ssl/tls_srp.c:156: error: BUFFER_OVERRUN_L3
  Offset added: [1, 15] Size: [0, +oo] by call to `ssl_randbytes`.
Showing all 10 steps of the trace


ssl/tls_srp.c:156:9: Call
154.           return SSL3_AL_FATAL;
155.   
156.       if (ssl_randbytes(s, b, sizeof(b)) <= 0)
               ^
157.           return SSL3_AL_FATAL;
158.       s->srp_ctx.b = BN_bin2bn(b, sizeof(b), NULL);

ssl/ssl_lib.c:5128:1: Parameter `size`
  5126.   }
  5127.   
  5128. > int ssl_randbytes(SSL *s, unsigned char *rnd, size_t size)
  5129.   {
  5130.       if (s->drbg != NULL) {

ssl/ssl_lib.c:5143:17: Call
  5141.            * here.
  5142.            */
  5143.            return RAND_DRBG_generate(s->drbg, rnd, size, 0, NULL, 0);
                          ^
  5144.       }
  5145.       return RAND_bytes(rnd, (int)size);

crypto/rand/drbg_lib.c:363:1: Parameter `outlen`
    361.    *
    362.    */
    363. > int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,
    364.                          int prediction_resistance,
    365.                          const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_lib.c:409:10: Call
    407.       }
    408.   
    409.       if (!ctr_generate(drbg, out, outlen, adin, adinlen)) {
                    ^
    410.           drbg->state = DRBG_ERROR;
    411.           RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);

crypto/rand/drbg_rand.c:266:1: <Offset trace>
264.   }
265.   
266. > int ctr_generate(RAND_DRBG *drbg,
267.                    unsigned char *out, size_t outlen,
268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: Parameter `outlen`
      264.   }
      265.   
      266. > int ctr_generate(RAND_DRBG *drbg,
      267.                    unsigned char *out, size_t outlen,
      268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: <Length trace>
264.   }
265.   
266. > int ctr_generate(RAND_DRBG *drbg,
267.                    unsigned char *out, size_t outlen,
268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: Parameter `drbg->ctr.K[*]`
      264.   }
      265.   
      266. > int ctr_generate(RAND_DRBG *drbg,
      267.                    unsigned char *out, size_t outlen,
      268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:288:13: Array access: Offset added: [1, 15] Size: [0, +oo] by call to `ssl_randbytes` 
      286.               /* Use K as temp space as it will be updated */
      287.               AES_encrypt(ctr->V, ctr->K, &ctr->ks);
      288.               memcpy(out, ctr->K, outlen);
                         ^
      289.               break;
      290.           }
