ssl/statem/extensions_srvr.c:890: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: 29 by call to `tls_curve_allowed`.
Showing all 8 steps of the trace


ssl/statem/extensions_srvr.c:900:22: Call
898.   
899.                   /* Add extension header */
900.                   if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_supported_groups)
                            ^
901.                              /* Sub-packet for supported_groups extension */
902.                           || !WPACKET_start_sub_packet_u16(pkt)

ssl/packet.c:312:1: Parameter `*pkt->buf->data`
  310.   }
  311.   
  312. > int WPACKET_put_bytes__(WPACKET *pkt, unsigned int val, size_t size)
  313.   {
  314.       unsigned char *data;

ssl/statem/extensions_srvr.c:890:13: Call
888.       /* Copy group ID if supported */
889.       for (i = 0; i < numgroups; i++, groups += 2) {
890.           if (tls_curve_allowed(s, groups, SSL_SECOP_CURVE_SUPPORTED)) {
                   ^
891.               if (first) {
892.                   /*

ssl/t1_lib.c:268:1: <Offset trace>
266.   
267.   /* See if curve is allowed by security callback */
268. > int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
269.   {
270.       const tls_curve_info *cinfo;

ssl/t1_lib.c:268:1: Parameter `*curve`
  266.   
  267.   /* See if curve is allowed by security callback */
  268. > int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
  269.   {
  270.       const tls_curve_info *cinfo;

ssl/t1_lib.c:137:1: <Length trace>
135.    * table: the index of each entry is one less than the TLS curve id.
136.    */
137. > static const tls_curve_info nid_list[] = {
138.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
139.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:137:1: Array declaration
  135.    * table: the index of each entry is one less than the TLS curve id.
  136.    */
  137. > static const tls_curve_info nid_list[] = {
  138.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
  139.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:275:5: Array access: Offset: [-1, +oo] Size: 29 by call to `tls_curve_allowed` 
  273.       if ((curve[1] < 1) || ((size_t)curve[1] > OSSL_NELEM(nid_list)))
  274.           return 0;
  275.       cinfo = &nid_list[curve[1] - 1];
             ^
  276.   # ifdef OPENSSL_NO_EC2M
  277.       if (cinfo->flags & TLS_CURVE_CHAR2)
