test/clienthellotest.c:102: error: BUFFER_OVERRUN_L1
  Offset: 7 Size: 4 by call to `SSL_CTX_set_cipher_list`.
Showing all 10 steps of the trace


test/clienthellotest.c:102:22: Call
100.            */
101.           if (currtest == TEST_ADD_PADDING
102.                   && (!SSL_CTX_set_cipher_list(ctx, "ALL")
                            ^
103.                       || SSL_CTX_set_alpn_protos(ctx,
104.                                                  (unsigned char *)alpn_prots,

ssl/ssl_lib.c:2285:1: Parameter `*str`
  2283.   
  2284.   /** specify the ciphers to be used by default by the SSL_CTX */
  2285. > int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)
  2286.   {
  2287.       STACK_OF(SSL_CIPHER) *sk;

ssl/ssl_lib.c:2289:10: Call
  2287.       STACK_OF(SSL_CIPHER) *sk;
  2288.   
  2289.       sk = ssl_create_cipher_list(ctx->method, &ctx->cipher_list,
                   ^
  2290.                                   &ctx->cipher_list_by_id, str, ctx->cert);
  2291.       /*

ssl/ssl_ciph.c:1283:1: <Length trace>
1281.   #endif
1282.   
1283. > STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, STACK_OF(SSL_CIPHER)
1284.                                                **cipher_list, STACK_OF(SSL_CIPHER)
1285.                                                **cipher_list_by_id,

ssl/ssl_ciph.c:1283:1: Parameter `*rule_str`
    1281.   #endif
    1282.   
    1283. > STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, STACK_OF(SSL_CIPHER)
    1284.                                                **cipher_list, STACK_OF(SSL_CIPHER)
    1285.                                                **cipher_list_by_id,

ssl/ssl_ciph.c:1301:10: Call
    1299.           return NULL;
    1300.   #ifndef OPENSSL_NO_EC
    1301.       if (!check_suiteb_cipher_list(ssl_method, c, &rule_str))
                     ^
    1302.           return NULL;
    1303.   #endif

ssl/ssl_ciph.c:1229:1: Parameter `**prule_str`
      1227.   
      1228.   #ifndef OPENSSL_NO_EC
      1229. > static int check_suiteb_cipher_list(const SSL_METHOD *meth, CERT *c,
      1230.                                       const char **prule_str)
      1231.   {

ssl/ssl_ciph.c:1454:5: Assignment
    1452.        */
    1453.       ok = 1;
    1454.       rule_p = rule_str;
                ^
    1455.       if (strncmp(rule_str, "DEFAULT", 7) == 0) {
    1456.           ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,

ssl/ssl_ciph.c:1458:9: Assignment
    1456.           ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,
    1457.                                           &head, &tail, ca_list, c);
    1458.           rule_p += 7;
                    ^
    1459.           if (*rule_p == ':')
    1460.               rule_p++;

ssl/ssl_ciph.c:1459:13: Array access: Offset: 7 Size: 4 by call to `SSL_CTX_set_cipher_list` 
    1457.                                           &head, &tail, ca_list, c);
    1458.           rule_p += 7;
    1459.           if (*rule_p == ':')
                        ^
    1460.               rule_p++;
    1461.       }

STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, STACK_OF(SSL_CIPHER)
                                             **cipher_list, STACK_OF(SSL_CIPHER)
                                             **cipher_list_by_id,
                                             const char *rule_str, CERT *c)
{
    int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;
    uint32_t disabled_mkey, disabled_auth, disabled_enc, disabled_mac;
    STACK_OF(SSL_CIPHER) *cipherstack, *tmp_cipher_list;
    const char *rule_p;
    CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;
    const SSL_CIPHER **ca_list = NULL;
    if (rule_str == NULL || cipher_list == NULL || cipher_list_by_id == NULL)
        return NULL;
#ifndef OPENSSL_NO_EC
    if (!check_suiteb_cipher_list(ssl_method, c, &rule_str))
        return NULL;
#endif
    disabled_mkey = disabled_mkey_mask;
    disabled_auth = disabled_auth_mask;
    disabled_enc = disabled_enc_mask;
    disabled_mac = disabled_mac_mask;
    num_of_ciphers = ssl_method->num_ciphers();
    co_list = OPENSSL_malloc(sizeof(*co_list) * num_of_ciphers);
    if (co_list == NULL) {
        SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
        return (NULL);
    }
    ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers,
                               disabled_mkey, disabled_auth, disabled_enc,
                               disabled_mac, co_list, &head, &tail);
    ssl_cipher_apply_rule(0, SSL_kECDHE, SSL_aECDSA, 0, 0, 0, 0, CIPHER_ADD,
                          -1, &head, &tail);
    ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head,
                          &tail);
    ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head,
                          &tail);
    ssl_cipher_apply_rule(0, 0, 0, SSL_AESGCM, 0, 0, 0, CIPHER_ADD, -1,
                          &head, &tail);
    ssl_cipher_apply_rule(0, 0, 0, SSL_CHACHA20, 0, 0, 0, CIPHER_ADD, -1,
                          &head, &tail);
    ssl_cipher_apply_rule(0, 0, 0, SSL_AES ^ SSL_AESGCM, 0, 0, 0, CIPHER_ADD,
                          -1, &head, &tail);
    ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);
    ssl_cipher_apply_rule(0, 0, 0, 0, SSL_MD5, 0, 0, CIPHER_ORD, -1, &head,
                          &tail);
    ssl_cipher_apply_rule(0, 0, SSL_aNULL, 0, 0, 0, 0, CIPHER_ORD, -1, &head,
                          &tail);
    ssl_cipher_apply_rule(0, SSL_kRSA, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head,
                          &tail);
    ssl_cipher_apply_rule(0, SSL_kPSK, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head,
                          &tail);
    ssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head,
                          &tail);
    if (!ssl_cipher_strength_sort(&head, &tail)) {
        OPENSSL_free(co_list);
        return NULL;
    }
    ssl_cipher_apply_rule(0, 0, 0, 0, 0, TLS1_2_VERSION, 0, CIPHER_BUMP, -1,
                          &head, &tail);
    ssl_cipher_apply_rule(0, 0, 0, 0, SSL_AEAD, 0, 0, CIPHER_BUMP, -1,
                          &head, &tail);
    ssl_cipher_apply_rule(0, SSL_kDHE | SSL_kECDHE, 0, 0, 0, 0, 0,
                          CIPHER_BUMP, -1, &head, &tail);
    ssl_cipher_apply_rule(0, SSL_kDHE | SSL_kECDHE, 0, 0, SSL_AEAD, 0, 0,
                          CIPHER_BUMP, -1, &head, &tail);
    ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);
    num_of_group_aliases = OSSL_NELEM(cipher_aliases);
    num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;
