ssl/s3_clnt.c:382: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: 28 by call to `ssl3_get_key_exchange`.
Showing all 11 steps of the trace


ssl/s3_clnt.c:186:1: Parameter `*s->init_msg`
184.   			ssl3_get_client_method)
185.   
186. > int ssl3_connect(SSL *s)
187.   	{
188.   	BUF_MEM *buf=NULL;

ssl/s3_clnt.c:382:8: Call
380.   		case SSL3_ST_CR_KEY_EXCH_A:
381.   		case SSL3_ST_CR_KEY_EXCH_B:
382.   			ret=ssl3_get_key_exchange(s);
              ^
383.   			if (ret <= 0) goto end;
384.   			s->state=SSL3_ST_CR_CERT_REQ_A;

ssl/s3_clnt.c:1402:1: Parameter `*s->init_msg`
  1400.   	}
  1401.   
  1402. > int ssl3_get_key_exchange(SSL *s)
  1403.   	{
  1404.   #ifndef OPENSSL_NO_RSA

ssl/s3_clnt.c:1781:8: Call
  1779.   		 * sent an invalid curve.
  1780.   		 */
  1781.   		if (!tls1_check_curve(s, p, param_len))
                 ^
  1782.   			{
  1783.   			al=SSL_AD_DECODE_ERROR;

ssl/t1_lib.c:275:1: Array declaration
    273.   	};
    274.   
    275. > static const unsigned char eccurves_default[] =
    276.   	{
    277.   		0,14, /* sect571r1 (14) */ 

ssl/t1_lib.c:472:11: Call
    470.   		{
    471.   		if (p[1] == curves[0] && p[2] == curves[1])
    472.   			return tls_curve_allowed(s, p + 1, SSL_SECOP_CURVE_CHECK);
                     ^
    473.   		}
    474.   	return 0;

ssl/t1_lib.c:429:1: <Offset trace>
427.   
428.   /* See if curve is allowed by security callback */
429. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
430.   	{
431.   	tls_curve_info *cinfo;

ssl/t1_lib.c:429:1: Parameter `*curve`
      427.   
      428.   /* See if curve is allowed by security callback */
      429. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
      430.   	{
      431.   	tls_curve_info *cinfo;

ssl/t1_lib.c:235:1: <Length trace>
233.   #define TLS_CURVE_PRIME		0x0
234.   
235. > static tls_curve_info nid_list[] =
236.   	{
237.   		{NID_sect163k1, 80, TLS_CURVE_CHAR2},/* sect163k1 (1) */

ssl/t1_lib.c:235:1: Array declaration
      233.   #define TLS_CURVE_PRIME		0x0
      234.   
      235. > static tls_curve_info nid_list[] =
      236.   	{
      237.   		{NID_sect163k1, 80, TLS_CURVE_CHAR2},/* sect163k1 (1) */

ssl/t1_lib.c:437:2: Array access: Offset: [-1, +oo] Size: 28 by call to `ssl3_get_key_exchange` 
      435.   				sizeof(nid_list)/sizeof(nid_list[0])))
      436.   		return 0;
      437.   	cinfo = &nid_list[curve[1]-1];
              ^
      438.   	return ssl_security(s, op, cinfo->secbits, cinfo->nid, (void *)curve);
      439.   	}
