ssl/d1_clnt.c:424: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: 28 by call to `ssl3_get_key_exchange`.
Showing all 11 steps of the trace


ssl/d1_clnt.c:162:1: Parameter `*s->init_msg`
160.                             dtls1_get_client_method, DTLSv1_2_enc_data)
161.   
162. > int dtls1_connect(SSL *s)
163.   {
164.       BUF_MEM *buf = NULL;

ssl/d1_clnt.c:424:19: Call
422.           case SSL3_ST_CR_KEY_EXCH_A:
423.           case SSL3_ST_CR_KEY_EXCH_B:
424.               ret = ssl3_get_key_exchange(s);
                         ^
425.               if (ret <= 0)
426.                   goto end;

ssl/s3_clnt.c:1318:1: Parameter `*s->init_msg`
  1316.   }
  1317.   
  1318. > int ssl3_get_key_exchange(SSL *s)
  1319.   {
  1320.   #ifndef OPENSSL_NO_RSA

ssl/s3_clnt.c:1768:14: Call
  1766.            * invalid curve. ECParameters is 3 bytes.
  1767.            */
  1768.           if (!tls1_check_curve(s, p, 3)) {
                       ^
  1769.               SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_WRONG_CURVE);
  1770.               goto f_err;

ssl/t1_lib.c:273:1: Array declaration
    271.   };
    272.   
    273. > static const unsigned char eccurves_default[] = {
    274.       0, 14,                      /* sect571r1 (14) */
    275.       0, 13,                      /* sect571k1 (13) */

ssl/t1_lib.c:484:20: Call
    482.       for (i = 0; i < num_curves; i++, curves += 2) {
    483.           if (p[1] == curves[0] && p[2] == curves[1])
    484.               return tls_curve_allowed(s, p + 1, SSL_SECOP_CURVE_CHECK);
                              ^
    485.       }
    486.       return 0;

ssl/t1_lib.c:442:1: <Offset trace>
440.   
441.   /* See if curve is allowed by security callback */
442. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
443.   {
444.       const tls_curve_info *cinfo;

ssl/t1_lib.c:442:1: Parameter `*curve`
      440.   
      441.   /* See if curve is allowed by security callback */
      442. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
      443.   {
      444.       const tls_curve_info *cinfo;

ssl/t1_lib.c:236:1: <Length trace>
234.   # define TLS_CURVE_PRIME         0x0
235.   
236. > static const tls_curve_info nid_list[] = {
237.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
238.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:236:1: Array declaration
      234.   # define TLS_CURVE_PRIME         0x0
      235.   
      236. > static const tls_curve_info nid_list[] = {
      237.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
      238.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:450:5: Array access: Offset: [-1, +oo] Size: 28 by call to `ssl3_get_key_exchange` 
      448.                              sizeof(nid_list) / sizeof(nid_list[0])))
      449.           return 0;
      450.       cinfo = &nid_list[curve[1] - 1];
                 ^
      451.   # ifdef OPENSSL_NO_EC2M
      452.       if (cinfo->flags & TLS_CURVE_CHAR2)
