ssl/t1_lib.c:523: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: 28 by call to `tls_curve_allowed`.
Showing all 7 steps of the trace


ssl/t1_lib.c:275:1: Array declaration
273.   	};
274.   
275. > static const unsigned char eccurves_default[] =
276.   	{
277.   		0,14, /* sect571r1 (14) */ 

ssl/t1_lib.c:523:10: Call
521.   			if (pref[0] == tsupp[0] && pref[1] == tsupp[1])
522.   				{
523.   				if (!tls_curve_allowed(s, pref, SSL_SECOP_CURVE_SHARED))
                ^
524.   					continue;
525.   				if (nmatch == k)

ssl/t1_lib.c:429:1: <Offset trace>
427.   
428.   /* See if curve is allowed by security callback */
429. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
430.   	{
431.   	const tls_curve_info *cinfo;

ssl/t1_lib.c:429:1: Parameter `*curve`
  427.   
  428.   /* See if curve is allowed by security callback */
  429. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
  430.   	{
  431.   	const tls_curve_info *cinfo;

ssl/t1_lib.c:235:1: <Length trace>
233.   #define TLS_CURVE_PRIME		0x0
234.   
235. > static const tls_curve_info nid_list[] =
236.   	{
237.   		{NID_sect163k1, 80, TLS_CURVE_CHAR2},/* sect163k1 (1) */

ssl/t1_lib.c:235:1: Array declaration
  233.   #define TLS_CURVE_PRIME		0x0
  234.   
  235. > static const tls_curve_info nid_list[] =
  236.   	{
  237.   		{NID_sect163k1, 80, TLS_CURVE_CHAR2},/* sect163k1 (1) */

ssl/t1_lib.c:437:2: Array access: Offset: [-1, +oo] Size: 28 by call to `tls_curve_allowed` 
  435.   				sizeof(nid_list)/sizeof(nid_list[0])))
  436.   		return 0;
  437.   	cinfo = &nid_list[curve[1]-1];
          ^
  438.   	return ssl_security(s, op, cinfo->secbits, cinfo->nid, (void *)curve);
  439.   	}
