ssl/t1_lib.c:3133: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [1, +oo] by call to `d2i_SSL_SESSION`.
Showing all 33 steps of the trace


ssl/t1_lib.c:3117:22: Call
3115.       /* Move p after IV to start of encrypted ticket, update length */
3116.       p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3117.       eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
                             ^
3118.       sdec = OPENSSL_malloc(eticklen);
3119.       if (sdec == NULL

crypto/evp/evp_lib.c:260:1: Parameter `ctx->cipher->iv_len`
  258.   }
  259.   
  260. > int EVP_CIPHER_CTX_iv_length(const EVP_CIPHER_CTX *ctx)
  261.   {
  262.       return ctx->cipher->iv_len;

crypto/evp/evp_lib.c:262:5: Assignment
  260.   int EVP_CIPHER_CTX_iv_length(const EVP_CIPHER_CTX *ctx)
  261.   {
  262.       return ctx->cipher->iv_len;
             ^
  263.   }
  264.   

ssl/t1_lib.c:3117:5: Assignment
3115.       /* Move p after IV to start of encrypted ticket, update length */
3116.       p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3117.       eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
            ^
3118.       sdec = OPENSSL_malloc(eticklen);
3119.       if (sdec == NULL

ssl/t1_lib.c:3118:12: Call
3116.       p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3117.       eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3118.       sdec = OPENSSL_malloc(eticklen);
                   ^
3119.       if (sdec == NULL
3120.               || EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen) <= 0) {

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

ssl/t1_lib.c:3118:5: Assignment
3116.       p = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3117.       eticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);
3118.       sdec = OPENSSL_malloc(eticklen);
            ^
3119.       if (sdec == NULL
3120.               || EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen) <= 0) {

ssl/t1_lib.c:3131:5: Assignment
3129.       slen += mlen;
3130.       EVP_CIPHER_CTX_cleanup(&ctx);
3131.       p = sdec;
            ^
3132.   
3133.       sess = d2i_SSL_SESSION(NULL, &p, slen);

ssl/t1_lib.c:3133:12: Call
3131.       p = sdec;
3132.   
3133.       sess = d2i_SSL_SESSION(NULL, &p, slen);
                   ^
3134.       OPENSSL_free(sdec);
3135.       if (sess) {

ssl/ssl_asn1.c:288:1: Parameter `**pp`
  286.   }
  287.   
  288. > SSL_SESSION *d2i_SSL_SESSION(SSL_SESSION **a, const unsigned char **pp,
  289.                                long length)
  290.   {

ssl/ssl_asn1.c:293:5: Assignment
  291.       long id;
  292.       unsigned int tmpl;
  293.       const unsigned char *p = *pp;
             ^
  294.       SSL_SESSION_ASN1 *as = NULL;
  295.       SSL_SESSION *ret = NULL;

ssl/ssl_asn1.c:297:10: Call
  295.       SSL_SESSION *ret = NULL;
  296.   
  297.       as = d2i_SSL_SESSION_ASN1(NULL, &p, length);
                  ^
  298.       /* ASN.1 code returns suitable error */
  299.       if (as == NULL)

ssl/ssl_asn1.c:143:1: Parameter `**in`
    141.   } static_ASN1_SEQUENCE_END(SSL_SESSION_ASN1)
    142.   
    143. > IMPLEMENT_STATIC_ASN1_ENCODE_FUNCTIONS(SSL_SESSION_ASN1)
    144.   
    145.   /* Utility functions for i2d_SSL_SESSION */

ssl/ssl_asn1.c:143:1: Call
    141.   } static_ASN1_SEQUENCE_END(SSL_SESSION_ASN1)
    142.   
    143. > IMPLEMENT_STATIC_ASN1_ENCODE_FUNCTIONS(SSL_SESSION_ASN1)
    144.   
    145.   /* Utility functions for i2d_SSL_SESSION */

crypto/asn1/tasn_dec.c:144:1: Parameter `**in`
      142.    */
      143.   
      144. > ASN1_VALUE *ASN1_item_d2i(ASN1_VALUE **pval,
      145.                             const unsigned char **in, long len,
      146.                             const ASN1_ITEM *it)

crypto/asn1/tasn_dec.c:153:9: Call
      151.           pval = &ptmpval;
      152.       asn1_tlc_clear_nc(&c);
      153.       if (ASN1_item_ex_d2i(pval, in, len, it, -1, 0, 0, &c) > 0)
                     ^
      154.           return *pval;
      155.       return NULL;

