ssl/statem/statem_lib.c:256: error: BUFFER_OVERRUN_S2
  Offset: [`s->method->ssl3_enc->hhlen` + 3, +oo] Size: [1, 2147483644] by call to `ssl_add_cert_chain`.
Showing all 12 steps of the trace


ssl/statem/statem_lib.c:251:1: Parameter `s->method->ssl3_enc->hhlen`
249.   }
250.   
251. > unsigned long ssl3_output_cert_chain(SSL *s, CERT_PKEY *cpk)
252.   {
253.       unsigned char *p;

ssl/statem/statem_lib.c:254:5: Assignment
252.   {
253.       unsigned char *p;
254.       unsigned long l = 3 + SSL_HM_HEADER_LENGTH(s);
           ^
255.   
256.       if (!ssl_add_cert_chain(s, cpk, &l))

ssl/statem/statem_lib.c:256:10: Call
254.       unsigned long l = 3 + SSL_HM_HEADER_LENGTH(s);
255.   
256.       if (!ssl_add_cert_chain(s, cpk, &l))
                ^
257.           return 0;
258.   

ssl/ssl_cert.c:771:1: Parameter `*l`
  769.   
  770.   /* Add certificate chain to internal SSL BUF_MEM structure */
  771. > int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l)
  772.   {
  773.       BUF_MEM *buf = s->init_buf;

ssl/ssl_cert.c:844:18: Call
  842.               x = sk_X509_value(chain, i);
  843.   
  844.               if (!ssl_add_cert_to_buf(buf, l, x)) {
                          ^
  845.                   X509_STORE_CTX_free(xs_ctx);
  846.                   return 0;

ssl/ssl_cert.c:747:1: <Offset trace>
745.   /* Add a certificate to a BUF_MEM structure */
746.   
747. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
748.   {
749.       int n;

ssl/ssl_cert.c:747:1: Parameter `*l`
    745.   /* Add a certificate to a BUF_MEM structure */
    746.   
    747. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
    748.   {
    749.       int n;

ssl/ssl_cert.c:747:1: <Length trace>
745.   /* Add a certificate to a BUF_MEM structure */
746.   
747. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
748.   {
749.       int n;

ssl/ssl_cert.c:747:1: Parameter `*buf->data`
    745.   /* Add a certificate to a BUF_MEM structure */
    746.   
    747. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
    748.   {
    749.       int n;

ssl/ssl_cert.c:753:19: Call
    751.   
    752.       n = i2d_X509(x, NULL);
    753.       if (n < 0 || !BUF_MEM_grow_clean(buf, (int)(n + (*l) + 3))) {
                             ^
    754.           SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);
    755.           return 0;

crypto/buffer/buffer.c:109:1: Parameter `*str->data`
      107.   }
      108.   
      109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
      110.   {
      111.       char *ret;

ssl/ssl_cert.c:757:5: Array access: Offset: [s->method->ssl3_enc->hhlen + 3, +oo] Size: [1, 2147483644] by call to `ssl_add_cert_chain` 
    755.           return 0;
    756.       }
    757.       p = (unsigned char *)&(buf->data[*l]);
               ^
    758.       l2n3(n, p);
    759.       n = i2d_X509(x, &p);
