ssl/statem/statem_clnt.c:2752: error: BUFFER_OVERRUN_L3
  Offset: 3 Size: [1, 118] by call to `ssl_log_rsa_client_key_exchange`.
Showing all 13 steps of the trace


ssl/statem/statem_clnt.c:2702:5: Assignment
2700.       }
2701.   
2702.       pmslen = SSL_MAX_MASTER_KEY_LENGTH;
            ^
2703.       pms = OPENSSL_malloc(pmslen);
2704.       if (pms == NULL) {

ssl/statem/statem_clnt.c:2752:10: Call
2750.   
2751.       /* Log the premaster secret, if logging is enabled. */
2752.       if (!ssl_log_rsa_client_key_exchange(s, encdata, enclen, pms, pmslen))
                 ^
2753.           goto err;
2754.   

ssl/ssl_lib.c:4372:1: Parameter `premaster_len`
  4370.   }
  4371.   
  4372. > int ssl_log_rsa_client_key_exchange(SSL *ssl,
  4373.                                       const uint8_t *encrypted_premaster,
  4374.                                       size_t encrypted_premaster_len,

ssl/ssl_lib.c:4384:12: Call
  4382.   
  4383.       /* We only want the first 8 bytes of the encrypted premaster as a tag. */
  4384.       return nss_keylog_int("RSA",
                     ^
  4385.                             ssl,
  4386.                             encrypted_premaster,

ssl/ssl_lib.c:4320:1: <Offset trace>
4318.   }
4319.   
4320. > static int nss_keylog_int(const char *prefix,
4321.                             SSL *ssl,
4322.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4320:1: Parameter `prefix->strlen`
    4318.   }
    4319.   
    4320. > static int nss_keylog_int(const char *prefix,
    4321.                             SSL *ssl,
    4322.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4320:1: <Length trace>
4318.   }
4319.   
4320. > static int nss_keylog_int(const char *prefix,
4321.                             SSL *ssl,
4322.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4320:1: Parameter `parameter_2_len`
    4318.   }
    4319.   
    4320. > static int nss_keylog_int(const char *prefix,
    4321.                             SSL *ssl,
    4322.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4344:5: Assignment
    4342.        */
    4343.       prefix_len = strlen(prefix);
    4344.       out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;
                ^
    4345.       if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
    4346.           SSLerr(SSL_F_NSS_KEYLOG_INT, ERR_R_MALLOC_FAILURE);

ssl/ssl_lib.c:4345:25: Call
    4343.       prefix_len = strlen(prefix);
    4344.       out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;
    4345.       if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
                                    ^
    4346.           SSLerr(SSL_F_NSS_KEYLOG_INT, ERR_R_MALLOC_FAILURE);
    4347.           return 0;

crypto/mem.c:166:9: Assignment
      164.   
      165.       if (num == 0)
      166.           return NULL;
                     ^
      167.   
      168.       FAILTEST();

ssl/ssl_lib.c:4345:16: Assignment
    4343.       prefix_len = strlen(prefix);
    4344.       out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;
    4345.       if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
                           ^
    4346.           SSLerr(SSL_F_NSS_KEYLOG_INT, ERR_R_MALLOC_FAILURE);
    4347.           return 0;

ssl/ssl_lib.c:4350:5: Array access: Offset: 3 Size: [1, 118] by call to `ssl_log_rsa_client_key_exchange` 
    4348.       }
    4349.   
    4350.       strcpy(cursor, prefix);
                ^
    4351.       cursor += prefix_len;
    4352.       *cursor++ = ' ';