    ca_list = OPENSSL_malloc(sizeof(*ca_list) * num_of_alias_max);
    if (ca_list == NULL) {
        OPENSSL_free(co_list);
        SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);
        return (NULL);
    }
    ssl_cipher_collect_aliases(ca_list, num_of_group_aliases,
                               disabled_mkey, disabled_auth, disabled_enc,
                               disabled_mac, head);
    ok = 1;
    rule_p = rule_str;
    if (strncmp(rule_str, "DEFAULT", 7) == 0) {
        ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,
                                        &head, &tail, ca_list, c);
        rule_p += 7;
        if (*rule_p == ':')
            rule_p++;
    }
    if (ok && (strlen(rule_p) > 0))
        ok = ssl_cipher_process_rulestr(rule_p, &head, &tail, ca_list, c);
    OPENSSL_free(ca_list);
    if (!ok) {
        OPENSSL_free(co_list);
        return (NULL);
    }
    if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) {
        OPENSSL_free(co_list);
        return (NULL);
    }
    for (curr = head; curr != NULL; curr = curr->next) {
        if (curr->active) {
            if (!sk_SSL_CIPHER_push(cipherstack, curr->cipher)) {
                OPENSSL_free(co_list);
                sk_SSL_CIPHER_free(cipherstack);
                return NULL;
            }
#ifdef CIPHER_DEBUG
            fprintf(stderr, "<%s>\n", curr->cipher->name);
#endif
        }
    }
    OPENSSL_free(co_list);
    tmp_cipher_list = sk_SSL_CIPHER_dup(cipherstack);
    if (tmp_cipher_list == NULL) {
        sk_SSL_CIPHER_free(cipherstack);
        return NULL;
    }
    sk_SSL_CIPHER_free(*cipher_list);
    *cipher_list = cipherstack;
    if (*cipher_list_by_id != NULL)
        sk_SSL_CIPHER_free(*cipher_list_by_id);
    *cipher_list_by_id = tmp_cipher_list;
    (void)sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id, ssl_cipher_ptr_id_cmp);
    sk_SSL_CIPHER_sort(*cipher_list_by_id);
    return (cipherstack);
}
['static int test_client_hello(int currtest)\n{\n    SSL_CTX *ctx;\n    SSL *con = NULL;\n    BIO *rbio;\n    BIO *wbio;\n    long len;\n    unsigned char *data;\n    PACKET pkt, pkt2, pkt3;\n    char *dummytick = "Hello World!";\n    unsigned int type;\n    int testresult = 0;\n    size_t msglen;\n    BIO *sessbio = NULL;\n    SSL_SESSION *sess = NULL;\n#ifdef OPENSSL_NO_TLS1_3\n    if (currtest == TEST_ADD_PADDING_AND_PSK)\n        return 1;\n#endif\n    ctx = SSL_CTX_new(TLS_method());\n    if (ctx == NULL)\n        goto end;\n    switch(currtest) {\n    case TEST_SET_SESSION_TICK_DATA_VER_NEG:\n        if (!SSL_CTX_set_max_proto_version(ctx, TLS1_2_VERSION))\n            goto end;\n        break;\n    case TEST_ADD_PADDING_AND_PSK:\n    case TEST_ADD_PADDING:\n    case TEST_PADDING_NOT_NEEDED:\n        SSL_CTX_set_options(ctx, SSL_OP_TLSEXT_PADDING);\n        if (currtest == TEST_ADD_PADDING\n                && (!SSL_CTX_set_cipher_list(ctx, "ALL")\n                    || SSL_CTX_set_alpn_protos(ctx,\n                                               (unsigned char *)alpn_prots,\n                                               sizeof(alpn_prots) - 1)))\n            goto end;\n        else if (currtest == TEST_PADDING_NOT_NEEDED)\n            testresult = 1;\n        break;\n    default:\n        goto end;\n    }\n    con = SSL_new(ctx);\n    if (con == NULL)\n        goto end;\n    if (currtest == TEST_ADD_PADDING_AND_PSK) {\n        sessbio = BIO_new_file(sessionfile, "r");\n        if (sessbio == NULL) {\n            