test/sslapitest.c:2093: error: BUFFER_OVERRUN_L3
  Offset added: [56, +oo] (⇐ [0, +oo] + 56) Size: [1, +oo] by call to `SSL_CTX_use_serverinfo_ex`.
Showing all 15 steps of the trace


test/sslapitest.c:2093:15: Call
2091.   
2092.       if ((tst & 0x04) == 0x04) {
2093.           ret = SSL_CTX_use_serverinfo_ex(ctx, version, sibuf, sibuflen);
                      ^
2094.       } else {
2095.           ret = SSL_CTX_use_serverinfo(ctx, sibuf, sibuflen);

ssl/ssl_rsa.c:861:1: Parameter `ctx->cert->custext.meths_count`
  859.   }
  860.   
  861. > int SSL_CTX_use_serverinfo_ex(SSL_CTX *ctx, unsigned int version,
  862.                                 const unsigned char *serverinfo,
  863.                                 size_t serverinfo_length)

ssl/ssl_rsa.c:894:10: Call
  892.        * register callbacks.
  893.        */
  894.       if (!serverinfo_process_buffer(version, serverinfo, serverinfo_length,
                  ^
  895.                                      ctx)) {
  896.           SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, SSL_R_INVALID_SERVERINFO_DATA);

ssl/ssl_rsa.c:802:1: Parameter `ctx->cert->custext.meths_count`
    800.    * the included extensions.
    801.    */
    802. > static int serverinfo_process_buffer(unsigned int version,
    803.                                        const unsigned char *serverinfo,
    804.                                        size_t serverinfo_length, SSL_CTX *ctx)

ssl/ssl_rsa.c:842:18: Call
    840.            */
    841.           if (version == SSL_SERVERINFOV1 || context == SYNTHV1CONTEXT) {
    842.               if (!SSL_CTX_add_server_custom_ext(ctx, ext_type,
                            ^
    843.                                                  serverinfo_srv_add_cb,
    844.                                                  NULL, NULL,

ssl/statem/extensions_cust.c:429:1: Parameter `ctx->cert->custext.meths_count`
      427.   }
      428.   
      429. > int SSL_CTX_add_server_custom_ext(SSL_CTX *ctx, unsigned int ext_type,
      430.                                     custom_ext_add_cb add_cb,
      431.                                     custom_ext_free_cb free_cb,

ssl/statem/extensions_cust.c:435:12: Call
      433.                                     custom_ext_parse_cb parse_cb, void *parse_arg)
      434.   {
      435.       return add_old_custom_ext(ctx, ENDPOINT_SERVER, ext_type,
                        ^
      436.                                 SSL_EXT_TLS1_2_AND_BELOW_ONLY
      437.                                 | SSL_EXT_CLIENT_HELLO

ssl/statem/extensions_cust.c:372:1: Parameter `ctx->cert->custext.meths_count`
        370.   }
        371.   
        372. > static int add_old_custom_ext(SSL_CTX *ctx, ENDPOINT role,
        373.                                 unsigned int ext_type,
        374.                                 unsigned int context,

ssl/statem/extensions_cust.c:398:11: Call
        396.       parse_cb_wrap->parse_cb = parse_cb;
        397.   
        398.       ret = add_custom_ext_intern(ctx, role, ext_type,
                         ^
        399.                                   context,
        400.                                   custom_ext_add_old_cb_wrap,

ssl/statem/extensions_cust.c:307:1: <Length trace>
305.   }
306.   
307. > static int add_custom_ext_intern(SSL_CTX *ctx, ENDPOINT role,
308.                                    unsigned int ext_type,
309.                                    unsigned int context,

ssl/statem/extensions_cust.c:307:1: Parameter `ctx->cert->custext.meths_count`
          305.   }
          306.   
          307. > static int add_custom_ext_intern(SSL_CTX *ctx, ENDPOINT role,
          308.                                    unsigned int ext_type,
          309.                                    unsigned int context,

ssl/statem/extensions_cust.c:350:9: Call
          348.           return 0;
          349.       /* Search for duplicate */
          350.       if (custom_ext_find(exts, role, ext_type, NULL))
                         ^
          351.           return 0;
          352.       tmp = OPENSSL_realloc(exts->meths,

ssl/statem/extensions_cust.c:81:1: Parameter `exts->meths_count`
            79.    * client, or ENDPOINT_BOTH for either
            80.    */
            81. > custom_ext_method *custom_ext_find(const custom_ext_methods *exts,
            82.                                      ENDPOINT role, unsigned int ext_type,
            83.                                      size_t *idx)

ssl/statem/extensions_cust.c:358:5: Assignment
          356.   
          357.       exts->meths = tmp;
          358.       meth = exts->meths + exts->meths_count;
                     ^
          359.       memset(meth, 0, sizeof(*meth));
          360.       meth->role = role;

ssl/statem/extensions_cust.c:359:5: Array access: Offset added: [56, +oo] (⇐ [0, +oo] + 56) Size: [1, +oo] by call to `SSL_CTX_use_serverinfo_ex` 
          357.       exts->meths = tmp;
          358.       meth = exts->meths + exts->meths_count;
          359.       memset(meth, 0, sizeof(*meth));
                     ^
          360.       meth->role = role;
          361.       meth->context = context;
