ssl/record/ssl3_record.c:1376: error: BUFFER_OVERRUN_L2
  Offset: [-oo, `ssl->s3.read_mac_secret_size` + 58] Size: 13 by call to `ssl3_cbc_digest_record`.
Showing all 7 steps of the trace


ssl/record/ssl3_record.c:1313:1: Array declaration
1311.   }
1312.   
1313. > int tls1_mac(SSL *ssl, SSL3_RECORD *rec, unsigned char *md, int sending)
1314.   {
1315.       unsigned char *seq;

ssl/record/ssl3_record.c:1376:13: Call
1374.            */
1375.           /* Final param == not SSLv3 */
1376.           if (ssl3_cbc_digest_record(mac_ctx,
                    ^
1377.                                      md, &md_size,
1378.                                      header, rec->input,

ssl/s3_cbc.c:128:1: <Offset trace>
126.    * Returns 1 on success or 0 on error
127.    */
128. > int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
129.                              unsigned char *md_out,
130.                              size_t *md_out_size,

ssl/s3_cbc.c:128:1: Parameter `data_plus_mac_plus_padding_size`
  126.    * Returns 1 on success or 0 on error
  127.    */
  128. > int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
  129.                              unsigned char *md_out,
  130.                              size_t *md_out_size,

ssl/s3_cbc.c:128:1: <Length trace>
126.    * Returns 1 on success or 0 on error
127.    */
128. > int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
129.                              unsigned char *md_out,
130.                              size_t *md_out_size,

ssl/s3_cbc.c:128:1: Parameter `*header`
  126.    * Returns 1 on success or 0 on error
  127.    */
  128. > int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
  129.                              unsigned char *md_out,
  130.                              size_t *md_out_size,

ssl/s3_cbc.c:410:21: Array access: Offset: [-oo, ssl->s3.read_mac_secret_size + 58] Size: 13 by call to `ssl3_cbc_digest_record` 
  408.               unsigned char b = 0, is_past_c, is_past_cp1;
  409.               if (k < header_length)
  410.                   b = header[k];
                             ^
  411.               else if (k < data_plus_mac_plus_padding_size + header_length)
  412.                   b = data[k - header_length];
