memcpy(out, ctr->K, outlen);
                           ^
        289.               break;
        290.           }

int ctr_generate(RAND_DRBG *drbg,
                 unsigned char *out, size_t outlen,
                 const unsigned char *adin, size_t adinlen)
{
    RAND_DRBG_CTR *ctr = &drbg->ctr;
    if (adin != NULL && adinlen != 0) {
        ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);
        if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) {
            adin = NULL;
            adinlen = 1;
        }
    } else {
        adinlen = 0;
    }
    for ( ; ; ) {
        inc_128(ctr);
        if (outlen < 16) {
            AES_encrypt(ctr->V, ctr->K, &ctr->ks);
            memcpy(out, ctr->K, outlen);
            break;
        }
        AES_encrypt(ctr->V, out, &ctr->ks);
        out += 16;
        outlen -= 16;
        if (outlen == 0)
            break;
    }
    ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);
    return 1;
}
['int tls_construct_client_hello(SSL *s, WPACKET *pkt)\n{\n    unsigned char *p;\n    size_t sess_id_len;\n    int i, protverr;\n    int al = SSL_AD_HANDSHAKE_FAILURE;\n#ifndef OPENSSL_NO_COMP\n    SSL_COMP *comp;\n#endif\n    SSL_SESSION *sess = s->session;\n    if (!WPACKET_set_max_size(pkt, SSL3_RT_MAX_PLAIN_LENGTH)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    protverr = ssl_set_client_hello_version(s);\n    if (protverr != 0) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, protverr);\n        return 0;\n    }\n    if (sess == NULL\n            || !ssl_version_supported(s, sess->ssl_version)\n            || !SSL_SESSION_is_resumable(sess)) {\n        if (!ssl_get_new_session(s, 0))\n            return 0;\n    }\n    p = s->s3->client_random;\n    if (SSL_IS_DTLS(s)) {\n        size_t idx;\n        i = 1;\n        for (idx = 0; idx < sizeof(s->s3->client_random); idx++) {\n            if (p[idx]) {\n                i = 0;\n                break;\n            }\n        }\n    } else {\n        i = s->hello_retry_request == 0;\n    }\n    if (i && ssl_fill_hello_random(s, 0, p, sizeof(s->s3->client_random),\n                                   DOWNGRADE_NONE) <= 0)\n        return 0;\n    if (!WPACKET_put_bytes_u16(pkt, s->client_version)\n            || !WPACKET_memcpy(pkt, s->s3->client_random, SSL3_RANDOM_SIZE)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    if (s->new_session || s->session->ssl_version == TLS1_3_VERSION)\n        sess_id_len = 0;\n    else\n        sess_id_len = s->session->session_id_length;\n    if (sess_id_len > sizeof(s->session->session_id)\n            || !WPACKET_start_sub_packet_u8(pkt)\n            || (sess_id_len != 0 && !WPACKET_memcpy(pkt, s->session->session_id,\n                                                    sess_id_len))\n            || !WPACKET_close(pkt)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    if (SSL_IS_DTLS(s)) {\n        if (s->d1->cookie_len > sizeof(s->d1->cookie)\n                || !WPACKET_sub_memcpy_u8(pkt, s->d1->cookie,\n                                          s->d1->cookie_len)) {\n            SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);\n            return 0;\n        }\n    }\n    if (!WPACKET_start_sub_packet_u16(pkt)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    if (!ssl_cipher_list_to_bytes(s, SSL_get_ciphers(s), pkt))\n        return 0;\n    if (!WPACKET_close(pkt)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    if (!WPACKET_start_sub_packet_u8(pkt)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n#ifndef OPENSSL_NO_COMP\n    if (ssl_allow_compression(s)\n            && s->ctx->comp_methods\n            && (SSL_IS_DTLS(s) || s->s3->tmp.max_ver < TLS1_3_VERSION)) {\n        int compnum = sk_SSL_COMP_num(s->ctx->comp_methods);\n        for (i = 0; i < compnum; i++) {\n            comp = sk_SSL_COMP_value(s->ctx->comp_methods, i);\n            if (!WPACKET_put_bytes_u8(pkt, comp->id)) {\n                SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);\n                return 0;\n            }\n        }\n    }\n#endif\n    if (!WPACKET_put_bytes_u8(pkt, 