printf("Unable to open session.pem\\n");\n            goto end;\n        }\n        sess = PEM_read_bio_SSL_SESSION(sessbio, NULL, NULL, NULL);\n        if (sess == NULL) {\n            printf("Unable to load SSL_SESSION\\n");\n            goto end;\n        }\n        if (!SSL_SESSION_set_time(sess, time(NULL))) {\n            printf("Unable to set creation time on SSL_SESSION\\n");\n            goto end;\n        }\n        if (!SSL_set_session(con, sess)) {\n            printf("Unable to set the session on the connection\\n");\n            goto end;\n        }\n    }\n    rbio = BIO_new(BIO_s_mem());\n    wbio = BIO_new(BIO_s_mem());\n    if (rbio == NULL || wbio == NULL) {\n        BIO_free(rbio);\n        BIO_free(wbio);\n        goto end;\n    }\n    SSL_set_bio(con, rbio, wbio);\n    SSL_set_connect_state(con);\n    if (currtest == TEST_SET_SESSION_TICK_DATA_VER_NEG) {\n        if (!SSL_set_session_ticket_ext(con, dummytick, strlen(dummytick)))\n            goto end;\n    }\n    if (SSL_connect(con) > 0) {\n        goto end;\n    }\n    len = BIO_get_mem_data(wbio, (char **)&data);\n    if (!PACKET_buf_init(&pkt, data, len))\n        goto end;\n    if (!PACKET_forward(&pkt, SSL3_RT_HEADER_LENGTH))\n        goto end;\n    msglen = PACKET_remaining(&pkt);\n    if (!PACKET_forward(&pkt, SSL3_HM_HEADER_LENGTH))\n        goto end;\n    if (!PACKET_forward(&pkt, CLIENT_VERSION_LEN + SSL3_RANDOM_SIZE))\n        goto end;\n    if (!PACKET_get_length_prefixed_1(&pkt, &pkt2))\n        goto end;\n    if (!PACKET_get_length_prefixed_2(&pkt, &pkt2))\n        goto end;\n    if (!PACKET_get_length_prefixed_1(&pkt, &pkt2))\n        goto end;\n    if (!PACKET_as_length_prefixed_2(&pkt, &pkt2))\n        goto end;\n    while (PACKET_remaining(&pkt2)) {\n        if (!PACKET_get_net_2(&pkt2, &type) ||\n            !PACKET_get_length_prefixed_2(&pkt2, &pkt3))\n            goto end;\n        if (type == TLSEXT_TYPE_session_ticket) {\n            if (currtest == TEST_SET_SESSION_TICK_DATA_VER_NEG) {\n                if (PACKET_equal(&pkt3, dummytick, strlen(dummytick))) {\n                    testresult = 1;\n                } else {\n                    printf("Received session ticket is not as expected\\n");\n                }\n                break;\n            }\n        }\n        if (type == TLSEXT_TYPE_padding) {\n            if (currtest == TEST_ADD_PADDING\n                    || currtest == TEST_ADD_PADDING_AND_PSK)\n                testresult = (msglen == F5_WORKAROUND_MAX_MSG_LEN);\n            else\n                testresult = 0;\n        }\n    }\nend:\n    SSL_free(con);\n    SSL_CTX_free(ctx);\n    SSL_SESSION_free(sess);\n    BIO_free(sessbio);\n    if (!testresult)\n        printf("ClientHello test: FAILED (Test %d)\\n", currtest);\n    return testresult;\n}', 'int SSL_CTX_set_cipher_list(SSL_CTX *ctx, const char *str)\n{\n    STACK_OF(SSL_CIPHER) *sk;\n    sk = ssl_create_cipher_list(ctx->method, &ctx->cipher_list,\n                                &ctx->cipher_list_by_id, str, ctx->cert);\n    if (sk == NULL)\n        return 0;\n    else if (sk_SSL_CIPHER_num(sk) == 0) {\n        SSLerr(SSL_F_SSL_CTX_SET_CIPHER_LIST, SSL_R_NO_CIPHER_MATCH);\n        return 0;\n    }\n    return 1;\n}', 'STACK_OF(SSL_CIPHER) *ssl_create_cipher_list(const SSL_METHOD *ssl_method, STACK_OF(SSL_CIPHER)\n                                             **cipher_list, STACK_OF(SSL_CIPHER)\n                                             **cipher_list_by_id,\n                                             