ssl/statem/statem_dtls.c:373: error: BUFFER_OVERRUN_L3
  Offset: 11 (⇐ 9 + 2) Size: [1, 2147483644].
Showing all 11 steps of the trace


ssl/statem/statem_dtls.c:341:10: <Length trace>
339.   
340.    again:
341.       if (!dtls_get_reassembled_message(s, &errtype, &tmplen)) {
                ^
342.           if (errtype == DTLS1_HM_BAD_FRAGMENT
343.                   || errtype == DTLS1_HM_FRAGMENT_RETRY) {

ssl/statem/statem_dtls.c:341:10: Call
339.   
340.    again:
341.       if (!dtls_get_reassembled_message(s, &errtype, &tmplen)) {
                ^
342.           if (errtype == DTLS1_HM_BAD_FRAGMENT
343.                   || errtype == DTLS1_HM_FRAGMENT_RETRY) {

ssl/statem/statem_dtls.c:726:1: Parameter `*s->init_buf->data`
  724.   }
  725.   
  726. > static int dtls_get_reassembled_message(SSL *s, int *errtype, size_t *len)
  727.   {
  728.       unsigned char wire[DTLS1_HM_HEADER_LENGTH];

ssl/statem/statem_dtls.c:738:11: Call
  736.    redo:
  737.       /* see if we have the required fragment already */
  738.       ret = dtls1_retrieve_buffered_fragment(s, &frag_len);
                   ^
  739.       if (ret < 0) {
  740.           /* SSLfatal() already called */

ssl/statem/statem_dtls.c:456:1: Parameter `*s->init_buf->data`
    454.    * fatal error.
    455.    */
    456. > static int dtls1_retrieve_buffered_fragment(SSL *s, size_t *len)
    457.   {
    458.       /*-

ssl/statem/statem_dtls.c:352:5: Assignment
350.       *mt = s->s3->tmp.message_type;
351.   
352.       p = (unsigned char *)s->init_buf->data;
           ^
353.       *len = s->init_num;
354.   

ssl/statem/statem_dtls.c:369:7: Assignment
367.   
368.       /* reconstruct message header */
369.       *(p++) = msg_hdr->type;
             ^
370.       l2n3(msg_len, p);
371.       s2n(msg_hdr->seq, p);

ssl/statem/statem_dtls.c:370:5: Assignment
368.       /* reconstruct message header */
369.       *(p++) = msg_hdr->type;
370.       l2n3(msg_len, p);
           ^
371.       s2n(msg_hdr->seq, p);
372.       l2n3(0, p);

ssl/statem/statem_dtls.c:371:5: Assignment
369.       *(p++) = msg_hdr->type;
370.       l2n3(msg_len, p);
371.       s2n(msg_hdr->seq, p);
           ^
372.       l2n3(0, p);
373.       l2n3(msg_len, p);

ssl/statem/statem_dtls.c:372:5: Assignment
370.       l2n3(msg_len, p);
371.       s2n(msg_hdr->seq, p);
372.       l2n3(0, p);
           ^
373.       l2n3(msg_len, p);
374.       if (s->version != DTLS1_BAD_VER) {

ssl/statem/statem_dtls.c:373:5: Array access: Offset: 11 (⇐ 9 + 2) Size: [1, 2147483644]
371.       s2n(msg_hdr->seq, p);
372.       l2n3(0, p);
373.       l2n3(msg_len, p);
           ^
374.       if (s->version != DTLS1_BAD_VER) {
375.           p -= DTLS1_HM_HEADER_LENGTH;
