ssl/record/ssl3_record.c:1095: error: BUFFER_OVERRUN_L2
  Offset added: [1, 123+max(0, `ssl->s3->read_mac_secret_size`)] (⇐ [64, 128] + [-63, -5+max(0, `ssl->s3->read_mac_secret_size`)]) Size: 104 by call to `ssl3_cbc_digest_record`.
Showing all 8 steps of the trace


ssl/record/ssl3_record.c:1034:1: Array declaration
1032.   }
1033.   
1034. > int tls1_mac(SSL *ssl, SSL3_RECORD *rec, unsigned char *md, int send)
1035.   {
1036.       unsigned char *seq;

ssl/record/ssl3_record.c:1095:13: Call
1093.            */
1094.           /* Final param == not SSLv3 */
1095.           if (ssl3_cbc_digest_record(mac_ctx,
                    ^
1096.                                      md, &md_size,
1097.                                      header, rec->input,

ssl/s3_cbc.c:192:5: <Offset trace>
190.       void (*md_final_raw) (void *ctx, unsigned char *md_out);
191.       void (*md_transform) (void *ctx, const unsigned char *block);
192.       unsigned md_size, md_block_size = 64;
           ^
193.       unsigned sslv3_pad_length = 40, header_length, variance_blocks,
194.           len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:192:5: Assignment
  190.       void (*md_final_raw) (void *ctx, unsigned char *md_out);
  191.       void (*md_transform) (void *ctx, const unsigned char *block);
  192.       unsigned md_size, md_block_size = 64;
             ^
  193.       unsigned sslv3_pad_length = 40, header_length, variance_blocks,
  194.           len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:421:13: Assignment
  419.                   return 0;
  420.               }
  421.               overhang = header_length - md_block_size;
                     ^
  422.               md_transform(md_state.c, header);
  423.               memcpy(first_block, header + md_block_size, overhang);

ssl/s3_cbc.c:176:1: <Length trace>
174.    * Returns 1 on success or 0 on error
175.    */
176. > int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
177.                               unsigned char *md_out,
178.                               size_t *md_out_size,

ssl/s3_cbc.c:176:1: Parameter `*header`
  174.    * Returns 1 on success or 0 on error
  175.    */
  176. > int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
  177.                               unsigned char *md_out,
  178.                               size_t *md_out_size,

ssl/s3_cbc.c:423:13: Array access: Offset added: [1, 123+max(0, ssl->s3->read_mac_secret_size)] (⇐ [64, 128] + [-63, -5+max(0, ssl->s3->read_mac_secret_size)]) Size: 104 by call to `ssl3_cbc_digest_record` 
  421.               overhang = header_length - md_block_size;
  422.               md_transform(md_state.c, header);
  423.               memcpy(first_block, header + md_block_size, overhang);
                     ^
  424.               memcpy(first_block + overhang, data, md_block_size - overhang);
  425.               md_transform(md_state.c, first_block);
