ssl/record/rec_layer_d1.c:635: error: BUFFER_OVERRUN_L3
  Offset: 2 (⇐ 1 + 1) Size: [1, 16384] by call to `dtls1_process_heartbeat`.
Showing all 11 steps of the trace


ssl/record/rec_layer_d1.c:405:1: Parameter `s->rlayer.rrec.length`
403.    *             none of our business
404.    */
405. > int dtls1_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
406.                        int len, int peek)
407.   {

ssl/record/rec_layer_d1.c:635:17: Call
633.           else if (SSL3_RECORD_get_type(rr) == TLS1_RT_HEARTBEAT) {
634.               /* We allow a 0 return */
635.               if (dtls1_process_heartbeat(s, SSL3_RECORD_get_data(rr),
                       ^
636.                       SSL3_RECORD_get_length(rr)) < 0) {
637.                   return -1;

ssl/d1_lib.c:894:1: <Length trace>
892.   
893.   #ifndef OPENSSL_NO_HEARTBEATS
894. > int dtls1_process_heartbeat(SSL *s, unsigned char *p, unsigned int length)
895.   {
896.       unsigned char *pl;

ssl/d1_lib.c:894:1: Parameter `length`
  892.   
  893.   #ifndef OPENSSL_NO_HEARTBEATS
  894. > int dtls1_process_heartbeat(SSL *s, unsigned char *p, unsigned int length)
  895.   {
  896.       unsigned char *pl;

ssl/d1_lib.c:919:9: Assignment
  917.       if (hbtype == TLS1_HB_REQUEST) {
  918.           unsigned char *buffer, *bp;
  919.           unsigned int write_length = 1 /* heartbeat type */  +
                 ^
  920.               2 /* heartbeat length */  +
  921.               payload + padding;

ssl/d1_lib.c:931:18: Call
  929.            * plus 2 bytes payload length, plus payload, plus padding
  930.            */
  931.           buffer = OPENSSL_malloc(write_length);
                          ^
  932.           if (buffer == NULL)
  933.               return -1;

crypto/mem.c:125:9: Assignment
    123.   
    124.       if (num <= 0)
    125.           return NULL;
                   ^
    126.   
    127.       allow_customize = 0;

ssl/d1_lib.c:931:9: Assignment
  929.            * plus 2 bytes payload length, plus payload, plus padding
  930.            */
  931.           buffer = OPENSSL_malloc(write_length);
                 ^
  932.           if (buffer == NULL)
  933.               return -1;

ssl/d1_lib.c:934:9: Assignment
  932.           if (buffer == NULL)
  933.               return -1;
  934.           bp = buffer;
                 ^
  935.   
  936.           /* Enter response type, length and copy payload */

ssl/d1_lib.c:937:10: Assignment
  935.   
  936.           /* Enter response type, length and copy payload */
  937.           *bp++ = TLS1_HB_RESPONSE;
                  ^
  938.           s2n(payload, bp);
  939.           memcpy(bp, pl, payload);

ssl/d1_lib.c:938:9: Array access: Offset: 2 (⇐ 1 + 1) Size: [1, 16384] by call to `dtls1_process_heartbeat` 
  936.           /* Enter response type, length and copy payload */
  937.           *bp++ = TLS1_HB_RESPONSE;
  938.           s2n(payload, bp);
                 ^
  939.           memcpy(bp, pl, payload);
  940.           bp += payload;
