ssl/t1_lib.c:1821: error: BUFFER_OVERRUN_L1
  Offset: [0, +oo] Size: 0 by call to `tls1_set_sigalgs`.
Showing all 9 steps of the trace


ssl/t1_lib.c:1816:5: Assignment
1814.   {
1815.       sig_cb_st sig;
1816.       sig.sigalgcnt = 0;
            ^
1817.       if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
1818.           return 0;

ssl/t1_lib.c:1821:12: Call
1819.       if (c == NULL)
1820.           return 1;
1821.       return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
                   ^
1822.   }
1823.   

ssl/t1_lib.c:1825:1: <Length trace>
1823.   
1824.   /* TODO(TLS1.3): Needs updating to allow setting of TLS1.3 sig algs */
1825. > int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
1826.   {
1827.       unsigned int *sigalgs, *sptr;

ssl/t1_lib.c:1825:1: Parameter `salglen`
  1823.   
  1824.   /* TODO(TLS1.3): Needs updating to allow setting of TLS1.3 sig algs */
  1825. > int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
  1826.   {
  1827.       unsigned int *sigalgs, *sptr;

ssl/t1_lib.c:1832:15: Call
  1830.       if (salglen & 1)
  1831.           return 0;
  1832.       sigalgs = OPENSSL_malloc((salglen / 2) * sizeof(*sigalgs));
                        ^
  1833.       if (sigalgs == NULL)
  1834.           return 0;

crypto/mem.c:165:9: Assignment
    163.   
    164.       if (num <= 0)
    165.           return NULL;
                   ^
    166.   
    167.       FAILTEST();

ssl/t1_lib.c:1832:5: Assignment
  1830.       if (salglen & 1)
  1831.           return 0;
  1832.       sigalgs = OPENSSL_malloc((salglen / 2) * sizeof(*sigalgs));
              ^
  1833.       if (sigalgs == NULL)
  1834.           return 0;

ssl/t1_lib.c:1839:17: Assignment
  1837.        * RSA-PKCS1. For now we only allow setting of RSA-PKCS1
  1838.        */
  1839.       for (i = 0, sptr = sigalgs; i < salglen; i += 2) {
                          ^
  1840.           size_t j;
  1841.           const SIGALG_LOOKUP *curr;

ssl/t1_lib.c:1851:17: Array access: Offset: [0, +oo] Size: 0 by call to `tls1_set_sigalgs` 
  1849.                   continue;
  1850.               if (curr->hash == md_id && curr->sig == sig_id) {
  1851.                   *sptr++ = curr->sigalg;
                          ^
  1852.                   break;
  1853.               }
