ssl/s3_cbc.c:439: error: BUFFER_OVERRUN_L2
  Offset: [-72, 79] Size: 16.
Showing all 5 steps of the trace


ssl/s3_cbc.c:145:5: <Offset trace>
143.       void (*md_final_raw) (void *ctx, unsigned char *md_out);
144.       void (*md_transform) (void *ctx, const unsigned char *block);
145.       size_t md_size, md_block_size = 64;
           ^
146.       size_t sslv3_pad_length = 40, header_length, variance_blocks,
147.           len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:145:5: Assignment
143.       void (*md_final_raw) (void *ctx, unsigned char *md_out);
144.       void (*md_transform) (void *ctx, const unsigned char *block);
145.       size_t md_size, md_block_size = 64;
           ^
146.       size_t sslv3_pad_length = 40, header_length, variance_blocks,
147.           len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:129:1: <Length trace>
127.    * Returns 1 on success or 0 on error
128.    */
129. > int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
130.                              unsigned char *md_out,
131.                              size_t *md_out_size,

ssl/s3_cbc.c:129:1: Array declaration
127.    * Returns 1 on success or 0 on error
128.    */
129. > int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
130.                              unsigned char *md_out,
131.                              size_t *md_out_size,

ssl/s3_cbc.c:439:44: Array access: Offset: [-72, 79] Size: 16
437.                   /* If this is index_b, write a length byte. */
438.                   b = constant_time_select_8(is_block_b,
439.                                              length_bytes[j -
                                                  ^
440.                                                           (md_block_size -
441.                                                            md_length_size)], b);
