ssl/t1_ext.c:234: error: BUFFER_OVERRUN_S2
  Offset added: [`exts->meths_count` + 48, `exts->meths_count` + 48] (⇐ `exts->meths_count` + 48) Size: [1, 48⋅`exts->meths_count` + 48].
Showing all 6 steps of the trace


ssl/t1_ext.c:201:1: <Length trace>
199.   
200.   /* Set callbacks for a custom extension. */
201. > static int custom_ext_meth_add(custom_ext_methods *exts,
202.                                  unsigned int ext_type,
203.                                  custom_ext_add_cb add_cb,

ssl/t1_ext.c:201:1: Parameter `exts->meths_count`
199.   
200.   /* Set callbacks for a custom extension. */
201. > static int custom_ext_meth_add(custom_ext_methods *exts,
202.                                  unsigned int ext_type,
203.                                  custom_ext_add_cb add_cb,

ssl/t1_ext.c:222:9: Call
220.           return 0;
221.       /* Search for duplicate */
222.       if (custom_ext_find(exts, ext_type))
               ^
223.           return 0;
224.       exts->meths = OPENSSL_realloc(exts->meths,

ssl/t1_ext.c:62:1: Parameter `exts->meths_count`
  60.   
  61.   /* Find a custom extension from the list. */
  62. > static custom_ext_method *custom_ext_find(custom_ext_methods *exts,
  63.                                             unsigned int ext_type)
  64.   {

ssl/t1_ext.c:233:5: Assignment
231.       }
232.   
233.       meth = exts->meths + exts->meths_count;
           ^
234.       memset(meth, 0, sizeof(*meth));
235.       meth->parse_cb = parse_cb;

ssl/t1_ext.c:234:5: Array access: Offset added: [exts->meths_count + 48, exts->meths_count + 48] (⇐ exts->meths_count + 48) Size: [1, 48⋅exts->meths_count + 48]
232.   
233.       meth = exts->meths + exts->meths_count;
234.       memset(meth, 0, sizeof(*meth));
           ^
235.       meth->parse_cb = parse_cb;
236.       meth->add_cb = add_cb;
