ssl/t1_lib.c:1289: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: 29 by call to `tls_curve_allowed`.
Showing all 7 steps of the trace


ssl/t1_lib.c:1120:1: Parameter `*s->session->tlsext_ellipticcurvelist`
1118.   }
1119.   
1120. > unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf,
1121.                                             unsigned char *limit, int *al)
1122.   {

ssl/t1_lib.c:1289:17: Call
1287.           /* Copy curve ID if supported */
1288.           for (i = 0; i < num_curves; i++, pcurves += 2) {
1289.               if (tls_curve_allowed(s, pcurves, SSL_SECOP_CURVE_SUPPORTED)) {
                        ^
1290.                   *etmp++ = pcurves[0];
1291.                   *etmp++ = pcurves[1];

ssl/t1_lib.c:419:1: <Offset trace>
417.   
418.   /* See if curve is allowed by security callback */
419. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
420.   {
421.       const tls_curve_info *cinfo;

ssl/t1_lib.c:419:1: Parameter `*curve`
  417.   
  418.   /* See if curve is allowed by security callback */
  419. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
  420.   {
  421.       const tls_curve_info *cinfo;

ssl/t1_lib.c:237:1: <Length trace>
235.    */
236.   
237. > static const tls_curve_info nid_list[] = {
238.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
239.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:237:1: Array declaration
  235.    */
  236.   
  237. > static const tls_curve_info nid_list[] = {
  238.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
  239.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:426:5: Array access: Offset: [-1, +oo] Size: 29 by call to `tls_curve_allowed` 
  424.       if ((curve[1] < 1) || ((size_t)curve[1] > OSSL_NELEM(nid_list)))
  425.           return 0;
  426.       cinfo = &nid_list[curve[1] - 1];
             ^
  427.   # ifdef OPENSSL_NO_EC2M
  428.       if (cinfo->flags & TLS_CURVE_CHAR2)
