ssl/ssl_rsa.c:871: error: BUFFER_OVERRUN_L3
  Offset added: [56, +oo] (⇐ [0, +oo] + 56) Size: [1, +oo] by call to `serverinfo_process_buffer`.
Showing all 13 steps of the trace


ssl/ssl_rsa.c:871:10: Call
869.           return 0;
870.       }
871.       if (!serverinfo_process_buffer(version, serverinfo, serverinfo_length,
                ^
872.                                      NULL)) {
873.           SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, SSL_R_INVALID_SERVERINFO_DATA);

ssl/ssl_rsa.c:802:1: Parameter `ctx->cert->custext.meths_count`
  800.    * the included extensions.
  801.    */
  802. > static int serverinfo_process_buffer(unsigned int version,
  803.                                        const unsigned char *serverinfo,
  804.                                        size_t serverinfo_length, SSL_CTX *ctx)

ssl/ssl_rsa.c:842:18: Call
  840.            */
  841.           if (version == SSL_SERVERINFOV1 || context == SYNTHV1CONTEXT) {
  842.               if (!SSL_CTX_add_server_custom_ext(ctx, ext_type,
                          ^
  843.                                                  serverinfo_srv_add_cb,
  844.                                                  NULL, NULL,

ssl/statem/extensions_cust.c:429:1: Parameter `ctx->cert->custext.meths_count`
    427.   }
    428.   
    429. > int SSL_CTX_add_server_custom_ext(SSL_CTX *ctx, unsigned int ext_type,
    430.                                     custom_ext_add_cb add_cb,
    431.                                     custom_ext_free_cb free_cb,

ssl/statem/extensions_cust.c:435:12: Call
    433.                                     custom_ext_parse_cb parse_cb, void *parse_arg)
    434.   {
    435.       return add_old_custom_ext(ctx, ENDPOINT_SERVER, ext_type,
                      ^
    436.                                 SSL_EXT_TLS1_2_AND_BELOW_ONLY
    437.                                 | SSL_EXT_CLIENT_HELLO

ssl/statem/extensions_cust.c:372:1: Parameter `ctx->cert->custext.meths_count`
      370.   }
      371.   
      372. > static int add_old_custom_ext(SSL_CTX *ctx, ENDPOINT role,
      373.                                 unsigned int ext_type,
      374.                                 unsigned int context,

ssl/statem/extensions_cust.c:398:11: Call
      396.       parse_cb_wrap->parse_cb = parse_cb;
      397.   
      398.       ret = add_custom_ext_intern(ctx, role, ext_type,
                       ^
      399.                                   context,
      400.                                   custom_ext_add_old_cb_wrap,

ssl/statem/extensions_cust.c:307:1: <Length trace>
305.   }
306.   
307. > static int add_custom_ext_intern(SSL_CTX *ctx, ENDPOINT role,
308.                                    unsigned int ext_type,
309.                                    unsigned int context,

ssl/statem/extensions_cust.c:307:1: Parameter `ctx->cert->custext.meths_count`
        305.   }
        306.   
        307. > static int add_custom_ext_intern(SSL_CTX *ctx, ENDPOINT role,
        308.                                    unsigned int ext_type,
        309.                                    unsigned int context,

ssl/statem/extensions_cust.c:350:9: Call
        348.           return 0;
        349.       /* Search for duplicate */
        350.       if (custom_ext_find(exts, role, ext_type, NULL))
                       ^
        351.           return 0;
        352.       tmp = OPENSSL_realloc(exts->meths,

ssl/statem/extensions_cust.c:81:1: Parameter `exts->meths_count`
          79.    * client, or ENDPOINT_BOTH for either
          80.    */
          81. > custom_ext_method *custom_ext_find(const custom_ext_methods *exts,
          82.                                      ENDPOINT role, unsigned int ext_type,
          83.                                      size_t *idx)

ssl/statem/extensions_cust.c:358:5: Assignment
        356.   
        357.       exts->meths = tmp;
        358.       meth = exts->meths + exts->meths_count;
                   ^
        359.       memset(meth, 0, sizeof(*meth));
        360.       meth->role = role;

ssl/statem/extensions_cust.c:359:5: Array access: Offset added: [56, +oo] (⇐ [0, +oo] + 56) Size: [1, +oo] by call to `serverinfo_process_buffer` 
        357.       exts->meths = tmp;
        358.       meth = exts->meths + exts->meths_count;
        359.       memset(meth, 0, sizeof(*meth));
                   ^
        360.       meth->role = role;
        361.       meth->context = context;
