ssl/t1_enc.c:669: error: BUFFER_OVERRUN_S2
  Offset: `llen` + 65 Size: [`llen` + 64, `llen` + `contextlen` + 66].
Showing all 13 steps of the trace


ssl/t1_enc.c:636:1: <Offset trace>
634.   }
635.   
636. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
637.                                   const char *label, size_t llen,
638.                                   const unsigned char *context,

ssl/t1_enc.c:636:1: Parameter `llen`
634.   }
635.   
636. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
637.                                   const char *label, size_t llen,
638.                                   const unsigned char *context,

ssl/t1_enc.c:660:5: Assignment
658.       currentvalpos = 0;
659.       memcpy(val + currentvalpos, (unsigned char *)label, llen);
660.       currentvalpos += llen;
           ^
661.       memcpy(val + currentvalpos, s->s3.client_random, SSL3_RANDOM_SIZE);
662.       currentvalpos += SSL3_RANDOM_SIZE;

ssl/t1_enc.c:662:5: Assignment
660.       currentvalpos += llen;
661.       memcpy(val + currentvalpos, s->s3.client_random, SSL3_RANDOM_SIZE);
662.       currentvalpos += SSL3_RANDOM_SIZE;
           ^
663.       memcpy(val + currentvalpos, s->s3.server_random, SSL3_RANDOM_SIZE);
664.       currentvalpos += SSL3_RANDOM_SIZE;

ssl/t1_enc.c:664:5: Assignment
662.       currentvalpos += SSL3_RANDOM_SIZE;
663.       memcpy(val + currentvalpos, s->s3.server_random, SSL3_RANDOM_SIZE);
664.       currentvalpos += SSL3_RANDOM_SIZE;
           ^
665.   
666.       if (use_context) {

ssl/t1_enc.c:668:9: Assignment
666.       if (use_context) {
667.           val[currentvalpos] = (contextlen >> 8) & 0xff;
668.           currentvalpos++;
               ^
669.           val[currentvalpos] = contextlen & 0xff;
670.           currentvalpos++;

ssl/t1_enc.c:636:1: <Length trace>
634.   }
635.   
636. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
637.                                   const char *label, size_t llen,
638.                                   const unsigned char *context,

ssl/t1_enc.c:636:1: Parameter `llen`
634.   }
635.   
636. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
637.                                   const char *label, size_t llen,
638.                                   const unsigned char *context,

ssl/t1_enc.c:650:5: Assignment
648.        * concatenation of values does not create a prohibited label.
649.        */
650.       vallen = llen + SSL3_RANDOM_SIZE * 2;
           ^
651.       if (use_context) {
652.           vallen += 2 + contextlen;

ssl/t1_enc.c:655:11: Call
653.       }
654.   
655.       val = OPENSSL_malloc(vallen);
                 ^
656.       if (val == NULL)
657.           goto err2;

crypto/mem.c:201:9: Assignment
  199.   
  200.       if (num == 0)
  201.           return NULL;
                 ^
  202.   
  203.       FAILTEST();

ssl/t1_enc.c:655:5: Assignment
653.       }
654.   
655.       val = OPENSSL_malloc(vallen);
           ^
656.       if (val == NULL)
657.           goto err2;

ssl/t1_enc.c:669:9: Array access: Offset: llen + 65 Size: [llen + 64, llen + contextlen + 66]
667.           val[currentvalpos] = (contextlen >> 8) & 0xff;
668.           currentvalpos++;
669.           val[currentvalpos] = contextlen & 0xff;
               ^
670.           currentvalpos++;
671.           if ((contextlen > 0) || (context != NULL)) {
