ssl/d1_pkt.c:551: error: BUFFER_OVERRUN_L3
  Offset added: [5, +oo] Size: [0, +oo] by call to `ssl3_read_n`.
Showing all 8 steps of the trace


ssl/d1_pkt.c:522:1: Parameter `s->s3->rbuf.left`
520.    */
521.   /* used only by dtls1_read_bytes */
522. > int dtls1_get_record(SSL *s)
523.   	{
524.   	int ssl_major,ssl_minor,al;

ssl/d1_pkt.c:551:5: Call
549.   		(s->packet_length < DTLS1_RT_HEADER_LENGTH)) 
550.   		{
551.   		n=ssl3_read_n(s, DTLS1_RT_HEADER_LENGTH, s->s3->rbuf.len, 0);
           ^
552.   		/* read timeout is handled by dtls1_read_bytes */
553.   		if (n <= 0) return(n); /* error or non-blocking */

ssl/s3_pkt.c:123:1: <Offset trace>
121.   static int ssl3_get_record(SSL *s);
122.   
123. > int ssl3_read_n(SSL *s, int n, int max, int extend)
124.   	{
125.   	/* If extend == 0, obtain new n-byte packet; if extend == 1, increase

ssl/s3_pkt.c:123:1: Parameter `s->s3->rbuf.left`
  121.   static int ssl3_get_record(SSL *s);
  122.   
  123. > int ssl3_read_n(SSL *s, int n, int max, int extend)
  124.   	{
  125.   	/* If extend == 0, obtain new n-byte packet; if extend == 1, increase

ssl/s3_pkt.c:140:2: Assignment
  138.   
  139.   	rb    = &(s->s3->rbuf);
  140.   	left  = rb->left;
          ^
  141.   #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
  142.   	align = (long)rb->buf + SSL3_RT_HEADER_LENGTH;

ssl/s3_pkt.c:123:1: <Length trace>
121.   static int ssl3_get_record(SSL *s);
122.   
123. > int ssl3_read_n(SSL *s, int n, int max, int extend)
124.   	{
125.   	/* If extend == 0, obtain new n-byte packet; if extend == 1, increase

ssl/s3_pkt.c:123:1: Parameter `*s->s3->rbuf.buf`
  121.   static int ssl3_get_record(SSL *s);
  122.   
  123. > int ssl3_read_n(SSL *s, int n, int max, int extend)
  124.   	{
  125.   	/* If extend == 0, obtain new n-byte packet; if extend == 1, increase

ssl/s3_pkt.c:166:5: Array access: Offset added: [5, +oo] Size: [0, +oo] by call to `ssl3_read_n` 
  164.   				 * arguments and therefore no buffer
  165.   				 * overrun can be triggered. */
  166.   				memmove (rb->buf+align,pkt,left);
             ^
  167.   				rb->offset = align;
  168.   				}
