ssl/record/ssl3_record.c:848: error: BUFFER_OVERRUN_L3
  Offset added: [-63, +oo] Size: 128 by call to `ssl3_cbc_digest_record`.
Showing all 11 steps of the trace


ssl/record/ssl3_record.c:812:9: Call
810.       }
811.   
812.       t = EVP_MD_CTX_size(hash);
               ^
813.       if (t < 0)
814.           return -1;

crypto/evp/evp_lib.c:304:9: Assignment
  302.       if (!md) {
  303.           EVPerr(EVP_F_EVP_MD_SIZE, EVP_R_MESSAGE_DIGEST_IS_NULL);
  304.           return -1;
                 ^
  305.       }
  306.       return md->md_size;

ssl/record/ssl3_record.c:812:5: Assignment
810.       }
811.   
812.       t = EVP_MD_CTX_size(hash);
           ^
813.       if (t < 0)
814.           return -1;

ssl/record/ssl3_record.c:815:5: Assignment
813.       if (t < 0)
814.           return -1;
815.       md_size = t;
           ^
816.       npad = (48 / md_size) * md_size;
817.   

ssl/record/ssl3_record.c:848:13: Call
846.   
847.           /* Final param == is SSLv3 */
848.           if (ssl3_cbc_digest_record(hash,
                   ^
849.                                      md, &md_size,
850.                                      header, rec->input,

ssl/s3_cbc.c:193:5: <Offset trace>
191.       void (*md_final_raw) (void *ctx, unsigned char *md_out);
192.       void (*md_transform) (void *ctx, const unsigned char *block);
193.       unsigned md_size, md_block_size = 64;
           ^
194.       unsigned sslv3_pad_length = 40, header_length, variance_blocks,
195.           len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:193:5: Assignment
  191.       void (*md_final_raw) (void *ctx, unsigned char *md_out);
  192.       void (*md_transform) (void *ctx, const unsigned char *block);
  193.       unsigned md_size, md_block_size = 64;
             ^
  194.       unsigned sslv3_pad_length = 40, header_length, variance_blocks,
  195.           len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:422:13: Assignment
  420.                   return 0;
  421.               }
  422.               overhang = header_length - md_block_size;
                     ^
  423.               md_transform(md_state.c, header);
  424.               memcpy(first_block, header + md_block_size, overhang);

ssl/s3_cbc.c:177:1: <Length trace>
175.    * Returns 1 on success or 0 on error
176.    */
177. > int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
178.                               unsigned char *md_out,
179.                               size_t *md_out_size,

ssl/s3_cbc.c:177:1: Array declaration
  175.    * Returns 1 on success or 0 on error
  176.    */
  177. > int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
  178.                               unsigned char *md_out,
  179.                               size_t *md_out_size,

ssl/s3_cbc.c:424:13: Array access: Offset added: [-63, +oo] Size: 128 by call to `ssl3_cbc_digest_record` 
  422.               overhang = header_length - md_block_size;
  423.               md_transform(md_state.c, header);
  424.               memcpy(first_block, header + md_block_size, overhang);
                     ^
  425.               memcpy(first_block + overhang, data, md_block_size - overhang);
  426.               md_transform(md_state.c, first_block);
