ssl/ssl_lib.c:338: error: BUFFER_OVERRUN_S2
  Offset: [`dctx->mdmax` + 1, `mtype` - 1] Size: [1, 8⋅`mtype` + 8].
Showing all 8 steps of the trace


ssl/ssl_lib.c:303:1: <Offset trace>
301.   }
302.   
303. > static int dane_mtype_set(
304.       struct dane_ctx_st *dctx,
305.       const EVP_MD *md,

ssl/ssl_lib.c:303:1: Parameter `mtype`
301.   }
302.   
303. > static int dane_mtype_set(
304.       struct dane_ctx_st *dctx,
305.       const EVP_MD *md,

ssl/ssl_lib.c:303:1: <Length trace>
301.   }
302.   
303. > static int dane_mtype_set(
304.       struct dane_ctx_st *dctx,
305.       const EVP_MD *md,

ssl/ssl_lib.c:303:1: Parameter `*dctx->mdevp`
301.   }
302.   
303. > static int dane_mtype_set(
304.       struct dane_ctx_st *dctx,
305.       const EVP_MD *md,

ssl/ssl_lib.c:322:17: Call
320.           int n = ((int) mtype) + 1;
321.   
322.           mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp));
                       ^
323.           if (mdevp == NULL) {
324.               SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);

crypto/mem.c:178:9: Assignment
  176.       if (num == 0) {
  177.           CRYPTO_free(str, file, line);
  178.           return NULL;
                 ^
  179.       }
  180.   

ssl/ssl_lib.c:322:9: Assignment
320.           int n = ((int) mtype) + 1;
321.   
322.           mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp));
               ^
323.           if (mdevp == NULL) {
324.               SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);

ssl/ssl_lib.c:338:13: Array access: Offset: [dctx->mdmax + 1, mtype - 1] Size: [1, 8⋅mtype + 8]
336.           /* Zero-fill any gaps */
337.           for (i = dctx->mdmax+1; i < mtype; ++i) {
338.               mdevp[i] = NULL;
                   ^
339.               mdord[i] = 0;
340.           }
