ssl/statem/statem_clnt.c:2538: error: BUFFER_OVERRUN_L3
  Offset: 3 Size: [1, 118] by call to `ssl_log_rsa_client_key_exchange`.
Showing all 13 steps of the trace


ssl/statem/statem_clnt.c:2488:5: Assignment
2486.       }
2487.   
2488.       pmslen = SSL_MAX_MASTER_KEY_LENGTH;
            ^
2489.       pms = OPENSSL_malloc(pmslen);
2490.       if (pms == NULL) {

ssl/statem/statem_clnt.c:2538:10: Call
2536.   
2537.       /* Log the premaster secret, if logging is enabled. */
2538.       if (!ssl_log_rsa_client_key_exchange(s, encdata, enclen, pms, pmslen))
                 ^
2539.           goto err;
2540.   

ssl/ssl_lib.c:4410:1: Parameter `premaster_len`
  4408.   }
  4409.   
  4410. > int ssl_log_rsa_client_key_exchange(SSL *ssl,
  4411.                                       const uint8_t *encrypted_premaster,
  4412.                                       size_t encrypted_premaster_len,

ssl/ssl_lib.c:4422:12: Call
  4420.   
  4421.       /* We only want the first 8 bytes of the encrypted premaster as a tag. */
  4422.       return nss_keylog_int("RSA",
                     ^
  4423.                             ssl,
  4424.                             encrypted_premaster,

ssl/ssl_lib.c:4358:1: <Offset trace>
4356.   }
4357.   
4358. > static int nss_keylog_int(const char *prefix,
4359.                             SSL *ssl,
4360.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4358:1: Parameter `prefix->strlen`
    4356.   }
    4357.   
    4358. > static int nss_keylog_int(const char *prefix,
    4359.                             SSL *ssl,
    4360.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4358:1: <Length trace>
4356.   }
4357.   
4358. > static int nss_keylog_int(const char *prefix,
4359.                             SSL *ssl,
4360.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4358:1: Parameter `parameter_2_len`
    4356.   }
    4357.   
    4358. > static int nss_keylog_int(const char *prefix,
    4359.                             SSL *ssl,
    4360.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4382:5: Assignment
    4380.        */
    4381.       prefix_len = strlen(prefix);
    4382.       out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;
                ^
    4383.       if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
    4384.           SSLerr(SSL_F_NSS_KEYLOG_INT, ERR_R_MALLOC_FAILURE);

ssl/ssl_lib.c:4383:25: Call
    4381.       prefix_len = strlen(prefix);
    4382.       out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;
    4383.       if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
                                    ^
    4384.           SSLerr(SSL_F_NSS_KEYLOG_INT, ERR_R_MALLOC_FAILURE);
    4385.           return 0;

crypto/mem.c:166:9: Assignment
      164.   
      165.       if (num <= 0)
      166.           return NULL;
                     ^
      167.   
      168.       FAILTEST();

ssl/ssl_lib.c:4383:16: Assignment
    4381.       prefix_len = strlen(prefix);
    4382.       out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;
    4383.       if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {
                           ^
    4384.           SSLerr(SSL_F_NSS_KEYLOG_INT, ERR_R_MALLOC_FAILURE);
    4385.           return 0;

ssl/ssl_lib.c:4388:5: Array access: Offset: 3 Size: [1, 118] by call to `ssl_log_rsa_client_key_exchange` 
    4386.       }
    4387.   
    4388.       strcpy(cursor, prefix);
                ^
    4389.       cursor += prefix_len;
    4390.       *cursor++ = ' ';
