ssl/t1_lib.c:1276: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: 28 by call to `tls_curve_allowed`.
Showing all 7 steps of the trace


ssl/t1_lib.c:1109:1: Parameter `*s->session->tlsext_ellipticcurvelist`
1107.   	}
1108.   
1109. > unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit, int *al)
1110.   	{
1111.   	int extdatalen=0;

ssl/t1_lib.c:1276:8: Call
1274.   		for (i = 0; i < plistlen; i += 2, plist += 2)
1275.   			{
1276.   			if (tls_curve_allowed(s, plist, SSL_SECOP_CURVE_SUPPORTED))
               ^
1277.   				{
1278.   				*etmp++ = plist[0];

ssl/t1_lib.c:429:1: <Offset trace>
427.   
428.   /* See if curve is allowed by security callback */
429. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
430.   	{
431.   	tls_curve_info *cinfo;

ssl/t1_lib.c:429:1: Parameter `*curve`
  427.   
  428.   /* See if curve is allowed by security callback */
  429. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
  430.   	{
  431.   	tls_curve_info *cinfo;

ssl/t1_lib.c:235:1: <Length trace>
233.   #define TLS_CURVE_PRIME		0x0
234.   
235. > static tls_curve_info nid_list[] =
236.   	{
237.   		{NID_sect163k1, 80, TLS_CURVE_CHAR2},/* sect163k1 (1) */

ssl/t1_lib.c:235:1: Array declaration
  233.   #define TLS_CURVE_PRIME		0x0
  234.   
  235. > static tls_curve_info nid_list[] =
  236.   	{
  237.   		{NID_sect163k1, 80, TLS_CURVE_CHAR2},/* sect163k1 (1) */

ssl/t1_lib.c:437:2: Array access: Offset: [-1, +oo] Size: 28 by call to `tls_curve_allowed` 
  435.   				sizeof(nid_list)/sizeof(nid_list[0])))
  436.   		return 0;
  437.   	cinfo = &nid_list[curve[1]-1];
          ^
  438.   	return ssl_security(s, op, cinfo->secbits, cinfo->nid, (void *)curve);
  439.   	}