static int nss_keylog_int(const char *prefix,
                          SSL *ssl,
                          const uint8_t *parameter_1,
                          size_t parameter_1_len,
                          const uint8_t *parameter_2,
                          size_t parameter_2_len)
{
    char *out = NULL;
    char *cursor = NULL;
    size_t out_len = 0;
    size_t i;
    size_t prefix_len;
    if (ssl->ctx->keylog_callback == NULL) return 1;
    prefix_len = strlen(prefix);
    out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;
    if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
        SSLerr(SSL_F_NSS_KEYLOG_INT, ERR_R_MALLOC_FAILURE);
        return 0;
    }
    strcpy(cursor, prefix);
    cursor += prefix_len;
    *cursor++ = ' ';
    for (i = 0; i < parameter_1_len; i++) {
        sprintf(cursor, "%02x", parameter_1[i]);
        cursor += 2;
    }
    *cursor++ = ' ';
    for (i = 0; i < parameter_2_len; i++) {
        sprintf(cursor, "%02x", parameter_2[i]);
        cursor += 2;
    }
    *cursor = '\0';
    ssl->ctx->keylog_callback(ssl, (const char *)out);
    OPENSSL_free(out);
    return 1;
}
['static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt, int *al)\n{\n#ifndef OPENSSL_NO_RSA\n    unsigned char *encdata = NULL;\n    EVP_PKEY *pkey = NULL;\n    EVP_PKEY_CTX *pctx = NULL;\n    size_t enclen;\n    unsigned char *pms = NULL;\n    size_t pmslen = 0;\n    if (s->session->peer == NULL) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    pkey = X509_get0_pubkey(s->session->peer);\n    if (EVP_PKEY_get0_RSA(pkey) == NULL) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    pmslen = SSL_MAX_MASTER_KEY_LENGTH;\n    pms = OPENSSL_malloc(pmslen);\n    if (pms == NULL) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_MALLOC_FAILURE);\n        *al = SSL_AD_INTERNAL_ERROR;\n        return 0;\n    }\n    pms[0] = s->client_version >> 8;\n    pms[1] = s->client_version & 0xff;\n    if (RAND_bytes(pms + 2, (int)(pmslen - 2)) <= 0) {\n        goto err;\n    }\n    if (s->version > SSL3_VERSION && !WPACKET_start_sub_packet_u16(pkt)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    pctx = EVP_PKEY_CTX_new(pkey, NULL);\n    if (pctx == NULL || EVP_PKEY_encrypt_init(pctx) <= 0\n        || EVP_PKEY_encrypt(pctx, NULL, &enclen, pms, pmslen) <= 0) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_EVP_LIB);\n        goto err;\n    }\n    if (!WPACKET_allocate_bytes(pkt, enclen, &encdata)\n            || EVP_PKEY_encrypt(pctx, encdata, &enclen, pms, pmslen) <= 0) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, SSL_R_BAD_RSA_ENCRYPT);\n        goto err;\n    }\n    EVP_PKEY_CTX_free(pctx);\n    pctx = NULL;\n# ifdef PKCS1_CHECK\n    if (s->options & SSL_OP_PKCS1_CHECK_1)\n        (*p)[1]++;\n    if (s->options & SSL_OP_PKCS1_CHECK_2)\n        tmp_buf[0] = 0x70;\n# endif\n    if (s->version > SSL3_VERSION && !WPACKET_close(pkt)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    s->s3->tmp.pms = pms;\n    s->s3->tmp.pmslen = pmslen;\n    if (!ssl_log_rsa_client_key_exchange(s, encdata, enclen, pms, pmslen))\n        goto err;\n    return 1;\n err:\n    OPENSSL_clear_free(pms, pmslen);\n    EVP_PKEY_CTX_free(pctx);\n    return 0;\n#else\n    SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, ERR_R_INTERNAL_ERROR);\n    *al = SSL_AD_INTERNAL_ERROR;\n    return 0;\n#endif\n}', 'int ssl_log_rsa_client_key_exchange(SSL *ssl,\n                                    const uint8_t *encrypted_premaster,\n                                    size_t encrypted_premaster_len,\n                                    const uint8_t *premaster,\n                                    size_t premaster_len)\n{\n    if (encrypted_premaster_len < 8) {\n        SSLerr(SSL_F_SSL_LOG_RSA_CLIENT_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);\n        return 0;\n    }\n    return nss_keylog_int("RSA",\n                          ssl,\n                          encrypted_premaster,\n                          8,\n                          premaster,\n                          premaster_len);\n}', 'static int nss_keylog_int(const char *prefix,\n                          SSL *ssl,\n                          const uint8_t *parameter_1,\n                          size_t parameter_1_len,\n                          const uint8_t *parameter_2,\n                          size_t parameter_2_len)\n{\n    char *out = NULL;\n    char *cursor = NULL;\n    size_t out_len = 0;\n    size_t i;\n    size_t prefix_len;\n    if (ssl->ctx->keylog_callback == NULL) return 1;\n    prefix_len = strlen(prefix);\n    out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;\n    if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {\n        SSLerr(SSL_F_NSS_KEYLOG_INT, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    strcpy(cursor, prefix);\n    cursor += prefix_len;\n    *cursor++ = \' \';\n    for (i = 0; i < parameter_1_len; i++) {\n        sprintf(cursor, "%02x", parameter_1[i]);\n        cursor += 2;\n    }\n    *cursor++ = \' \';\n    for (i = 0; i < parameter_2_len; i++) {\n        sprintf(cursor, "%02x", parameter_2[i]);\n        cursor += 2;\n    }\n    *cursor = \'\\0\';\n    ssl->ctx->keylog_callback(ssl, (const char *)out);\n    OPENSSL_free(out);\n    return 1;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    osslargused(file); osslargused(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}']