ssl/d1_clnt.c:422: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: 28 by call to `ssl3_get_key_exchange`.
Showing all 11 steps of the trace


ssl/d1_clnt.c:159:1: Parameter `*s->init_msg`
157.                             dtls1_get_client_method, DTLSv1_2_enc_data)
158.   
159. > int dtls1_connect(SSL *s)
160.   {
161.       BUF_MEM *buf = NULL;

ssl/d1_clnt.c:422:19: Call
420.           case SSL3_ST_CR_KEY_EXCH_A:
421.           case SSL3_ST_CR_KEY_EXCH_B:
422.               ret = ssl3_get_key_exchange(s);
                         ^
423.               if (ret <= 0)
424.                   goto end;

ssl/s3_clnt.c:1378:1: Parameter `*s->init_msg`
  1376.   }
  1377.   
  1378. > int ssl3_get_key_exchange(SSL *s)
  1379.   {
  1380.   #ifndef OPENSSL_NO_RSA

ssl/s3_clnt.c:1797:14: Call
  1795.            * invalid curve. ECParameters is 3 bytes.
  1796.            */
  1797.           if (!tls1_check_curve(s, p, 3)) {
                       ^
  1798.               SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_WRONG_CURVE);
  1799.               goto f_err;

ssl/t1_lib.c:266:1: Array declaration
    264.   
    265.   /* The client's default curves / the server's 'auto' curves. */
    266. > static const unsigned char eccurves_auto[] = {
    267.       /* Prefer P-256 which has the fastest and most secure implementations. */
    268.       0, 23,                      /* secp256r1 (23) */

ssl/t1_lib.c:507:20: Call
    505.       for (i = 0; i < num_curves; i++, curves += 2) {
    506.           if (p[1] == curves[0] && p[2] == curves[1])
    507.               return tls_curve_allowed(s, p + 1, SSL_SECOP_CURVE_CHECK);
                              ^
    508.       }
    509.       return 0;

ssl/t1_lib.c:466:1: <Offset trace>
464.   
465.   /* See if curve is allowed by security callback */
466. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
467.   {
468.       const tls_curve_info *cinfo;

ssl/t1_lib.c:466:1: Parameter `*curve`
      464.   
      465.   /* See if curve is allowed by security callback */
      466. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
      467.   {
      468.       const tls_curve_info *cinfo;

ssl/t1_lib.c:228:1: <Length trace>
226.   # define TLS_CURVE_PRIME         0x0
227.   
228. > static const tls_curve_info nid_list[] = {
229.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
230.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:228:1: Array declaration
      226.   # define TLS_CURVE_PRIME         0x0
      227.   
      228. > static const tls_curve_info nid_list[] = {
      229.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
      230.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:473:5: Array access: Offset: [-1, +oo] Size: 28 by call to `ssl3_get_key_exchange` 
      471.       if ((curve[1] < 1) || ((size_t)curve[1] > OSSL_NELEM(nid_list)))
      472.           return 0;
      473.       cinfo = &nid_list[curve[1] - 1];
                 ^
      474.   # ifdef OPENSSL_NO_EC2M
      475.       if (cinfo->flags & TLS_CURVE_CHAR2)
