ssl/t1_lib.c:1802: error: BUFFER_OVERRUN_L1
  Offset: [0, +oo] Size: 0 by call to `tls1_set_sigalgs`.
Showing all 9 steps of the trace


ssl/t1_lib.c:1797:5: Assignment
1795.   {
1796.       sig_cb_st sig;
1797.       sig.sigalgcnt = 0;
            ^
1798.       if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
1799.           return 0;

ssl/t1_lib.c:1802:12: Call
1800.       if (c == NULL)
1801.           return 1;
1802.       return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
                   ^
1803.   }
1804.   

ssl/t1_lib.c:1805:1: <Length trace>
1803.   }
1804.   
1805. > int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
1806.   {
1807.       uint16_t *sigalgs, *sptr;

ssl/t1_lib.c:1805:1: Parameter `salglen`
  1803.   }
  1804.   
  1805. > int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
  1806.   {
  1807.       uint16_t *sigalgs, *sptr;

ssl/t1_lib.c:1812:15: Call
  1810.       if (salglen & 1)
  1811.           return 0;
  1812.       sigalgs = OPENSSL_malloc((salglen / 2) * sizeof(*sigalgs));
                        ^
  1813.       if (sigalgs == NULL)
  1814.           return 0;

crypto/mem.c:166:9: Assignment
    164.   
    165.       if (num <= 0)
    166.           return NULL;
                   ^
    167.   
    168.       FAILTEST();

ssl/t1_lib.c:1812:5: Assignment
  1810.       if (salglen & 1)
  1811.           return 0;
  1812.       sigalgs = OPENSSL_malloc((salglen / 2) * sizeof(*sigalgs));
              ^
  1813.       if (sigalgs == NULL)
  1814.           return 0;

ssl/t1_lib.c:1815:17: Assignment
  1813.       if (sigalgs == NULL)
  1814.           return 0;
  1815.       for (i = 0, sptr = sigalgs; i < salglen; i += 2) {
                          ^
  1816.           size_t j;
  1817.           const SIGALG_LOOKUP *curr;

ssl/t1_lib.c:1824:17: Array access: Offset: [0, +oo] Size: 0 by call to `tls1_set_sigalgs` 
  1822.                j++, curr++) {
  1823.               if (curr->hash == md_id && curr->sig == sig_id) {
  1824.                   *sptr++ = curr->sigalg;
                          ^
  1825.                   break;
  1826.               }
