ssl/t1_lib.c:1989: error: BUFFER_OVERRUN_L3
  Offset added: [0, 255] Size: [8, 2048] by call to `PACKET_copy_bytes`.
Showing all 11 steps of the trace


ssl/t1_lib.c:1969:29: Call
1967.               while (PACKET_remaining(&ssubpkt) > 3) {
1968.                   if (!PACKET_get_1(&ssubpkt, &servname_type)
1969.                           || !PACKET_get_net_2(&ssubpkt, &len)
                                    ^
1970.                           || PACKET_remaining(&ssubpkt) < len)
1971.                       goto err;

ssl/packet_locl.h:197:10: Call
  195.                                                  unsigned int *data)
  196.   {
  197.       if (!PACKET_peek_net_2(pkt, data))
                  ^
  198.           return 0;
  199.   

ssl/packet_locl.h:180:8: Parameter `*data`
    178.    * |*data|
    179.    */
    180.   __owur static ossl_inline int PACKET_peek_net_2(const PACKET *pkt,
                  ^
    181.                                                   unsigned int *data)
    182.   {

ssl/t1_lib.c:1989:34: Call
1987.                                   return 0;
1988.                               }
1989.                               if (!PACKET_copy_bytes(&ssubpkt,
                                         ^
1990.                                       (unsigned char *)s->session
1991.                                           ->tlsext_hostname,

ssl/packet_locl.h:375:8: Parameter `len`
  373.    * The caller is responsible for ensuring that |data| can hold |len| bytes.
  374.    */
  375.   __owur static ossl_inline int PACKET_copy_bytes(PACKET *pkt,
                ^
  376.                                                   unsigned char *data,
  377.                                                   size_t len)

ssl/packet_locl.h:379:10: Call
  377.                                                   size_t len)
  378.   {
  379.       if (!PACKET_peek_copy_bytes(pkt, data, len))
                  ^
  380.           return 0;
  381.   

ssl/packet_locl.h:359:8: <Offset trace>
357.   
358.   /* Peek ahead at |len| bytes from |pkt| and copy them to |data| */
359.   __owur static ossl_inline int PACKET_peek_copy_bytes(const PACKET *pkt,
              ^
360.                                                        unsigned char *data,
361.                                                        size_t len)

ssl/packet_locl.h:359:8: Parameter `len`
    357.   
    358.   /* Peek ahead at |len| bytes from |pkt| and copy them to |data| */
    359.   __owur static ossl_inline int PACKET_peek_copy_bytes(const PACKET *pkt,
                  ^
    360.                                                        unsigned char *data,
    361.                                                        size_t len)

ssl/packet_locl.h:359:8: <Length trace>
357.   
358.   /* Peek ahead at |len| bytes from |pkt| and copy them to |data| */
359.   __owur static ossl_inline int PACKET_peek_copy_bytes(const PACKET *pkt,
              ^
360.                                                        unsigned char *data,
361.                                                        size_t len)

ssl/packet_locl.h:359:8: Parameter `*data`
    357.   
    358.   /* Peek ahead at |len| bytes from |pkt| and copy them to |data| */
    359.   __owur static ossl_inline int PACKET_peek_copy_bytes(const PACKET *pkt,
                  ^
    360.                                                        unsigned char *data,
    361.                                                        size_t len)

ssl/packet_locl.h:366:5: Array access: Offset added: [0, 255] Size: [8, 2048] by call to `PACKET_copy_bytes` 
    364.           return 0;
    365.   
    366.       memcpy(data, pkt->curr, len);
               ^
    367.   
    368.       return 1;
