ssl/s3_cbc.c:645: error: BUFFER_OVERRUN_L2
  Offset added: [-`mac_secret_length` - 46, `mac_secret_length` + 238] (⇐ [-115, `mac_secret_length` - 5] + [-`mac_secret_length` + 69, 243]) Size: 128.
Showing all 5 steps of the trace


ssl/s3_cbc.c:425:5: <Offset trace>
423.       void (*md_final_raw) (void *ctx, unsigned char *md_out);
424.       void (*md_transform) (void *ctx, const unsigned char *block);
425.       unsigned md_size, md_block_size = 64;
           ^
426.       unsigned sslv3_pad_length = 40, header_length, variance_blocks,
427.           len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:425:5: Assignment
423.       void (*md_final_raw) (void *ctx, unsigned char *md_out);
424.       void (*md_transform) (void *ctx, const unsigned char *block);
425.       unsigned md_size, md_block_size = 64;
           ^
426.       unsigned sslv3_pad_length = 40, header_length, variance_blocks,
427.           len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:409:1: <Length trace>
407.    * padding too. )
408.    */
409. > void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
410.                               unsigned char *md_out,
411.                               size_t *md_out_size,

ssl/s3_cbc.c:409:1: Array declaration
407.    * padding too. )
408.    */
409. > void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
410.                               unsigned char *md_out,
411.                               size_t *md_out_size,

ssl/s3_cbc.c:645:13: Array access: Offset added: [-mac_secret_length - 46, mac_secret_length + 238] (⇐ [-115, mac_secret_length - 5] + [-mac_secret_length + 69, 243]) Size: 128
643.               md_transform(md_state.c, header);
644.               memcpy(first_block, header + md_block_size, overhang);
645.               memcpy(first_block + overhang, data, md_block_size - overhang);
                   ^
646.               md_transform(md_state.c, first_block);
647.               for (i = 1; i < k / md_block_size - 1; i++)
