ssl/ssl_lib.c:2931: error: BUFFER_OVERRUN_L2
  Offset: [min(-1, `s->s3->tmp.cert_idx`), max(7, `s->s3->tmp.cert_idx`)] Size: 7.
Showing all 8 steps of the trace


ssl/ssl_lib.c:2916:1: <Offset trace>
2914.   }
2915.   
2916. > int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
2917.                                      size_t *serverinfo_length)
2918.   {

ssl/ssl_lib.c:2916:1: Parameter `s->s3->tmp.cert_idx`
2914.   }
2915.   
2916. > int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
2917.                                      size_t *serverinfo_length)
2918.   {

ssl/ssl_lib.c:2924:9: Call
2922.   
2923.       c = s->cert;
2924.       i = ssl_get_server_cert_index(s);
                ^
2925.   
2926.       if (i == -1)

ssl/ssl_lib.c:2844:13: Assignment
  2842.           if (s->s3->tmp.sigalg == NULL) {
  2843.               SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
  2844.               return -1;
                      ^
  2845.           }
  2846.           return s->s3->tmp.cert_idx;

ssl/ssl_lib.c:2924:5: Assignment
2922.   
2923.       c = s->cert;
2924.       i = ssl_get_server_cert_index(s);
            ^
2925.   
2926.       if (i == -1)

ssl/ssl_lib.c:2916:1: <Length trace>
2914.   }
2915.   
2916. > int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
2917.                                      size_t *serverinfo_length)
2918.   {

ssl/ssl_lib.c:2916:1: Parameter `s->cert->pkeys[*]`
2914.   }
2915.   
2916. > int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
2917.                                      size_t *serverinfo_length)
2918.   {

ssl/ssl_lib.c:2931:19: Array access: Offset: [min(-1, s->s3->tmp.cert_idx), max(7, s->s3->tmp.cert_idx)] Size: 7
2929.           return 0;
2930.   
2931.       *serverinfo = c->pkeys[i].serverinfo;
                          ^
2932.       *serverinfo_length = c->pkeys[i].serverinfo_length;
2933.       return 1;

int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
                                   size_t *serverinfo_length)
{
    CERT *c = NULL;
    int i = 0;
    *serverinfo_length = 0;
    c = s->cert;
    i = ssl_get_server_cert_index(s);
    if (i == -1)
        return 0;
    if (c->pkeys[i].serverinfo == NULL)
        return 0;
    *serverinfo = c->pkeys[i].serverinfo;
    *serverinfo_length = c->pkeys[i].serverinfo_length;
    return 1;
}
['int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,\n                                   size_t *serverinfo_length)\n{\n    CERT *c = NULL;\n    int i = 0;\n    *serverinfo_length = 0;\n    c = s->cert;\n    i = ssl_get_server_cert_index(s);\n    if (i == -1)\n        return 0;\n    if (c->pkeys[i].serverinfo == NULL)\n        return 0;\n    *serverinfo = c->pkeys[i].serverinfo;\n    *serverinfo_length = c->pkeys[i].serverinfo_length;\n    return 1;\n}', 'static int ssl_get_server_cert_index(const SSL *s)\n{\n    int idx;\n    if (SSL_IS_TLS13(s)) {\n        if (s->s3->tmp.sigalg == NULL) {\n            SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);\n            return -1;\n        }\n        return s->s3->tmp.cert_idx;\n    }\n    idx = ssl_cipher_get_cert_index(s->s3->tmp.new_cipher);\n    if (idx == SSL_PKEY_RSA_ENC && !s->cert->pkeys[SSL_PKEY_RSA_ENC].x509)\n        idx = SSL_PKEY_RSA_SIGN;\n    if (idx == SSL_PKEY_GOST_EC) {\n        if (s->cert->pkeys[SSL_PKEY_GOST12_512].x509)\n            idx = SSL_PKEY_GOST12_512;\n        else if (s->cert->pkeys[SSL_PKEY_GOST12_256].x509)\n            idx = SSL_PKEY_GOST12_256;\n        else if (s->cert->pkeys[SSL_PKEY_GOST01].x509)\n            idx = SSL_PKEY_GOST01;\n        else\n            idx = -1;\n    }\n    if (idx == -1)\n        SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);\n    return idx;\n}']