ssl/s3_enc.c:772: error: BUFFER_OVERRUN_L3
  Offset added: [-115, +oo] Size: 128 by call to `ssl3_cbc_digest_record`.
Showing all 12 steps of the trace


ssl/s3_enc.c:713:1: Parameter `ssl->read_hash->digest->md_size`
711.   }
712.   
713. > int n_ssl3_mac(SSL *ssl, unsigned char *md, int send)
714.   {
715.       SSL3_RECORD *rec;

ssl/s3_enc.c:736:9: Call
734.       }
735.   
736.       t = EVP_MD_CTX_size(hash);
               ^
737.       if (t < 0)
738.           return -1;

crypto/evp/evp_lib.c:276:9: Assignment
  274.       if (!md) {
  275.           EVPerr(EVP_F_EVP_MD_SIZE, EVP_R_MESSAGE_DIGEST_IS_NULL);
  276.           return -1;
                 ^
  277.       }
  278.       return md->md_size;

ssl/s3_enc.c:736:5: Assignment
734.       }
735.   
736.       t = EVP_MD_CTX_size(hash);
           ^
737.       if (t < 0)
738.           return -1;

ssl/s3_enc.c:739:5: Assignment
737.       if (t < 0)
738.           return -1;
739.       md_size = t;
           ^
740.       npad = (48 / md_size) * md_size;
741.   

ssl/s3_enc.c:772:9: Call
770.   
771.           /* Final param == is SSLv3 */
772.           ssl3_cbc_digest_record(hash,
               ^
773.                                  md, &md_size,
774.                                  header, rec->input,

ssl/s3_cbc.c:425:5: <Offset trace>
423.       void (*md_final_raw) (void *ctx, unsigned char *md_out);
424.       void (*md_transform) (void *ctx, const unsigned char *block);
425.       unsigned md_size, md_block_size = 64;
           ^
426.       unsigned sslv3_pad_length = 40, header_length, variance_blocks,
427.           len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:425:5: Assignment
  423.       void (*md_final_raw) (void *ctx, unsigned char *md_out);
  424.       void (*md_transform) (void *ctx, const unsigned char *block);
  425.       unsigned md_size, md_block_size = 64;
             ^
  426.       unsigned sslv3_pad_length = 40, header_length, variance_blocks,
  427.           len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:642:13: Assignment
  640.                * consumes: either 7 bytes (SHA1) or 11 bytes (MD5).
  641.                */
  642.               unsigned overhang = header_length - md_block_size;
                     ^
  643.               md_transform(md_state.c, header);
  644.               memcpy(first_block, header + md_block_size, overhang);

ssl/s3_cbc.c:409:1: <Length trace>
407.    * padding too. )
408.    */
409. > void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
410.                               unsigned char *md_out,
411.                               size_t *md_out_size,

ssl/s3_cbc.c:409:1: Array declaration
  407.    * padding too. )
  408.    */
  409. > void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
  410.                               unsigned char *md_out,
  411.                               size_t *md_out_size,

ssl/s3_cbc.c:644:13: Array access: Offset added: [-115, +oo] Size: 128 by call to `ssl3_cbc_digest_record` 
  642.               unsigned overhang = header_length - md_block_size;
  643.               md_transform(md_state.c, header);
  644.               memcpy(first_block, header + md_block_size, overhang);
                     ^
  645.               memcpy(first_block + overhang, data, md_block_size - overhang);
  646.               md_transform(md_state.c, first_block);
