ssl/statem/statem_dtls.c:478: error: BUFFER_OVERRUN_L3
  Offset: 11 (⇐ 9 + 2) Size: [1, 2147483644].
Showing all 12 steps of the trace


ssl/statem/statem_dtls.c:434:1: <Length trace>
432.   }
433.   
434. > int dtls_get_message(SSL *s, int *mt, unsigned long *len)
435.   {
436.       struct hm_header_st *msg_hdr;

ssl/statem/statem_dtls.c:434:1: Parameter `*s->init_buf->data`
432.   }
433.   
434. > int dtls_get_message(SSL *s, int *mt, unsigned long *len)
435.   {
436.       struct hm_header_st *msg_hdr;

ssl/statem/statem_dtls.c:446:10: Call
444.   
445.    again:
446.       ok = dtls_get_reassembled_message(s, &tmplen);
                ^
447.       if (tmplen == DTLS1_HM_BAD_FRAGMENT
448.           || tmplen == DTLS1_HM_FRAGMENT_RETRY) {

ssl/statem/statem_dtls.c:810:1: Parameter `*s->init_buf->data`
  808.   }
  809.   
  810. > static int dtls_get_reassembled_message(SSL *s, long *len)
  811.   {
  812.       unsigned char wire[DTLS1_HM_HEADER_LENGTH];

ssl/statem/statem_dtls.c:820:21: Call
  818.    redo:
  819.       /* see if we have the required fragment already */
  820.       if ((frag_len = dtls1_retrieve_buffered_fragment(s, &ok)) || ok) {
                             ^
  821.           if (ok)
  822.               s->init_num = frag_len;

ssl/statem/statem_dtls.c:542:1: Parameter `*s->init_buf->data`
    540.   }
    541.   
    542. > static int dtls1_retrieve_buffered_fragment(SSL *s, int *ok)
    543.   {
    544.       /*-

ssl/statem/statem_dtls.c:457:5: Assignment
455.       *mt = s->s3->tmp.message_type;
456.   
457.       p = (unsigned char *)s->init_buf->data;
           ^
458.   
459.       if (*mt == SSL3_MT_CHANGE_CIPHER_SPEC) {

ssl/statem/statem_dtls.c:474:7: Assignment
472.   
473.       /* reconstruct message header */
474.       *(p++) = msg_hdr->type;
             ^
475.       l2n3(msg_len, p);
476.       s2n(msg_hdr->seq, p);

ssl/statem/statem_dtls.c:475:5: Assignment
473.       /* reconstruct message header */
474.       *(p++) = msg_hdr->type;
475.       l2n3(msg_len, p);
           ^
476.       s2n(msg_hdr->seq, p);
477.       l2n3(0, p);

ssl/statem/statem_dtls.c:476:5: Assignment
474.       *(p++) = msg_hdr->type;
475.       l2n3(msg_len, p);
476.       s2n(msg_hdr->seq, p);
           ^
477.       l2n3(0, p);
478.       l2n3(msg_len, p);

ssl/statem/statem_dtls.c:477:5: Assignment
475.       l2n3(msg_len, p);
476.       s2n(msg_hdr->seq, p);
477.       l2n3(0, p);
           ^
478.       l2n3(msg_len, p);
479.       if (s->version != DTLS1_BAD_VER) {

ssl/statem/statem_dtls.c:478:5: Array access: Offset: 11 (⇐ 9 + 2) Size: [1, 2147483644]
476.       s2n(msg_hdr->seq, p);
477.       l2n3(0, p);
478.       l2n3(msg_len, p);
           ^
479.       if (s->version != DTLS1_BAD_VER) {
480.           p -= DTLS1_HM_HEADER_LENGTH;
