ssl/record/ssl3_record.c:1272: error: BUFFER_OVERRUN_L3
  Offset added: [-63, +oo] Size: 128 by call to `ssl3_cbc_digest_record`.
Showing all 11 steps of the trace


ssl/record/ssl3_record.c:1236:9: Call
1234.       }
1235.   
1236.       t = EVP_MD_CTX_size(hash);
                ^
1237.       if (t < 0)
1238.           return 0;

crypto/evp/evp_lib.c:509:9: Assignment
  507.       if (md == NULL) {
  508.           EVPerr(EVP_F_EVP_MD_SIZE, EVP_R_MESSAGE_DIGEST_IS_NULL);
  509.           return -1;
                 ^
  510.       }
  511.   

ssl/record/ssl3_record.c:1236:5: Assignment
1234.       }
1235.   
1236.       t = EVP_MD_CTX_size(hash);
            ^
1237.       if (t < 0)
1238.           return 0;

ssl/record/ssl3_record.c:1239:5: Assignment
1237.       if (t < 0)
1238.           return 0;
1239.       md_size = t;
            ^
1240.       npad = (48 / md_size) * md_size;
1241.   

ssl/record/ssl3_record.c:1272:13: Call
1270.   
1271.           /* Final param == is SSLv3 */
1272.           if (ssl3_cbc_digest_record(hash,
                    ^
1273.                                      md, &md_size,
1274.                                      header, rec->input,

ssl/s3_cbc.c:144:5: <Offset trace>
142.       void (*md_final_raw) (void *ctx, unsigned char *md_out);
143.       void (*md_transform) (void *ctx, const unsigned char *block);
144.       size_t md_size, md_block_size = 64;
           ^
145.       size_t sslv3_pad_length = 40, header_length, variance_blocks,
146.           len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:144:5: Assignment
  142.       void (*md_final_raw) (void *ctx, unsigned char *md_out);
  143.       void (*md_transform) (void *ctx, const unsigned char *block);
  144.       size_t md_size, md_block_size = 64;
             ^
  145.       size_t sslv3_pad_length = 40, header_length, variance_blocks,
  146.           len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:377:13: Assignment
  375.                   return 0;
  376.               }
  377.               overhang = header_length - md_block_size;
                     ^
  378.               md_transform(md_state.c, header);
  379.               memcpy(first_block, header + md_block_size, overhang);

ssl/s3_cbc.c:128:1: <Length trace>
126.    * Returns 1 on success or 0 on error
127.    */
128. > int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
129.                              unsigned char *md_out,
130.                              size_t *md_out_size,

ssl/s3_cbc.c:128:1: Array declaration
  126.    * Returns 1 on success or 0 on error
  127.    */
  128. > int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
  129.                              unsigned char *md_out,
  130.                              size_t *md_out_size,

ssl/s3_cbc.c:379:13: Array access: Offset added: [-63, +oo] Size: 128 by call to `ssl3_cbc_digest_record` 
  377.               overhang = header_length - md_block_size;
  378.               md_transform(md_state.c, header);
  379.               memcpy(first_block, header + md_block_size, overhang);
                     ^
  380.               memcpy(first_block + overhang, data, md_block_size - overhang);
  381.               md_transform(md_state.c, first_block);
