ssl/statem/statem_clnt.c:2867: error: BUFFER_OVERRUN_L3
  Offset: [4, +oo] Size: [1, 118] by call to `ssl_log_rsa_client_key_exchange`.
Showing all 10 steps of the trace


ssl/statem/statem_clnt.c:2820:5: Assignment
2818.       }
2819.   
2820.       pmslen = SSL_MAX_MASTER_KEY_LENGTH;
            ^
2821.       pms = OPENSSL_malloc(pmslen);
2822.       if (pms == NULL) {

ssl/statem/statem_clnt.c:2867:10: Call
2865.   
2866.       /* Log the premaster secret, if logging is enabled. */
2867.       if (!ssl_log_rsa_client_key_exchange(s, encdata, enclen, pms, pmslen)) {
                 ^
2868.           /* SSLfatal() already called */
2869.           goto err;

ssl/ssl_lib.c:4940:1: Parameter `premaster_len`
  4938.   }
  4939.   
  4940. > int ssl_log_rsa_client_key_exchange(SSL *ssl,
  4941.                                       const uint8_t *encrypted_premaster,
  4942.                                       size_t encrypted_premaster_len,

ssl/ssl_lib.c:4953:12: Call
  4951.   
  4952.       /* We only want the first 8 bytes of the encrypted premaster as a tag. */
  4953.       return nss_keylog_int("RSA",
                     ^
  4954.                             ssl,
  4955.                             encrypted_premaster,

ssl/ssl_lib.c:4887:1: <Length trace>
4885.   }
4886.   
4887. > static int nss_keylog_int(const char *prefix,
4888.                             SSL *ssl,
4889.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4887:1: Parameter `prefix->strlen`
    4885.   }
    4886.   
    4887. > static int nss_keylog_int(const char *prefix,
    4888.                             SSL *ssl,
    4889.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4910:5: Assignment
    4908.        * hexadecimal, so we need a buffer that is twice their lengths.
    4909.        */
    4910.       prefix_len = strlen(prefix);
                ^
    4911.       out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;
    4912.       if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {

ssl/ssl_lib.c:4919:5: Assignment
    4917.   
    4918.       strcpy(cursor, prefix);
    4919.       cursor += prefix_len;
                ^
    4920.       *cursor++ = ' ';
    4921.   

ssl/ssl_lib.c:4920:6: Assignment
    4918.       strcpy(cursor, prefix);
    4919.       cursor += prefix_len;
    4920.       *cursor++ = ' ';
                 ^
    4921.   
    4922.       for (i = 0; i < parameter_1_len; i++) {

ssl/ssl_lib.c:4926:5: Array access: Offset: [4, +oo] Size: [1, 118] by call to `ssl_log_rsa_client_key_exchange` 
    4924.           cursor += 2;
    4925.       }
    4926.       *cursor++ = ' ';
                ^
    4927.   
    4928.       for (i = 0; i < parameter_2_len; i++) {
