ssl/statem/statem_clnt.c:1594: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: 29 by call to `tls1_check_curve`.
Showing all 9 steps of the trace


ssl/statem/statem_clnt.c:1407:1: Parameter `*pkt->curr`
1405.   }
1406.   
1407. > MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s, PACKET *pkt)
1408.   {
1409.       EVP_MD_CTX *md_ctx;

ssl/statem/statem_clnt.c:1594:14: Call
1592.            * invalid curve. ECParameters is 3 bytes.
1593.            */
1594.           if (!tls1_check_curve(s, ecparams, 3)) {
                     ^
1595.               SSLerr(SSL_F_TLS_PROCESS_KEY_EXCHANGE, SSL_R_WRONG_CURVE);
1596.               goto f_err;

ssl/t1_lib.c:277:1: Array declaration
  275.   
  276.   /* The default curves */
  277. > static const unsigned char eccurves_default[] = {
  278.       0, 29,                      /* X25519 (29) */
  279.       /* Prefer P-256 which has the fastest and most secure implementations. */

ssl/t1_lib.c:460:20: Call
  458.       for (i = 0; i < num_curves; i++, curves += 2) {
  459.           if (p[1] == curves[0] && p[2] == curves[1])
  460.               return tls_curve_allowed(s, p + 1, SSL_SECOP_CURVE_CHECK);
                            ^
  461.       }
  462.       return 0;

ssl/t1_lib.c:419:1: <Offset trace>
417.   
418.   /* See if curve is allowed by security callback */
419. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
420.   {
421.       const tls_curve_info *cinfo;

ssl/t1_lib.c:419:1: Parameter `*curve`
    417.   
    418.   /* See if curve is allowed by security callback */
    419. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
    420.   {
    421.       const tls_curve_info *cinfo;

ssl/t1_lib.c:237:1: <Length trace>
235.    */
236.   
237. > static const tls_curve_info nid_list[] = {
238.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
239.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:237:1: Array declaration
    235.    */
    236.   
    237. > static const tls_curve_info nid_list[] = {
    238.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
    239.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:426:5: Array access: Offset: [-1, +oo] Size: 29 by call to `tls1_check_curve` 
    424.       if ((curve[1] < 1) || ((size_t)curve[1] > OSSL_NELEM(nid_list)))
    425.           return 0;
    426.       cinfo = &nid_list[curve[1] - 1];
               ^
    427.   # ifdef OPENSSL_NO_EC2M
    428.       if (cinfo->flags & TLS_CURVE_CHAR2)
