ssl/record/ssl3_record.c:1038: error: BUFFER_OVERRUN_L2
  Offset added: [71-min(70, `ssl->s3->read_mac_secret_size`), `ssl->s3->read_mac_secret_size` + 123] (⇐ [64, 128] + [7-min(70, `ssl->s3->read_mac_secret_size`), `ssl->s3->read_mac_secret_size` - 5]) Size: 104 by call to `ssl3_cbc_digest_record`.
Showing all 8 steps of the trace


ssl/record/ssl3_record.c:978:1: Array declaration
976.   }
977.   
978. > int tls1_mac(SSL *ssl, SSL3_RECORD *rec, unsigned char *md, int send)
979.   {
980.       unsigned char *seq;

ssl/record/ssl3_record.c:1038:13: Call
1036.            */
1037.           /* Final param == not SSLv3 */
1038.           if (ssl3_cbc_digest_record(mac_ctx,
                    ^
1039.                                      md, &md_size,
1040.                                      header, rec->input,

ssl/s3_cbc.c:145:5: <Offset trace>
143.       void (*md_final_raw) (void *ctx, unsigned char *md_out);
144.       void (*md_transform) (void *ctx, const unsigned char *block);
145.       size_t md_size, md_block_size = 64;
           ^
146.       size_t sslv3_pad_length = 40, header_length, variance_blocks,
147.           len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:145:5: Assignment
  143.       void (*md_final_raw) (void *ctx, unsigned char *md_out);
  144.       void (*md_transform) (void *ctx, const unsigned char *block);
  145.       size_t md_size, md_block_size = 64;
             ^
  146.       size_t sslv3_pad_length = 40, header_length, variance_blocks,
  147.           len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:375:13: Assignment
  373.                   return 0;
  374.               }
  375.               overhang = header_length - md_block_size;
                     ^
  376.               md_transform(md_state.c, header);
  377.               memcpy(first_block, header + md_block_size, overhang);

ssl/s3_cbc.c:129:1: <Length trace>
127.    * Returns 1 on success or 0 on error
128.    */
129. > int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
130.                              unsigned char *md_out,
131.                              size_t *md_out_size,

ssl/s3_cbc.c:129:1: Parameter `*header`
  127.    * Returns 1 on success or 0 on error
  128.    */
  129. > int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
  130.                              unsigned char *md_out,
  131.                              size_t *md_out_size,

ssl/s3_cbc.c:377:13: Array access: Offset added: [71-min(70, ssl->s3->read_mac_secret_size), ssl->s3->read_mac_secret_size + 123] (⇐ [64, 128] + [7-min(70, ssl->s3->read_mac_secret_size), ssl->s3->read_mac_secret_size - 5]) Size: 104 by call to `ssl3_cbc_digest_record` 
  375.               overhang = header_length - md_block_size;
  376.               md_transform(md_state.c, header);
  377.               memcpy(first_block, header + md_block_size, overhang);
                     ^
  378.               memcpy(first_block + overhang, data, md_block_size - overhang);
  379.               md_transform(md_state.c, first_block);
