ssl/statem/statem_srvr.c:2674: error: BUFFER_OVERRUN_L3
  Offset added: [1, 15] Size: [0, +oo] by call to `ssl_randbytes`.
Showing all 10 steps of the trace


ssl/statem/statem_srvr.c:2674:9: Call
2672.        */
2673.   
2674.       if (ssl_randbytes(s, rand_premaster_secret, sizeof(rand_premaster_secret)) <= 0)
                ^
2675.           goto err;
2676.   

ssl/ssl_lib.c:5097:1: Parameter `size`
  5095.   }
  5096.   
  5097. > int ssl_randbytes(SSL *s, unsigned char *rnd, size_t size)
  5098.   {
  5099.       if (s->drbg != NULL)

ssl/ssl_lib.c:5100:16: Call
  5098.   {
  5099.       if (s->drbg != NULL)
  5100.           return RAND_DRBG_generate(s->drbg, rnd, size, 0, NULL, 0);
                         ^
  5101.       return RAND_bytes(rnd, (int)size);
  5102.   }

crypto/rand/drbg_lib.c:248:1: Parameter `outlen`
    246.    * sent in |adin| and |adinlen|.
    247.    */
    248. > int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,
    249.                          int prediction_resistance,
    250.                          const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_lib.c:281:10: Call
    279.       }
    280.   
    281.       if (!ctr_generate(drbg, out, outlen, adin, adinlen)) {
                    ^
    282.           drbg->state = DRBG_ERROR;
    283.           RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);

crypto/rand/drbg_rand.c:261:1: <Offset trace>
259.   }
260.   
261. > int ctr_generate(RAND_DRBG *drbg,
262.                    unsigned char *out, size_t outlen,
263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:261:1: Parameter `outlen`
      259.   }
      260.   
      261. > int ctr_generate(RAND_DRBG *drbg,
      262.                    unsigned char *out, size_t outlen,
      263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:261:1: <Length trace>
259.   }
260.   
261. > int ctr_generate(RAND_DRBG *drbg,
262.                    unsigned char *out, size_t outlen,
263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:261:1: Parameter `drbg->ctr.K[*]`
      259.   }
      260.   
      261. > int ctr_generate(RAND_DRBG *drbg,
      262.                    unsigned char *out, size_t outlen,
      263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:283:13: Array access: Offset added: [1, 15] Size: [0, +oo] by call to `ssl_randbytes` 
      281.               /* Use K as temp space as it will be updated */
      282.               AES_encrypt(ctr->V, ctr->K, &ctr->ks);
      283.               memcpy(out, ctr->K, outlen);
                         ^
      284.               break;
      285.           }
