ssl/t1_enc.c:583: error: BUFFER_OVERRUN_S2
  Offset: `llen` + 65 Size: [`llen` + 64, `llen` + `contextlen` + 66].
Showing all 13 steps of the trace


ssl/t1_enc.c:550:1: <Offset trace>
548.   }
549.   
550. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
551.                                   const char *label, size_t llen,
552.                                   const unsigned char *context,

ssl/t1_enc.c:550:1: Parameter `llen`
548.   }
549.   
550. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
551.                                   const char *label, size_t llen,
552.                                   const unsigned char *context,

ssl/t1_enc.c:574:5: Assignment
572.       currentvalpos = 0;
573.       memcpy(val + currentvalpos, (unsigned char *)label, llen);
574.       currentvalpos += llen;
           ^
575.       memcpy(val + currentvalpos, s->s3->client_random, SSL3_RANDOM_SIZE);
576.       currentvalpos += SSL3_RANDOM_SIZE;

ssl/t1_enc.c:576:5: Assignment
574.       currentvalpos += llen;
575.       memcpy(val + currentvalpos, s->s3->client_random, SSL3_RANDOM_SIZE);
576.       currentvalpos += SSL3_RANDOM_SIZE;
           ^
577.       memcpy(val + currentvalpos, s->s3->server_random, SSL3_RANDOM_SIZE);
578.       currentvalpos += SSL3_RANDOM_SIZE;

ssl/t1_enc.c:578:5: Assignment
576.       currentvalpos += SSL3_RANDOM_SIZE;
577.       memcpy(val + currentvalpos, s->s3->server_random, SSL3_RANDOM_SIZE);
578.       currentvalpos += SSL3_RANDOM_SIZE;
           ^
579.   
580.       if (use_context) {

ssl/t1_enc.c:582:9: Assignment
580.       if (use_context) {
581.           val[currentvalpos] = (contextlen >> 8) & 0xff;
582.           currentvalpos++;
               ^
583.           val[currentvalpos] = contextlen & 0xff;
584.           currentvalpos++;

ssl/t1_enc.c:550:1: <Length trace>
548.   }
549.   
550. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
551.                                   const char *label, size_t llen,
552.                                   const unsigned char *context,

ssl/t1_enc.c:550:1: Parameter `llen`
548.   }
549.   
550. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
551.                                   const char *label, size_t llen,
552.                                   const unsigned char *context,

ssl/t1_enc.c:564:5: Assignment
562.        * concatenation of values does not create a prohibited label.
563.        */
564.       vallen = llen + SSL3_RANDOM_SIZE * 2;
           ^
565.       if (use_context) {
566.           vallen += 2 + contextlen;

ssl/t1_enc.c:569:11: Call
567.       }
568.   
569.       val = OPENSSL_malloc(vallen);
                 ^
570.       if (val == NULL)
571.           goto err2;

crypto/mem.c:165:9: Assignment
  163.   
  164.       if (num <= 0)
  165.           return NULL;
                 ^
  166.   
  167.       FAILTEST();

ssl/t1_enc.c:569:5: Assignment
567.       }
568.   
569.       val = OPENSSL_malloc(vallen);
           ^
570.       if (val == NULL)
571.           goto err2;

ssl/t1_enc.c:583:9: Array access: Offset: llen + 65 Size: [llen + 64, llen + contextlen + 66]
581.           val[currentvalpos] = (contextlen >> 8) & 0xff;
582.           currentvalpos++;
583.           val[currentvalpos] = contextlen & 0xff;
               ^
584.           currentvalpos++;
585.           if ((contextlen > 0) || (context != NULL)) {
