ssl/t1_lib.c:4243: error: BUFFER_OVERRUN_L3
  Offset: [-1, 9] Size: 10 by call to `tls1_check_chain`.
Showing all 6 steps of the trace


ssl/t1_lib.c:4243:12: Call
4241.   int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
4242.   {
4243.       return tls1_check_chain(s, x, pk, chain, -1);
                   ^
4244.   }
4245.   

ssl/t1_lib.c:3959:1: <Offset trace>
3957.            | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
3958.   
3959. > int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
3960.                        int idx)
3961.   {

ssl/t1_lib.c:3959:1: Parameter `idx`
  3957.            | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
  3958.   
  3959. > int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
  3960.                        int idx)
  3961.   {

ssl/t1_lib.c:3959:1: <Length trace>
3957.            | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
3958.   
3959. > int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
3960.                        int idx)
3961.   {

ssl/t1_lib.c:3959:1: Parameter `s->s3->tmp.md[*]`
  3957.            | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
  3958.   
  3959. > int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
  3960.                        int idx)
  3961.   {

ssl/t1_lib.c:4205:18: Array access: Offset: [-1, 9] Size: 10 by call to `tls1_check_chain` 
  4203.           if (*pvalid & CERT_PKEY_EXPLICIT_SIGN)
  4204.               rv |= CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN;
  4205.           else if (s->s3->tmp.md[idx] != NULL)
                           ^
  4206.               rv |= CERT_PKEY_SIGN;
  4207.       } else
