test/sslapitest.c:4189: error: BUFFER_OVERRUN_L3
  Offset added: [56, +oo] (⇐ [0, +oo] + 56) Size: [1, +oo] by call to `SSL_CTX_add_custom_ext`.
Showing all 21 steps of the trace


test/sslapitest.c:4158:14: Call
4156.       /* Create a client side custom extension */
4157.       if (tst == 0) {
4158.           if (!TEST_true(SSL_CTX_add_client_custom_ext(cctx, TEST_EXT_TYPE1,
                     ^
4159.                                                        old_add_cb, old_free_cb,
4160.                                                        &client, old_parse_cb,

ssl/statem/extensions_cust.c:450:1: Parameter `ctx->cert->custext.meths_count`
  448.   
  449.   /* Application level functions to add the old custom extension callbacks */
  450. > int SSL_CTX_add_client_custom_ext(SSL_CTX *ctx, unsigned int ext_type,
  451.                                     custom_ext_add_cb add_cb,
  452.                                     custom_ext_free_cb free_cb,

ssl/statem/extensions_cust.c:456:12: Call
  454.                                     custom_ext_parse_cb parse_cb, void *parse_arg)
  455.   {
  456.       return add_old_custom_ext(ctx, ENDPOINT_CLIENT, ext_type,
                    ^
  457.                                 SSL_EXT_TLS1_2_AND_BELOW_ONLY
  458.                                 | SSL_EXT_CLIENT_HELLO

ssl/statem/extensions_cust.c:407:1: Parameter `ctx->cert->custext.meths_count`
    405.   }
    406.   
    407. > static int add_old_custom_ext(SSL_CTX *ctx, ENDPOINT role,
    408.                                 unsigned int ext_type,
    409.                                 unsigned int context,

test/sslapitest.c:4171:10: Call
4169.   
4170.       /* Should not be able to add duplicates */
4171.       if (!TEST_false(SSL_CTX_add_client_custom_ext(cctx, TEST_EXT_TYPE1,
                 ^
4172.                                                     old_add_cb, old_free_cb,
4173.                                                     &client, old_parse_cb,

ssl/statem/extensions_cust.c:450:1: Parameter `ctx->cert->custext.meths_count`
  448.   
  449.   /* Application level functions to add the old custom extension callbacks */
  450. > int SSL_CTX_add_client_custom_ext(SSL_CTX *ctx, unsigned int ext_type,
  451.                                     custom_ext_add_cb add_cb,
  452.                                     custom_ext_free_cb free_cb,

ssl/statem/extensions_cust.c:456:12: Call
  454.                                     custom_ext_parse_cb parse_cb, void *parse_arg)
  455.   {
  456.       return add_old_custom_ext(ctx, ENDPOINT_CLIENT, ext_type,
                    ^
  457.                                 SSL_EXT_TLS1_2_AND_BELOW_ONLY
  458.                                 | SSL_EXT_CLIENT_HELLO

ssl/statem/extensions_cust.c:407:1: Parameter `ctx->cert->custext.meths_count`
    405.   }
    406.   
    407. > static int add_old_custom_ext(SSL_CTX *ctx, ENDPOINT role,
    408.                                 unsigned int ext_type,
    409.                                 unsigned int context,

test/sslapitest.c:4175:17: Call
4173.                                                     &client, old_parse_cb,
4174.                                                     &client))
4175.               || !TEST_false(SSL_CTX_add_custom_ext(cctx, TEST_EXT_TYPE1,
                        ^
4176.                                                     context, new_add_cb,
4177.                                                     new_free_cb, &client,

ssl/statem/extensions_cust.c:478:1: Parameter `ctx->cert->custext.meths_count`
  476.   }
  477.   
  478. > int SSL_CTX_add_custom_ext(SSL_CTX *ctx, unsigned int ext_type,
  479.                              unsigned int context,
  480.                              SSL_custom_ext_add_cb_ex add_cb,

ssl/statem/extensions_cust.c:485:12: Call
  483.                              SSL_custom_ext_parse_cb_ex parse_cb, void *parse_arg)
  484.   {
  485.       return add_custom_ext_intern(ctx, ENDPOINT_BOTH, ext_type, context, add_cb,
                    ^
  486.                                    free_cb, add_arg, parse_cb, parse_arg);
  487.   }

ssl/statem/extensions_cust.c:342:1: Parameter `ctx->cert->custext.meths_count`
    340.   }
    341.   
    342. > static int add_custom_ext_intern(SSL_CTX *ctx, ENDPOINT role,
    343.                                    unsigned int ext_type,
    344.                                    unsigned int context,

test/sslapitest.c:4189:14: Call
4187.               goto end;
4188.       } else {
4189.           if (!TEST_true(SSL_CTX_add_custom_ext(sctx, TEST_EXT_TYPE1, context,
                     ^
4190.                                                 new_add_cb, new_free_cb,
4191.                                                 &server, new_parse_cb, &server)))

ssl/statem/extensions_cust.c:478:1: Parameter `ctx->cert->custext.meths_count`
  476.   }
  477.   
  478. > int SSL_CTX_add_custom_ext(SSL_CTX *ctx, unsigned int ext_type,
  479.                              unsigned int context,
  480.                              SSL_custom_ext_add_cb_ex add_cb,

ssl/statem/extensions_cust.c:485:12: Call
  483.                              SSL_custom_ext_parse_cb_ex parse_cb, void *parse_arg)
  484.   {
  485.       return add_custom_ext_intern(ctx, ENDPOINT_BOTH, ext_type, context, add_cb,
                    ^
  486.                                    free_cb, add_arg, parse_cb, parse_arg);
  487.   }

ssl/statem/extensions_cust.c:342:1: <Length trace>
340.   }
341.   
342. > static int add_custom_ext_intern(SSL_CTX *ctx, ENDPOINT role,
343.                                    unsigned int ext_type,
344.                                    unsigned int context,

ssl/statem/extensions_cust.c:342:1: Parameter `ctx->cert->custext.meths_count`
    340.   }
    341.   
    342. > static int add_custom_ext_intern(SSL_CTX *ctx, ENDPOINT role,
    343.                                    unsigned int ext_type,
    344.                                    unsigned int context,

ssl/statem/extensions_cust.c:385:9: Call
    383.           return 0;
    384.       /* Search for duplicate */
    385.       if (custom_ext_find(exts, role, ext_type, NULL))
                   ^
    386.           return 0;
    387.       tmp = OPENSSL_realloc(exts->meths,

ssl/statem/extensions_cust.c:81:1: Parameter `exts->meths_count`
      79.    * client, or ENDPOINT_BOTH for either
      80.    */
      81. > custom_ext_method *custom_ext_find(const custom_ext_methods *exts,
      82.                                      ENDPOINT role, unsigned int ext_type,
      83.                                      size_t *idx)

ssl/statem/extensions_cust.c:393:5: Assignment
    391.   
    392.       exts->meths = tmp;
    393.       meth = exts->meths + exts->meths_count;
               ^
    394.       memset(meth, 0, sizeof(*meth));
    395.       meth->role = role;

ssl/statem/extensions_cust.c:394:5: Array access: Offset added: [56, +oo] (⇐ [0, +oo] + 56) Size: [1, +oo] by call to `SSL_CTX_add_custom_ext` 
    392.       exts->meths = tmp;
    393.       meth = exts->meths + exts->meths_count;
    394.       memset(meth, 0, sizeof(*meth));
               ^
    395.       meth->role = role;
    396.       meth->context = context;
