ssl/s3_enc.c:798: error: BUFFER_OVERRUN_L3
  Offset added: [-115, +oo] Size: 128 by call to `ssl3_cbc_digest_record`.
Showing all 12 steps of the trace


ssl/s3_enc.c:737:1: Parameter `ssl->read_hash->digest->md_size`
735.   	}
736.   
737. > int n_ssl3_mac(SSL *ssl, unsigned char *md, int send)
738.   	{
739.   	SSL3_RECORD *rec;

ssl/s3_enc.c:763:4: Call
761.   		}
762.   
763.   	t=EVP_MD_CTX_size(hash);
          ^
764.   	if (t < 0)
765.   		return -1;

crypto/evp/evp_lib.c:283:3: Assignment
  281.   		{
  282.   		EVPerr(EVP_F_EVP_MD_SIZE, EVP_R_MESSAGE_DIGEST_IS_NULL);
  283.   		return -1;
           ^
  284.   		}
  285.   	return md->md_size;

ssl/s3_enc.c:763:2: Assignment
761.   		}
762.   
763.   	t=EVP_MD_CTX_size(hash);
        ^
764.   	if (t < 0)
765.   		return -1;

ssl/s3_enc.c:766:2: Assignment
764.   	if (t < 0)
765.   		return -1;
766.   	md_size=t;
        ^
767.   	npad=(48/md_size)*md_size;
768.   

ssl/s3_enc.c:798:3: Call
796.   
797.   		/* Final param == is SSLv3 */
798.   		ssl3_cbc_digest_record(
         ^
799.   			hash,
800.   			md, &md_size,

ssl/s3_cbc.c:418:2: <Offset trace>
416.   	void (*md_final_raw)(void *ctx, unsigned char *md_out);
417.   	void (*md_transform)(void *ctx, const unsigned char *block);
418.   	unsigned md_size, md_block_size = 64;
        ^
419.   	unsigned sslv3_pad_length = 40, header_length, variance_blocks,
420.   		 len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:418:2: Assignment
  416.   	void (*md_final_raw)(void *ctx, unsigned char *md_out);
  417.   	void (*md_transform)(void *ctx, const unsigned char *block);
  418.   	unsigned md_size, md_block_size = 64;
          ^
  419.   	unsigned sslv3_pad_length = 40, header_length, variance_blocks,
  420.   		 len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:614:4: Assignment
  612.   			 * block that the header consumes: either 7 bytes
  613.   			 * (SHA1) or 11 bytes (MD5). */
  614.   			unsigned overhang = header_length-md_block_size;
            ^
  615.   			md_transform(md_state.c, header);
  616.   			memcpy(first_block, header + md_block_size, overhang);

ssl/s3_cbc.c:402:1: <Length trace>
400.    * padding too. ) 
401.    */
402. > void ssl3_cbc_digest_record(
403.   	const EVP_MD_CTX *ctx,
404.   	unsigned char* md_out,

ssl/s3_cbc.c:402:1: Array declaration
  400.    * padding too. ) 
  401.    */
  402. > void ssl3_cbc_digest_record(
  403.   	const EVP_MD_CTX *ctx,
  404.   	unsigned char* md_out,

ssl/s3_cbc.c:616:4: Array access: Offset added: [-115, +oo] Size: 128 by call to `ssl3_cbc_digest_record` 
  614.   			unsigned overhang = header_length-md_block_size;
  615.   			md_transform(md_state.c, header);
  616.   			memcpy(first_block, header + md_block_size, overhang);
            ^
  617.   			memcpy(first_block + overhang, data, md_block_size-overhang);
  618.   			md_transform(md_state.c, first_block);
