ssl/ssl_lib.c:5140: error: BUFFER_OVERRUN_S2
  Offset: [`prefix->strlen` + 2, +oo] Size: [1, 2⋅`parameter_2_len` + 2⋅`parameter_1_len` + `prefix->strlen` + 3].
Showing all 7 steps of the trace


ssl/ssl_lib.c:5094:1: <Length trace>
5092.   }
5093.   
5094. > static int nss_keylog_int(const char *prefix,
5095.                             SSL *ssl,
5096.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:5094:1: Parameter `prefix->strlen`
5092.   }
5093.   
5094. > static int nss_keylog_int(const char *prefix,
5095.                             SSL *ssl,
5096.                             const uint8_t *parameter_1,

ssl/ssl_lib.c:5118:5: Assignment
5116.        * hexadecimal, so we need a buffer that is twice their lengths.
5117.        */
5118.       prefix_len = strlen(prefix);
            ^
5119.       out_len = prefix_len + (2 * parameter_1_len) + (2 * parameter_2_len) + 3;
5120.       if ((out = cursor = OPENSSL_malloc(out_len)) == NULL) {

ssl/ssl_lib.c:5127:5: Assignment
5125.   
5126.       strcpy(cursor, prefix);
5127.       cursor += prefix_len;
            ^
5128.       *cursor++ = ' ';
5129.   

ssl/ssl_lib.c:5128:6: Assignment
5126.       strcpy(cursor, prefix);
5127.       cursor += prefix_len;
5128.       *cursor++ = ' ';
             ^
5129.   
5130.       for (i = 0; i < parameter_1_len; i++) {

ssl/ssl_lib.c:5134:6: Assignment
5132.           cursor += 2;
5133.       }
5134.       *cursor++ = ' ';
             ^
5135.   
5136.       for (i = 0; i < parameter_2_len; i++) {

ssl/ssl_lib.c:5140:5: Array access: Offset: [prefix->strlen + 2, +oo] Size: [1, 2⋅parameter_2_len + 2⋅parameter_1_len + prefix->strlen + 3]
5138.           cursor += 2;
5139.       }
5140.       *cursor = '\0';
            ^
5141.   
5142.       ssl->ctx->keylog_callback(ssl, (const char *)out);