const char *rule_str, CERT *c)\n{\n    int ok, num_of_ciphers, num_of_alias_max, num_of_group_aliases;\n    uint32_t disabled_mkey, disabled_auth, disabled_enc, disabled_mac;\n    STACK_OF(SSL_CIPHER) *cipherstack, *tmp_cipher_list;\n    const char *rule_p;\n    CIPHER_ORDER *co_list = NULL, *head = NULL, *tail = NULL, *curr;\n    const SSL_CIPHER **ca_list = NULL;\n    if (rule_str == NULL || cipher_list == NULL || cipher_list_by_id == NULL)\n        return NULL;\n#ifndef OPENSSL_NO_EC\n    if (!check_suiteb_cipher_list(ssl_method, c, &rule_str))\n        return NULL;\n#endif\n    disabled_mkey = disabled_mkey_mask;\n    disabled_auth = disabled_auth_mask;\n    disabled_enc = disabled_enc_mask;\n    disabled_mac = disabled_mac_mask;\n    num_of_ciphers = ssl_method->num_ciphers();\n    co_list = OPENSSL_malloc(sizeof(*co_list) * num_of_ciphers);\n    if (co_list == NULL) {\n        SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);\n        return (NULL);\n    }\n    ssl_cipher_collect_ciphers(ssl_method, num_of_ciphers,\n                               disabled_mkey, disabled_auth, disabled_enc,\n                               disabled_mac, co_list, &head, &tail);\n    ssl_cipher_apply_rule(0, SSL_kECDHE, SSL_aECDSA, 0, 0, 0, 0, CIPHER_ADD,\n                          -1, &head, &tail);\n    ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, SSL_kECDHE, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, 0, 0, SSL_AESGCM, 0, 0, 0, CIPHER_ADD, -1,\n                          &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, SSL_CHACHA20, 0, 0, 0, CIPHER_ADD, -1,\n                          &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, SSL_AES ^ SSL_AESGCM, 0, 0, 0, CIPHER_ADD,\n                          -1, &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_ADD, -1, &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, 0, SSL_MD5, 0, 0, CIPHER_ORD, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, 0, SSL_aNULL, 0, 0, 0, 0, CIPHER_ORD, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, SSL_kRSA, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, SSL_kPSK, 0, 0, 0, 0, 0, CIPHER_ORD, -1, &head,\n                          &tail);\n    ssl_cipher_apply_rule(0, 0, 0, SSL_RC4, 0, 0, 0, CIPHER_ORD, -1, &head,\n                          &tail);\n    if (!ssl_cipher_strength_sort(&head, &tail)) {\n        OPENSSL_free(co_list);\n        return NULL;\n    }\n    ssl_cipher_apply_rule(0, 0, 0, 0, 0, TLS1_2_VERSION, 0, CIPHER_BUMP, -1,\n                          &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, 0, SSL_AEAD, 0, 0, CIPHER_BUMP, -1,\n                          &head, &tail);\n    ssl_cipher_apply_rule(0, SSL_kDHE | SSL_kECDHE, 0, 0, 0, 0, 0,\n                          CIPHER_BUMP, -1, &head, &tail);\n    ssl_cipher_apply_rule(0, SSL_kDHE | SSL_kECDHE, 0, 0, SSL_AEAD, 0, 0,\n                          CIPHER_BUMP, -1, &head, &tail);\n    ssl_cipher_apply_rule(0, 0, 0, 0, 0, 0, 0, CIPHER_DEL, -1, &head, &tail);\n    num_of_group_aliases = OSSL_NELEM(cipher_aliases);\n    num_of_alias_max = num_of_ciphers + num_of_group_aliases + 1;\n    ca_list = OPENSSL_malloc(sizeof(*ca_list) * num_of_alias_max);\n    if (ca_list == NULL) {\n        OPENSSL_free(co_list);\n        SSLerr(SSL_F_SSL_CREATE_CIPHER_LIST, ERR_R_MALLOC_FAILURE);\n        return (NULL);\n    }\n    ssl_cipher_collect_aliases(ca_list, num_of_group_aliases,\n                               