ssl/statem/statem_srvr.c:3092: error: BUFFER_OVERRUN_L3
  Offset: 7 (⇐ 5 + 2) Size: [1, 2147483644].
Showing all 9 steps of the trace


ssl/statem/statem_srvr.c:3069:1: <Length trace>
3067.   }
3068.   
3069. > int tls_construct_cert_status(SSL *s)
3070.   {
3071.       unsigned char *p;

ssl/statem/statem_srvr.c:3069:1: Parameter `*s->init_buf->data`
3067.   }
3068.   
3069. > int tls_construct_cert_status(SSL *s)
3070.   {
3071.       unsigned char *p;

ssl/statem/statem_srvr.c:3078:10: Call
3076.        * + (ocsp response)
3077.        */
3078.       if (!BUF_MEM_grow(s->init_buf, 8 + s->tlsext_ocsp_resplen)) {
                 ^
3079.           ossl_statem_set_error(s);
3080.           return 0;

crypto/buffer/buffer.c:122:1: Parameter `*str->data`
  120.   }
  121.   
  122. > size_t BUF_MEM_grow(BUF_MEM *str, size_t len)
  123.   {
  124.       char *ret;

ssl/statem/statem_srvr.c:3083:5: Assignment
3081.       }
3082.   
3083.       p = (unsigned char *)s->init_buf->data;
            ^
3084.   
3085.       /* do the header */

ssl/statem/statem_srvr.c:3086:7: Assignment
3084.   
3085.       /* do the header */
3086.       *(p++) = SSL3_MT_CERTIFICATE_STATUS;
              ^
3087.       /* message length */
3088.       l2n3(s->tlsext_ocsp_resplen + 4, p);

ssl/statem/statem_srvr.c:3088:5: Assignment
3086.       *(p++) = SSL3_MT_CERTIFICATE_STATUS;
3087.       /* message length */
3088.       l2n3(s->tlsext_ocsp_resplen + 4, p);
            ^
3089.       /* status type */
3090.       *(p++) = s->tlsext_status_type;

ssl/statem/statem_srvr.c:3090:7: Assignment
3088.       l2n3(s->tlsext_ocsp_resplen + 4, p);
3089.       /* status type */
3090.       *(p++) = s->tlsext_status_type;
              ^
3091.       /* length of OCSP response */
3092.       l2n3(s->tlsext_ocsp_resplen, p);

ssl/statem/statem_srvr.c:3092:5: Array access: Offset: 7 (⇐ 5 + 2) Size: [1, 2147483644]
3090.       *(p++) = s->tlsext_status_type;
3091.       /* length of OCSP response */
3092.       l2n3(s->tlsext_ocsp_resplen, p);
            ^
3093.       /* actual response */
3094.       memcpy(p, s->tlsext_ocsp_resp, s->tlsext_ocsp_resplen);

int tls_construct_cert_status(SSL *s)
{
    unsigned char *p;
    if (!BUF_MEM_grow(s->init_buf, 8 + s->tlsext_ocsp_resplen)) {
        ossl_statem_set_error(s);
        return 0;
    }
    p = (unsigned char *)s->init_buf->data;
    *(p++) = SSL3_MT_CERTIFICATE_STATUS;
    l2n3(s->tlsext_ocsp_resplen + 4, p);
    *(p++) = s->tlsext_status_type;
    l2n3(s->tlsext_ocsp_resplen, p);
    memcpy(p, s->tlsext_ocsp_resp, s->tlsext_ocsp_resplen);
    s->init_num = 8 + s->tlsext_ocsp_resplen;
    s->init_off = 0;
    return 1;
}
['int tls_construct_cert_status(SSL *s)\n{\n    unsigned char *p;\n    if (!BUF_MEM_grow(s->init_buf, 8 + s->tlsext_ocsp_resplen)) {\n        ossl_statem_set_error(s);\n        return 0;\n    }\n    p = (unsigned char *)s->init_buf->data;\n    *(p++) = SSL3_MT_CERTIFICATE_STATUS;\n    l2n3(s->tlsext_ocsp_resplen + 4, p);\n    *(p++) = s->tlsext_status_type;\n    l2n3(s->tlsext_ocsp_resplen, p);\n    memcpy(p, s->tlsext_ocsp_resp, s->tlsext_ocsp_resplen);\n    s->init_num = 8 + s->tlsext_ocsp_resplen;\n    s->init_off = 0;\n    return 1;\n}', 'size_t BUF_MEM_grow(BUF_MEM *str, size_t len)\n{\n    char *ret;\n    size_t n;\n    if (str->length >= len) {\n        str->length = len;\n        return (len);\n    }\n    if (str->max >= len) {\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n        return (len);\n    }\n    if (len > LIMIT_BEFORE_EXPANSION) {\n        BUFerr(BUF_F_BUF_MEM_GROW, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    n = (len + 3) / 3 * 4;\n    if ((str->flags & BUF_MEM_FLAG_SECURE))\n        ret = sec_alloc_realloc(str, n);\n    else\n        ret = OPENSSL_realloc(str->data, n);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_MEM_GROW, ERR_R_MALLOC_FAILURE);\n        len = 0;\n    } else {\n        str->data = ret;\n        str->max = n;\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n    }\n    return (len);\n}']