ssl/t1_lib.c:1739: error: BUFFER_OVERRUN_L1
  Offset: [0, +oo] Size: 0 by call to `tls1_set_sigalgs`.
Showing all 9 steps of the trace


ssl/t1_lib.c:1734:5: Assignment
1732.   {
1733.       sig_cb_st sig;
1734.       sig.sigalgcnt = 0;
            ^
1735.       if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
1736.           return 0;

ssl/t1_lib.c:1739:12: Call
1737.       if (c == NULL)
1738.           return 1;
1739.       return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
                   ^
1740.   }
1741.   

ssl/t1_lib.c:1742:1: <Length trace>
1740.   }
1741.   
1742. > int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
1743.   {
1744.       uint16_t *sigalgs, *sptr;

ssl/t1_lib.c:1742:1: Parameter `salglen`
  1740.   }
  1741.   
  1742. > int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
  1743.   {
  1744.       uint16_t *sigalgs, *sptr;

ssl/t1_lib.c:1749:15: Call
  1747.       if (salglen & 1)
  1748.           return 0;
  1749.       sigalgs = OPENSSL_malloc((salglen / 2) * sizeof(*sigalgs));
                        ^
  1750.       if (sigalgs == NULL)
  1751.           return 0;

crypto/mem.c:166:9: Assignment
    164.   
    165.       if (num == 0)
    166.           return NULL;
                   ^
    167.   
    168.       FAILTEST();

ssl/t1_lib.c:1749:5: Assignment
  1747.       if (salglen & 1)
  1748.           return 0;
  1749.       sigalgs = OPENSSL_malloc((salglen / 2) * sizeof(*sigalgs));
              ^
  1750.       if (sigalgs == NULL)
  1751.           return 0;

ssl/t1_lib.c:1752:17: Assignment
  1750.       if (sigalgs == NULL)
  1751.           return 0;
  1752.       for (i = 0, sptr = sigalgs; i < salglen; i += 2) {
                          ^
  1753.           size_t j;
  1754.           const SIGALG_LOOKUP *curr;

ssl/t1_lib.c:1761:17: Array access: Offset: [0, +oo] Size: 0 by call to `tls1_set_sigalgs` 
  1759.                j++, curr++) {
  1760.               if (curr->hash == md_id && curr->sig == sig_id) {
  1761.                   *sptr++ = curr->sigalg;
                          ^
  1762.                   break;
  1763.               }