disabled_mkey, disabled_auth, disabled_enc,\n                               disabled_mac, head);\n    ok = 1;\n    rule_p = rule_str;\n    if (strncmp(rule_str, "DEFAULT", 7) == 0) {\n        ok = ssl_cipher_process_rulestr(SSL_DEFAULT_CIPHER_LIST,\n                                        &head, &tail, ca_list, c);\n        rule_p += 7;\n        if (*rule_p == \':\')\n            rule_p++;\n    }\n    if (ok && (strlen(rule_p) > 0))\n        ok = ssl_cipher_process_rulestr(rule_p, &head, &tail, ca_list, c);\n    OPENSSL_free(ca_list);\n    if (!ok) {\n        OPENSSL_free(co_list);\n        return (NULL);\n    }\n    if ((cipherstack = sk_SSL_CIPHER_new_null()) == NULL) {\n        OPENSSL_free(co_list);\n        return (NULL);\n    }\n    for (curr = head; curr != NULL; curr = curr->next) {\n        if (curr->active) {\n            if (!sk_SSL_CIPHER_push(cipherstack, curr->cipher)) {\n                OPENSSL_free(co_list);\n                sk_SSL_CIPHER_free(cipherstack);\n                return NULL;\n            }\n#ifdef CIPHER_DEBUG\n            fprintf(stderr, "<%s>\\n", curr->cipher->name);\n#endif\n        }\n    }\n    OPENSSL_free(co_list);\n    tmp_cipher_list = sk_SSL_CIPHER_dup(cipherstack);\n    if (tmp_cipher_list == NULL) {\n        sk_SSL_CIPHER_free(cipherstack);\n        return NULL;\n    }\n    sk_SSL_CIPHER_free(*cipher_list);\n    *cipher_list = cipherstack;\n    if (*cipher_list_by_id != NULL)\n        sk_SSL_CIPHER_free(*cipher_list_by_id);\n    *cipher_list_by_id = tmp_cipher_list;\n    (void)sk_SSL_CIPHER_set_cmp_func(*cipher_list_by_id, ssl_cipher_ptr_id_cmp);\n    sk_SSL_CIPHER_sort(*cipher_list_by_id);\n    return (cipherstack);\n}', 'static int check_suiteb_cipher_list(const SSL_METHOD *meth, CERT *c,\n                                    const char **prule_str)\n{\n    unsigned int suiteb_flags = 0, suiteb_comb2 = 0;\n    if (strncmp(*prule_str, "SUITEB128ONLY", 13) == 0) {\n        suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS_ONLY;\n    } else if (strncmp(*prule_str, "SUITEB128C2", 11) == 0) {\n        suiteb_comb2 = 1;\n        suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS;\n    } else if (strncmp(*prule_str, "SUITEB128", 9) == 0) {\n        suiteb_flags = SSL_CERT_FLAG_SUITEB_128_LOS;\n    } else if (strncmp(*prule_str, "SUITEB192", 9) == 0) {\n        suiteb_flags = SSL_CERT_FLAG_SUITEB_192_LOS;\n    }\n    if (suiteb_flags) {\n        c->cert_flags &= ~SSL_CERT_FLAG_SUITEB_128_LOS;\n        c->cert_flags |= suiteb_flags;\n    } else\n        suiteb_flags = c->cert_flags & SSL_CERT_FLAG_SUITEB_128_LOS;\n    if (!suiteb_flags)\n        return 1;\n    if (!(meth->ssl3_enc->enc_flags & SSL_ENC_FLAG_TLS1_2_CIPHERS)) {\n        SSLerr(SSL_F_CHECK_SUITEB_CIPHER_LIST,\n               SSL_R_AT_LEAST_TLS_1_2_NEEDED_IN_SUITEB_MODE);\n        return 0;\n    }\n# ifndef OPENSSL_NO_EC\n    switch (suiteb_flags) {\n    case SSL_CERT_FLAG_SUITEB_128_LOS:\n        if (suiteb_comb2)\n            *prule_str = "ECDHE-ECDSA-AES256-GCM-SHA384";\n        else\n            *prule_str =\n                "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384";\n        break;\n    case SSL_CERT_FLAG_SUITEB_128_LOS_ONLY:\n        *prule_str = "ECDHE-ECDSA-AES128-GCM-SHA256";\n        break;\n    case SSL_CERT_FLAG_SUITEB_192_LOS:\n        *prule_str = "ECDHE-ECDSA-AES256-GCM-SHA384";\n        break;\n    }\n    return 1;\n# else\n    SSLerr(SSL_F_CHECK_SUITEB_CIPHER_LIST, SSL_R_ECDH_REQUIRED_FOR_SUITEB_MODE);\n    return 0;\n# endif\n}']