apps/s_cb.c:789: error: BUFFER_OVERRUN_L3
  Offset added: 18 (⇐ 2 + 16) Size: [1, 18].
Showing all 10 steps of the trace


apps/s_cb.c:762:5: <Length trace>
760.   
761.       /* Create buffer with peer's address and port */
762.       length = 0;
           ^
763.       switch (peer.sa.sa_family) {
764.       case AF_INET:

apps/s_cb.c:762:5: Assignment
760.   
761.       /* Create buffer with peer's address and port */
762.       length = 0;
           ^
763.       switch (peer.sa.sa_family) {
764.       case AF_INET:

apps/s_cb.c:778:14: Call
776.           break;
777.       }
778.       buffer = app_malloc(length, "cookie generate buffer");
                    ^
779.   
780.       switch (peer.sa.sa_family) {

apps/apps.c:976:1: Parameter `sz`
  974.   }
  975.   
  976. > void* app_malloc(int sz, const char *what)
  977.   {
  978.       void *vp = OPENSSL_malloc(sz);

apps/apps.c:978:16: Call
  976.   void* app_malloc(int sz, const char *what)
  977.   {
  978.       void *vp = OPENSSL_malloc(sz);
                        ^
  979.   
  980.       if (vp == NULL) {

crypto/mem.c:125:9: Assignment
    123.   
    124.       if (num <= 0)
    125.           return NULL;
                   ^
    126.   
    127.       allow_customize = 0;

apps/apps.c:978:5: Assignment
  976.   void* app_malloc(int sz, const char *what)
  977.   {
  978.       void *vp = OPENSSL_malloc(sz);
             ^
  979.   
  980.       if (vp == NULL) {

apps/apps.c:986:5: Assignment
  984.           exit(1);
  985.       }
  986.       return vp;
             ^
  987.   }
  988.   

apps/s_cb.c:778:5: Assignment
776.           break;
777.       }
778.       buffer = app_malloc(length, "cookie generate buffer");
           ^
779.   
780.       switch (peer.sa.sa_family) {

apps/s_cb.c:789:9: Array access: Offset added: 18 (⇐ 2 + 16) Size: [1, 18]
787.       case AF_INET6:
788.           memcpy(buffer, &peer.s6.sin6_port, sizeof(peer.s6.sin6_port));
789.           memcpy(buffer + sizeof(peer.s6.sin6_port),
               ^
790.                  &peer.s6.sin6_addr, sizeof(struct in6_addr));
791.           break;

int generate_cookie_callback(SSL *ssl, unsigned char *cookie,
                             unsigned int *cookie_len)
{
    unsigned char *buffer;
    unsigned int length;
    union {
        struct sockaddr sa;
        struct sockaddr_in s4;
#if OPENSSL_USE_IPV6
        struct sockaddr_in6 s6;
#endif
    } peer;
    if (!cookie_initialized) {
        if (RAND_bytes(cookie_secret, COOKIE_SECRET_LENGTH) <= 0) {
            BIO_printf(bio_err, "error setting random cookie secret\n");
            return 0;
        }
        cookie_initialized = 1;
    }
    (void)BIO_dgram_get_peer(SSL_get_rbio(ssl), &peer);
    length = 0;
    switch (peer.sa.sa_family) {
    case AF_INET:
        length += sizeof(struct in_addr);
        length += sizeof(peer.s4.sin_port);
        break;
#if OPENSSL_USE_IPV6
    case AF_INET6:
        length += sizeof(struct in6_addr);
        length += sizeof(peer.s6.sin6_port);
        break;
#endif
    default:
        OPENSSL_assert(0);
        break;
    }
    buffer = app_malloc(length, "cookie generate buffer");
    switch (peer.sa.sa_family) {
    case AF_INET:
        memcpy(buffer, &peer.s4.sin_port, sizeof(peer.s4.sin_port));
        memcpy(buffer + sizeof(peer.s4.sin_port),
               &peer.s4.sin_addr, sizeof(struct in_addr));
        break;
#if OPENSSL_USE_IPV6
    case AF_INET6:
        memcpy(buffer, &peer.s6.sin6_port, sizeof(peer.s6.sin6_port));
        memcpy(buffer + sizeof(peer.s6.sin6_port),
               &peer.s6.sin6_addr, sizeof(struct in6_addr));
        break;
#endif
    default:
        OPENSSL_assert(0);
        break;
    }
    HMAC(EVP_sha1(), cookie_secret, COOKIE_SECRET_LENGTH,
         buffer, length, cookie, cookie_len);
    OPENSSL_free(buffer);
    return 1;
}
['int generate_cookie_callback(SSL *ssl, unsigned char *cookie,\n                             unsigned int *cookie_len)\n{\n    unsigned char *buffer;\n    unsigned int length;\n    union {\n        struct sockaddr sa;\n        struct sockaddr_in s4;\n#if OPENSSL_USE_IPV6\n        struct sockaddr_in6 s6;\n#endif\n    } peer;\n    if (!cookie_initialized) {\n        if (RAND_bytes(cookie_secret, COOKIE_SECRET_LENGTH) <= 0) {\n            BIO_printf(bio_err, "error setting random cookie secret\\n");\n            return 0;\n        }\n        cookie_initialized = 1;\n    }\n    (void)BIO_dgram_get_peer(SSL_get_rbio(ssl), &peer);\n    length = 0;\n    switch (peer.sa.sa_family) {\n    case AF_INET:\n        length += sizeof(struct in_addr);\n        length += sizeof(peer.s4.sin_port);\n        break;\n#if OPENSSL_USE_IPV6\n    case AF_INET6:\n        length += sizeof(struct in6_addr);\n        length += sizeof(peer.s6.sin6_port);\n        break;\n#endif\n    default:\n        OPENSSL_assert(0);\n        break;\n    }\n    buffer = app_malloc(length, "cookie generate buffer");\n    switch (peer.sa.sa_family) {\n    case AF_INET:\n        memcpy(buffer, &peer.s4.sin_port, sizeof(peer.s4.sin_port));\n        memcpy(buffer + sizeof(peer.s4.sin_port),\n               &peer.s4.sin_addr, sizeof(struct in_addr));\n        break;\n#if OPENSSL_USE_IPV6\n    case AF_INET6:\n        memcpy(buffer, &peer.s6.sin6_port, sizeof(peer.s6.sin6_port));\n        memcpy(buffer + sizeof(peer.s6.sin6_port),\n               &peer.s6.sin6_addr, sizeof(struct in6_addr));\n        break;\n#endif\n    default:\n        OPENSSL_assert(0);\n        break;\n    }\n    HMAC(EVP_sha1(), cookie_secret, COOKIE_SECRET_LENGTH,\n         buffer, length, cookie, cookie_len);\n    OPENSSL_free(buffer);\n    return 1;\n}', 'void* app_malloc(int sz, const char *what)\n{\n    void *vp = OPENSSL_malloc(sz);\n    if (vp == NULL) {\n        BIO_printf(bio_err, "%s: Could not allocate %d bytes for %s\\n",\n                opt_getprog(), sz, what);\n        ERR_print_errors(bio_err);\n        exit(1);\n    }\n    return vp;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifdef CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}']