ssl/ssl_lib.c:337: error: BUFFER_OVERRUN_S2
  Offset: [`dctx->mdmax` + 1, `mtype` - 1] Size: [1, 8⋅`mtype` + 8].
Showing all 8 steps of the trace


ssl/ssl_lib.c:302:1: <Offset trace>
300.   }
301.   
302. > static int dane_mtype_set(
303.       struct dane_ctx_st *dctx,
304.       const EVP_MD *md,

ssl/ssl_lib.c:302:1: Parameter `mtype`
300.   }
301.   
302. > static int dane_mtype_set(
303.       struct dane_ctx_st *dctx,
304.       const EVP_MD *md,

ssl/ssl_lib.c:302:1: <Length trace>
300.   }
301.   
302. > static int dane_mtype_set(
303.       struct dane_ctx_st *dctx,
304.       const EVP_MD *md,

ssl/ssl_lib.c:302:1: Parameter `*dctx->mdevp`
300.   }
301.   
302. > static int dane_mtype_set(
303.       struct dane_ctx_st *dctx,
304.       const EVP_MD *md,

ssl/ssl_lib.c:321:17: Call
319.           int n = ((int) mtype) + 1;
320.   
321.           mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp));
                       ^
322.           if (mdevp == NULL) {
323.               SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);

crypto/mem.c:173:9: Assignment
  171.       if (num == 0) {
  172.           CRYPTO_free(str);
  173.           return NULL;
                 ^
  174.       }
  175.   

ssl/ssl_lib.c:321:9: Assignment
319.           int n = ((int) mtype) + 1;
320.   
321.           mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp));
               ^
322.           if (mdevp == NULL) {
323.               SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);

ssl/ssl_lib.c:337:13: Array access: Offset: [dctx->mdmax + 1, mtype - 1] Size: [1, 8⋅mtype + 8]
335.           /* Zero-fill any gaps */
336.           for (i = dctx->mdmax+1; i < mtype; ++i) {
337.               mdevp[i] = NULL;
                   ^
338.               mdord[i] = 0;
339.           }
