ssl/statem/statem_clnt.c:1720: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: 29 by call to `tls1_check_curve`.
Showing all 9 steps of the trace


ssl/statem/statem_clnt.c:1697:1: Parameter `*pkt->curr`
1695.   }
1696.   
1697. > static int tls_process_ske_ecdhe(SSL *s, PACKET *pkt, EVP_PKEY **pkey, int *al)
1698.   {
1699.   #ifndef OPENSSL_NO_EC

ssl/statem/statem_clnt.c:1720:10: Call
1718.        * invalid curve. ECParameters is 3 bytes.
1719.        */
1720.       if (!tls1_check_curve(s, ecparams, 3)) {
                 ^
1721.           *al = SSL_AD_DECODE_ERROR;
1722.           SSLerr(SSL_F_TLS_PROCESS_SKE_ECDHE, SSL_R_WRONG_CURVE);

ssl/t1_lib.c:181:1: Array declaration
  179.   
  180.   /* The default curves */
  181. > static const unsigned char eccurves_default[] = {
  182.       0, 29,                      /* X25519 (29) */
  183.       0, 23,                      /* secp256r1 (23) */

ssl/t1_lib.c:351:20: Call
  349.       for (i = 0; i < num_curves; i++, curves += 2) {
  350.           if (p[1] == curves[0] && p[2] == curves[1])
  351.               return tls_curve_allowed(s, p + 1, SSL_SECOP_CURVE_CHECK);
                            ^
  352.       }
  353.       return 0;

ssl/t1_lib.c:310:1: <Offset trace>
308.   
309.   /* See if curve is allowed by security callback */
310. > int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
311.   {
312.       const tls_curve_info *cinfo;

ssl/t1_lib.c:310:1: Parameter `*curve`
    308.   
    309.   /* See if curve is allowed by security callback */
    310. > int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
    311.   {
    312.       const tls_curve_info *cinfo;

ssl/t1_lib.c:142:1: <Length trace>
140.    * table: the index of each entry is one less than the TLS curve id.
141.    */
142. > static const tls_curve_info nid_list[] = {
143.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
144.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:142:1: Array declaration
    140.    * table: the index of each entry is one less than the TLS curve id.
    141.    */
    142. > static const tls_curve_info nid_list[] = {
    143.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
    144.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:317:5: Array access: Offset: [-1, +oo] Size: 29 by call to `tls1_check_curve` 
    315.       if ((curve[1] < 1) || ((size_t)curve[1] > OSSL_NELEM(nid_list)))
    316.           return 0;
    317.       cinfo = &nid_list[curve[1] - 1];
               ^
    318.   # ifdef OPENSSL_NO_EC2M
    319.       if (cinfo->flags & TLS_CURVE_CHAR2)
