ssl/statem/statem_dtls.c:375: error: BUFFER_OVERRUN_L3
  Offset: 11 (⇐ 9 + 2) Size: [1, 2147483644].
Showing all 11 steps of the trace


ssl/statem/statem_dtls.c:343:10: <Length trace>
341.   
342.    again:
343.       if (!dtls_get_reassembled_message(s, &errtype, &tmplen)) {
                ^
344.           if (errtype == DTLS1_HM_BAD_FRAGMENT
345.                   || errtype == DTLS1_HM_FRAGMENT_RETRY) {

ssl/statem/statem_dtls.c:343:10: Call
341.   
342.    again:
343.       if (!dtls_get_reassembled_message(s, &errtype, &tmplen)) {
                ^
344.           if (errtype == DTLS1_HM_BAD_FRAGMENT
345.                   || errtype == DTLS1_HM_FRAGMENT_RETRY) {

ssl/statem/statem_dtls.c:737:1: Parameter `*s->init_buf->data`
  735.   }
  736.   
  737. > static int dtls_get_reassembled_message(SSL *s, int *errtype, size_t *len)
  738.   {
  739.       unsigned char wire[DTLS1_HM_HEADER_LENGTH];

ssl/statem/statem_dtls.c:749:11: Call
  747.    redo:
  748.       /* see if we have the required fragment already */
  749.       ret = dtls1_retrieve_buffered_fragment(s, &frag_len);
                   ^
  750.       if (ret < 0) {
  751.           /* SSLfatal() already called */

ssl/statem/statem_dtls.c:467:1: Parameter `*s->init_buf->data`
    465.    * fatal error.
    466.    */
    467. > static int dtls1_retrieve_buffered_fragment(SSL *s, size_t *len)
    468.   {
    469.       /*-

ssl/statem/statem_dtls.c:354:5: Assignment
352.       *mt = s->s3.tmp.message_type;
353.   
354.       p = (unsigned char *)s->init_buf->data;
           ^
355.       *len = s->init_num;
356.   

ssl/statem/statem_dtls.c:371:7: Assignment
369.   
370.       /* reconstruct message header */
371.       *(p++) = msg_hdr->type;
             ^
372.       l2n3(msg_len, p);
373.       s2n(msg_hdr->seq, p);

ssl/statem/statem_dtls.c:372:5: Assignment
370.       /* reconstruct message header */
371.       *(p++) = msg_hdr->type;
372.       l2n3(msg_len, p);
           ^
373.       s2n(msg_hdr->seq, p);
374.       l2n3(0, p);

ssl/statem/statem_dtls.c:373:5: Assignment
371.       *(p++) = msg_hdr->type;
372.       l2n3(msg_len, p);
373.       s2n(msg_hdr->seq, p);
           ^
374.       l2n3(0, p);
375.       l2n3(msg_len, p);

ssl/statem/statem_dtls.c:374:5: Assignment
372.       l2n3(msg_len, p);
373.       s2n(msg_hdr->seq, p);
374.       l2n3(0, p);
           ^
375.       l2n3(msg_len, p);
376.       if (s->version != DTLS1_BAD_VER) {

ssl/statem/statem_dtls.c:375:5: Array access: Offset: 11 (⇐ 9 + 2) Size: [1, 2147483644]
373.       s2n(msg_hdr->seq, p);
374.       l2n3(0, p);
375.       l2n3(msg_len, p);
           ^
376.       if (s->version != DTLS1_BAD_VER) {
377.           p -= DTLS1_HM_HEADER_LENGTH;
