ssl/s3_lib.c:3462: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 1] by call to `tls1_set_groups`.
Showing all 9 steps of the trace


ssl/s3_lib.c:3462:20: Call
3460.               if (nid == NID_undef)
3461.                   return 0;
3462.               return tls1_set_groups(&s->ext.supportedgroups,
                           ^
3463.                                      &s->ext.supportedgroups_len,
3464.                                      &nid, 1);

ssl/t1_lib.c:335:1: <Offset trace>
333.   }
334.   
335. > int tls1_set_groups(uint16_t **pext, size_t *pextlen,
336.                       int *groups, size_t ngroups)
337.   {

ssl/t1_lib.c:335:1: Parameter `ngroups`
  333.   }
  334.   
  335. > int tls1_set_groups(uint16_t **pext, size_t *pextlen,
  336.                       int *groups, size_t ngroups)
  337.   {

ssl/t1_lib.c:335:1: <Length trace>
333.   }
334.   
335. > int tls1_set_groups(uint16_t **pext, size_t *pextlen,
336.                       int *groups, size_t ngroups)
337.   {

ssl/t1_lib.c:335:1: Parameter `ngroups`
  333.   }
  334.   
  335. > int tls1_set_groups(uint16_t **pext, size_t *pextlen,
  336.                       int *groups, size_t ngroups)
  337.   {

ssl/t1_lib.c:346:18: Call
  344.       unsigned long dup_list = 0;
  345.   
  346.       if ((glist = OPENSSL_malloc(ngroups * sizeof(*glist))) == NULL) {
                          ^
  347.           SSLerr(SSL_F_TLS1_SET_GROUPS, ERR_R_MALLOC_FAILURE);
  348.           return 0;

crypto/mem.c:201:9: Assignment
    199.   
    200.       if (num == 0)
    201.           return NULL;
                   ^
    202.   
    203.       FAILTEST();

ssl/t1_lib.c:346:10: Assignment
  344.       unsigned long dup_list = 0;
  345.   
  346.       if ((glist = OPENSSL_malloc(ngroups * sizeof(*glist))) == NULL) {
                  ^
  347.           SSLerr(SSL_F_TLS1_SET_GROUPS, ERR_R_MALLOC_FAILURE);
  348.           return 0;

ssl/t1_lib.c:361:9: Array access: Offset: 0 Size: [0, 1] by call to `tls1_set_groups` 
  359.           }
  360.           dup_list |= idmask;
  361.           glist[i] = id;
                 ^
  362.       }
  363.       OPENSSL_free(*pext);