crypto/asn1/tasn_dec.c:158:1: Parameter `**in`
        156.   }
        157.   
        158. > int ASN1_item_ex_d2i(ASN1_VALUE **pval, const unsigned char **in, long len,
        159.                        const ASN1_ITEM *it,
        160.                        int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:163:10: Call
        161.   {
        162.       int rv;
        163.       rv = asn1_item_embed_d2i(pval, in, len, it, tag, aclass, opt, ctx);
                        ^
        164.       if (rv <= 0)
        165.           ASN1_item_ex_free(pval, it);

crypto/asn1/tasn_dec.c:174:1: Parameter `**in`
          172.    */
          173.   
          174. > static int asn1_item_embed_d2i(ASN1_VALUE **pval, const unsigned char **in,
          175.                                  long len, const ASN1_ITEM *it,
          176.                                  int tag, int aclass, char opt, ASN1_TLC *ctx)

crypto/asn1/tasn_dec.c:218:9: Assignment
          216.   
          217.       case ASN1_ITYPE_MSTRING:
          218.           p = *in;
                         ^
          219.           /* Just read in tag and class */
          220.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,

crypto/asn1/tasn_dec.c:220:15: Call
          218.           p = *in;
          219.           /* Just read in tag and class */
          220.           ret = asn1_check_tlen(NULL, &otag, &oclass, NULL, NULL,
                               ^
          221.                                 &p, len, -1, 0, 1, ctx);
          222.           if (!ret) {

crypto/asn1/tasn_dec.c:1098:1: Parameter `**in`
            1096.    */
            1097.   
            1098. > static int asn1_check_tlen(long *olen, int *otag, unsigned char *oclass,
            1099.                              char *inf, char *cst,
            1100.                              const unsigned char **in, long len,

crypto/asn1/tasn_dec.c:1107:5: Assignment
            1105.       long plen;
            1106.       const unsigned char *p, *q;
            1107.       p = *in;
                        ^
            1108.       q = p;
            1109.   

crypto/asn1/tasn_dec.c:1117:13: Call
            1115.           p += ctx->hdrlen;
            1116.       } else {
            1117.           i = ASN1_get_object(&p, &plen, &ptag, &pclass, len);
                                ^
            1118.           if (ctx) {
            1119.               ctx->ret = i;

crypto/asn1/asn1_lib.c:92:1: Parameter `**pp`
              90.   }
              91.   
              92. > int ASN1_get_object(const unsigned char **pp, long *plength, int *ptag,
              93.                       int *pclass, long omax)
              94.   {

crypto/asn1/asn1_lib.c:97:5: Assignment
              95.       int i, ret;
              96.       long l;
              97.       const unsigned char *p = *pp;
                         ^
              98.       int tag, xclass, inf;
              99.       long max = omax;

crypto/asn1/asn1_lib.c:126:9: Assignment
              124.       } else {
              125.           tag = i;
              126.           p++;
                             ^
              127.           if (--max == 0)
              128.               goto err;

crypto/asn1/asn1_lib.c:132:10: Call
              130.       *ptag = tag;
              131.       *pclass = xclass;
              132.       if (!asn1_get_length(&p, &inf, plength, (int)max))
                              ^
              133.           goto err;
              134.   

crypto/asn1/asn1_lib.c:153:1: <Length trace>
151.   }
152.   
153. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
154.                              int max)
155.   {

crypto/asn1/asn1_lib.c:153:1: Parameter `**pp`
                151.   }
                152.   
                153. > static int asn1_get_length(const unsigned char **pp, int *inf, long *rl,
                154.                              int max)
                155.   {

crypto/asn1/asn1_lib.c:156:5: Assignment
                154.                              int max)
                155.   {
                156.       const unsigned char *p = *pp;
                           ^
                157.       unsigned long ret = 0;
                158.       unsigned int i;

crypto/asn1/asn1_lib.c:169:15: Assignment
                167.           *inf = 0;
                168.           i = *p & 0x7f;
                169.           if (*(p++) & 0x80) {
                                     ^
                170.               if (max < (int)i)
                171.                   return 0;

crypto/asn1/asn1_lib.c:173:25: Array access: Offset: [2, +oo] Size: [1, +oo] by call to `d2i_SSL_SESSION` 
                171.                   return 0;
                172.               /* Skip leading zeroes */
                173.               while (i && *p == 0) {
                                               ^
                174.                   p++;
                175.                   i--;