0) || !WPACKET_close(pkt)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    if (!tls_construct_extensions(s, pkt, SSL_EXT_CLIENT_HELLO, NULL, 0, &al)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    return 1;\n}', 'int ssl_fill_hello_random(SSL *s, int server, unsigned char *result, size_t len,\n                          DOWNGRADE dgrd)\n{\n    int send_time = 0, ret;\n    if (len < 4)\n        return 0;\n    if (server)\n        send_time = (s->mode & SSL_MODE_SEND_SERVERHELLO_TIME) != 0;\n    else\n        send_time = (s->mode & SSL_MODE_SEND_CLIENTHELLO_TIME) != 0;\n    if (send_time) {\n        unsigned long Time = (unsigned long)time(NULL);\n        unsigned char *p = result;\n        l2n(Time, p);\n        ret = ssl_randbytes(s, p, len - 4);\n    } else {\n        ret = ssl_randbytes(s, result, len);\n    }\n#ifndef OPENSSL_NO_TLS13DOWNGRADE\n    if (ret) {\n        if (!ossl_assert(sizeof(tls11downgrade) < len)\n                || !ossl_assert(sizeof(tls12downgrade) < len))\n             return 0;\n        if (dgrd == DOWNGRADE_TO_1_2)\n            memcpy(result + len - sizeof(tls12downgrade), tls12downgrade,\n                   sizeof(tls12downgrade));\n        else if (dgrd == DOWNGRADE_TO_1_1)\n            memcpy(result + len - sizeof(tls11downgrade), tls11downgrade,\n                   sizeof(tls11downgrade));\n    }\n#endif\n    return ret;\n}', 'int ssl_randbytes(SSL *s, unsigned char *rnd, size_t size)\n{\n    if (s->drbg != NULL) {\n         return RAND_DRBG_generate(s->drbg, rnd, size, 0, NULL, 0);\n    }\n    return RAND_bytes(rnd, (int)size);\n}', 'int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,\n                       int prediction_resistance,\n                       const unsigned char *adin, size_t adinlen)\n{\n    int reseed_required = 0;\n    if (drbg->state != DRBG_READY) {\n        rand_drbg_restart(drbg, NULL, 0, 0);\n        if (drbg->state == DRBG_ERROR) {\n            RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_IN_ERROR_STATE);\n            return 0;\n        }\n        if (drbg->state == DRBG_UNINITIALISED) {\n            RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_NOT_INSTANTIATED);\n            return 0;\n        }\n    }\n    if (outlen > drbg->max_request) {\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_REQUEST_TOO_LARGE_FOR_DRBG);\n        return 0;\n    }\n    if (adinlen > drbg->max_adinlen) {\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_ADDITIONAL_INPUT_TOO_LONG);\n        return 0;\n    }\n    if (drbg->fork_count != rand_fork_count) {\n        drbg->fork_count = rand_fork_count;\n        reseed_required = 1;\n    }\n    if (drbg->reseed_counter >= drbg->reseed_interval)\n        reseed_required = 1;\n    if (reseed_required || prediction_resistance) {\n        if (!RAND_DRBG_reseed(drbg, adin, adinlen)) {\n            RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_RESEED_ERROR);\n            return 0;\n        }\n        adin = NULL;\n        adinlen = 0;\n    }\n    if (!ctr_generate(drbg, out, outlen, adin, adinlen)) {\n        drbg->state = DRBG_ERROR;\n        RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);\n        return 0;\n    }\n    drbg->reseed_counter++;\n    return 1;\n}', 'int ctr_generate(RAND_DRBG *drbg,\n                 unsigned char *out, size_t outlen,\n                 const unsigned char *adin, size_t adinlen)\n{\n    RAND_DRBG_CTR *ctr = &drbg->ctr;\n    if (adin != NULL && adinlen != 0) {\n        ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);\n        if (drbg->flags & RAND_DRBG_FLAG_CTR_USE_DF) {\n            adin = NULL;\n            adinlen = 1;\n        }\n    } else {\n        adinlen = 0;\n    }\n    for ( ; ; ) {\n        inc_128(ctr);\n        if (outlen < 16) {\n            AES_encrypt(ctr->V, ctr->K, &ctr->ks);\n            memcpy(out, ctr->K, outlen);\n            break;\n        }\n        AES_encrypt(ctr->V, out, &ctr->ks);\n        out += 16;\n        outlen -= 16;\n        if (outlen == 0)\n            break;\n    }\n    ctr_update(drbg, adin, adinlen, NULL, 0, NULL, 0);\n    return 1;\n}']