ssl/statem/statem_clnt.c:1823: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: 28 by call to `tls1_check_curve`.
Showing all 9 steps of the trace


ssl/statem/statem_clnt.c:1593:1: Parameter `*pkt->curr`
1591.   }
1592.   
1593. > MSG_PROCESS_RETURN tls_process_key_exchange(SSL *s, PACKET *pkt)
1594.   {
1595.   #ifndef OPENSSL_NO_RSA

ssl/statem/statem_clnt.c:1823:14: Call
1821.            * invalid curve. ECParameters is 3 bytes.
1822.            */
1823.           if (!tls1_check_curve(s, ecparams, 3)) {
                     ^
1824.               SSLerr(SSL_F_TLS_PROCESS_KEY_EXCHANGE, SSL_R_WRONG_CURVE);
1825.               goto f_err;

ssl/t1_lib.c:266:1: Array declaration
  264.   
  265.   /* The client's default curves / the server's 'auto' curves. */
  266. > static const unsigned char eccurves_auto[] = {
  267.       /* Prefer P-256 which has the fastest and most secure implementations. */
  268.       0, 23,                      /* secp256r1 (23) */

ssl/t1_lib.c:507:20: Call
  505.       for (i = 0; i < num_curves; i++, curves += 2) {
  506.           if (p[1] == curves[0] && p[2] == curves[1])
  507.               return tls_curve_allowed(s, p + 1, SSL_SECOP_CURVE_CHECK);
                            ^
  508.       }
  509.       return 0;

ssl/t1_lib.c:466:1: <Offset trace>
464.   
465.   /* See if curve is allowed by security callback */
466. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
467.   {
468.       const tls_curve_info *cinfo;

ssl/t1_lib.c:466:1: Parameter `*curve`
    464.   
    465.   /* See if curve is allowed by security callback */
    466. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
    467.   {
    468.       const tls_curve_info *cinfo;

ssl/t1_lib.c:228:1: <Length trace>
226.   # define TLS_CURVE_PRIME         0x0
227.   
228. > static const tls_curve_info nid_list[] = {
229.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
230.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:228:1: Array declaration
    226.   # define TLS_CURVE_PRIME         0x0
    227.   
    228. > static const tls_curve_info nid_list[] = {
    229.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
    230.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:473:5: Array access: Offset: [-1, +oo] Size: 28 by call to `tls1_check_curve` 
    471.       if ((curve[1] < 1) || ((size_t)curve[1] > OSSL_NELEM(nid_list)))
    472.           return 0;
    473.       cinfo = &nid_list[curve[1] - 1];
               ^
    474.   # ifdef OPENSSL_NO_EC2M
    475.       if (cinfo->flags & TLS_CURVE_CHAR2)
