ssl/statem/statem_clnt.c:2642: error: BUFFER_OVERRUN_L3
  Offset: [4, +oo] Size: [1, 150] by call to `ssl_log_rsa_client_key_exchange`.
Showing all 10 steps of the trace


ssl/statem/statem_clnt.c:2592:5: Assignment
2590.       }
2591.   
2592.       pmslen = SSL_MAX_MASTER_KEY_LENGTH;
            ^
2593.       pms = OPENSSL_malloc(pmslen);
2594.       if (pms == NULL) {

ssl/statem/statem_clnt.c:2642:10: Call
2640.   
2641.       /* Log the premaster secret, if logging is enabled. */
2642.       if (!ssl_log_rsa_client_key_exchange(s, encdata, enclen, pms, pmslen))
                 ^
2643.           goto err;
2644.   

ssl/ssl_lib.c:4418:1: Parameter `premaster_len`
  4416.   }
  4417.   
  4418. > int ssl_log_rsa_client_key_exchange(SSL *ssl,
  4419.                                       const uint8_t *encrypted_premaster,
  4420.                                       size_t encrypted_premaster_len,

ssl/ssl_lib.c:4430:12: Call
  4428.   
  4429.       /* We only want the first 8 bytes of the encrypted premaster as a tag. */
  4430.       return nss_keylog_int("RSA",
                     ^
  4431.                             ssl,
  4432.                             encrypted_premaster,

ssl/ssl_lib.c:4366:1: <Length trace>
4364.   }
4365.   
4366. > static int nss_keylog_int(const char *prefix,
4367.                             SSL *ssl,
4368.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4366:1: Parameter `prefix->strlen`
    4364.   }
    4365.   
    4366. > static int nss_keylog_int(const char *prefix,
    4367.                             SSL *ssl,
    4368.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:4389:5: Assignment
    4387.        * hexadecimal, so we need a buffer that is twice their lengths.
    4388.        */
    4389.       prefix_len = strlen(prefix);
                ^
    4390.       out_len = prefix_len + (2*parameter_1_len) + (2*parameter_2_len) + 3;
    4391.       if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {

ssl/ssl_lib.c:4397:5: Assignment
    4395.   
    4396.       strcpy(cursor, prefix);
    4397.       cursor += prefix_len;
                ^
    4398.       *cursor++ = ' ';
    4399.   

ssl/ssl_lib.c:4398:6: Assignment
    4396.       strcpy(cursor, prefix);
    4397.       cursor += prefix_len;
    4398.       *cursor++ = ' ';
                 ^
    4399.   
    4400.       for (i = 0; i < parameter_1_len; i++) {

ssl/ssl_lib.c:4404:5: Array access: Offset: [4, +oo] Size: [1, 150] by call to `ssl_log_rsa_client_key_exchange` 
    4402.           cursor += 2;
    4403.       }
    4404.       *cursor++ = ' ';
                ^
    4405.   
    4406.       for (i = 0; i < parameter_2_len; i++) {
