ssl/statem/extensions.c:1136: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: 29 by call to `check_in_list`.
Showing all 9 steps of the trace


ssl/t1_lib.c:176:1: Array declaration
174.   
175.   /* The default curves */
176. > static const unsigned char eccurves_default[] = {
177.       0, 29,                      /* X25519 (29) */
178.       0, 23,                      /* secp256r1 (23) */

ssl/statem/extensions.c:1136:21: Call
1134.                   group_id = bytestogroup(pcurvestmp);
1135.   
1136.                   if (check_in_list(s, group_id, clntcurves, clnt_num_curves, 1))
                            ^
1137.                       break;
1138.               }

ssl/statem/statem_lib.c:1951:1: Parameter `*groups`
  1949.    */
  1950.   #ifndef OPENSSL_NO_EC
  1951. > int check_in_list(SSL *s, unsigned int group_id, const unsigned char *groups,
  1952.                     size_t num_groups, int checkallow)
  1953.   {

ssl/statem/statem_lib.c:1962:24: Call
  1960.           if (group_id == GET_GROUP_ID(groups, 0)
  1961.                   && (!checkallow
  1962.                       || tls_curve_allowed(s, groups, SSL_SECOP_CURVE_CHECK))) {
                                 ^
  1963.               return 1;
  1964.           }

ssl/t1_lib.c:268:1: <Offset trace>
266.   
267.   /* See if curve is allowed by security callback */
268. > int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
269.   {
270.       const tls_curve_info *cinfo;

ssl/t1_lib.c:268:1: Parameter `*curve`
    266.   
    267.   /* See if curve is allowed by security callback */
    268. > int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
    269.   {
    270.       const tls_curve_info *cinfo;

ssl/t1_lib.c:137:1: <Length trace>
135.    * table: the index of each entry is one less than the TLS curve id.
136.    */
137. > static const tls_curve_info nid_list[] = {
138.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
139.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:137:1: Array declaration
    135.    * table: the index of each entry is one less than the TLS curve id.
    136.    */
    137. > static const tls_curve_info nid_list[] = {
    138.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
    139.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:275:5: Array access: Offset: [-1, +oo] Size: 29 by call to `check_in_list` 
    273.       if ((curve[1] < 1) || ((size_t)curve[1] > OSSL_NELEM(nid_list)))
    274.           return 0;
    275.       cinfo = &nid_list[curve[1] - 1];
               ^
    276.   # ifdef OPENSSL_NO_EC2M
    277.       if (cinfo->flags & TLS_CURVE_CHAR2)
