ssl/d1_lib.c:772: error: BUFFER_OVERRUN_L3
  Offset: 24 (⇐ 22 + 2) Size: [1, 2147483644].
Showing all 10 steps of the trace


ssl/d1_lib.c:536:14: <Length trace>
534.           }
535.   
536.           if (!BUF_MEM_grow(bufm, SSL3_RT_MAX_PLAIN_LENGTH)) {
                    ^
537.               BUF_MEM_free(bufm);
538.               SSLerr(SSL_F_DTLSV1_LISTEN, ERR_R_MALLOC_FAILURE);

ssl/d1_lib.c:536:14: Call
534.           }
535.   
536.           if (!BUF_MEM_grow(bufm, SSL3_RT_MAX_PLAIN_LENGTH)) {
                    ^
537.               BUF_MEM_free(bufm);
538.               SSLerr(SSL_F_DTLSV1_LISTEN, ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:121:1: Parameter `*str->data`
  119.   }
  120.   
  121. > size_t BUF_MEM_grow(BUF_MEM *str, size_t len)
  122.   {
  123.       char *ret;

ssl/d1_lib.c:543:5: Assignment
541.           s->init_buf = bufm;
542.       }
543.       buf = (unsigned char *)s->init_buf->data;
           ^
544.   
545.       do {

ssl/d1_lib.c:755:13: Assignment
753.               }
754.   
755.               p = &buf[DTLS1_RT_HEADER_LENGTH];
                   ^
756.               msglen = dtls_raw_hello_verify_request(p + DTLS1_HM_HEADER_LENGTH,
757.                                                      cookie, cookielen);

ssl/d1_lib.c:759:14: Assignment
757.                                                      cookie, cookielen);
758.   
759.               *p++ = DTLS1_MT_HELLO_VERIFY_REQUEST;
                    ^
760.   
761.               /* Message length */

ssl/d1_lib.c:762:13: Assignment
760.   
761.               /* Message length */
762.               l2n3(msglen, p);
                   ^
763.   
764.               /* Message sequence number is always 0 for a HelloVerifyRequest */

ssl/d1_lib.c:765:13: Assignment
763.   
764.               /* Message sequence number is always 0 for a HelloVerifyRequest */
765.               s2n(0, p);
                   ^
766.   
767.               /*

ssl/d1_lib.c:771:13: Assignment
769.                * and fragment length is message length
770.                */
771.               l2n3(0, p);
                   ^
772.               l2n3(msglen, p);
773.   

ssl/d1_lib.c:772:13: Array access: Offset: 24 (⇐ 22 + 2) Size: [1, 2147483644]
770.                */
771.               l2n3(0, p);
772.               l2n3(msglen, p);
                   ^
773.   
774.               /* Set reclen equal to length of whole handshake message */
