ssl/statem/extensions_clnt.c:167: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: 29 by call to `tls_curve_allowed`.
Showing all 8 steps of the trace


ssl/statem/extensions_clnt.c:168:18: Call
166.       for (i = 0; i < num_curves; i++, pcurvestmp += 2) {
167.           if (tls_curve_allowed(s, pcurvestmp, SSL_SECOP_CURVE_SUPPORTED)) {
168.               if (!WPACKET_put_bytes_u8(pkt, pcurvestmp[0])
                        ^
169.                   || !WPACKET_put_bytes_u8(pkt, pcurvestmp[1])) {
170.                       SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS,

ssl/packet.c:312:1: Parameter `*pkt->buf->data`
  310.   }
  311.   
  312. > int WPACKET_put_bytes__(WPACKET *pkt, unsigned int val, size_t size)
  313.   {
  314.       unsigned char *data;

ssl/statem/extensions_clnt.c:167:13: Call
165.       /* Copy curve ID if supported */
166.       for (i = 0; i < num_curves; i++, pcurvestmp += 2) {
167.           if (tls_curve_allowed(s, pcurvestmp, SSL_SECOP_CURVE_SUPPORTED)) {
                   ^
168.               if (!WPACKET_put_bytes_u8(pkt, pcurvestmp[0])
169.                   || !WPACKET_put_bytes_u8(pkt, pcurvestmp[1])) {

ssl/t1_lib.c:268:1: <Offset trace>
266.   
267.   /* See if curve is allowed by security callback */
268. > int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
269.   {
270.       const tls_curve_info *cinfo;

ssl/t1_lib.c:268:1: Parameter `*curve`
  266.   
  267.   /* See if curve is allowed by security callback */
  268. > int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
  269.   {
  270.       const tls_curve_info *cinfo;

ssl/t1_lib.c:137:1: <Length trace>
135.    * table: the index of each entry is one less than the TLS curve id.
136.    */
137. > static const tls_curve_info nid_list[] = {
138.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
139.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:137:1: Array declaration
  135.    * table: the index of each entry is one less than the TLS curve id.
  136.    */
  137. > static const tls_curve_info nid_list[] = {
  138.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
  139.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:275:5: Array access: Offset: [-1, +oo] Size: 29 by call to `tls_curve_allowed` 
  273.       if ((curve[1] < 1) || ((size_t)curve[1] > OSSL_NELEM(nid_list)))
  274.           return 0;
  275.       cinfo = &nid_list[curve[1] - 1];
             ^
  276.   # ifdef OPENSSL_NO_EC2M
  277.       if (cinfo->flags & TLS_CURVE_CHAR2)

int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
{
    const tls_curve_info *cinfo;
    if (curve[0])
        return 1;
    if ((curve[1] < 1) || ((size_t)curve[1] > OSSL_NELEM(nid_list)))
        return 0;
    cinfo = &nid_list[curve[1] - 1];
# ifdef OPENSSL_NO_EC2M
    if (cinfo->flags & TLS_CURVE_CHAR2)
        return 0;
# endif
    return ssl_security(s, op, cinfo->secbits, cinfo->nid, (void *)curve);
}
['int tls_construct_ctos_supported_groups(SSL *s, WPACKET *pkt,\n                                        unsigned int context, X509 *x,\n                                        size_t chainidx, int *al)\n{\n    const unsigned char *pcurves = NULL, *pcurvestmp;\n    size_t num_curves = 0, i;\n    if (!use_ecc(s))\n        return 1;\n    pcurves = s->ext.supportedgroups;\n    if (!tls1_get_curvelist(s, 0, &pcurves, &num_curves)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS,\n               ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    pcurvestmp = pcurves;\n    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups)\n            || !WPACKET_start_sub_packet_u16(pkt)\n            || !WPACKET_start_sub_packet_u16(pkt)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS,\n               ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    for (i = 0; i < num_curves; i++, pcurvestmp += 2) {\n        if (tls_curve_allowed(s, pcurvestmp, SSL_SECOP_CURVE_SUPPORTED)) {\n            if (!WPACKET_put_bytes_u8(pkt, pcurvestmp[0])\n                || !WPACKET_put_bytes_u8(pkt, pcurvestmp[1])) {\n                    SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS,\n                           ERR_R_INTERNAL_ERROR);\n                    return 0;\n                }\n        }\n    }\n    if (!WPACKET_close(pkt) || !WPACKET_close(pkt)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CTOS_SUPPORTED_GROUPS,\n               ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    return 1;\n}', 'int WPACKET_put_bytes__(WPACKET *pkt, unsigned int val, size_t size)\n{\n    unsigned char *data;\n    assert(size <= sizeof(unsigned int));\n    if (size > sizeof(unsigned int)\n            || !WPACKET_allocate_bytes(pkt, size, &data)\n            || !put_value(data, val, size))\n        return 0;\n    return 1;\n}', 'int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)\n{\n    const tls_curve_info *cinfo;\n    if (curve[0])\n        return 1;\n    if ((curve[1] < 1) || ((size_t)curve[1] > OSSL_NELEM(nid_list)))\n        return 0;\n    cinfo = &nid_list[curve[1] - 1];\n# ifdef OPENSSL_NO_EC2M\n    if (cinfo->flags & TLS_CURVE_CHAR2)\n        return 0;\n# endif\n    return ssl_security(s, op, cinfo->secbits, cinfo->nid, (void *)curve);\n}']