ssl/record/ssl3_record.c:440: error: BUFFER_OVERRUN_L2
  Offset added: [0, 34112] Size: 128 by call to `ssl3_cbc_copy_mac`.
Showing all 9 steps of the trace


ssl/record/ssl3_record.c:186:1: Parameter `s->rlayer.rrec.length`
184.    */
185.   /* used only by ssl3_read_bytes */
186. > int ssl3_get_record(SSL *s)
187.   {
188.       int ssl_major, ssl_minor, al;

ssl/record/ssl3_record.c:360:5: Assignment
358.       /* decrypt in place in 'rr->input' */
359.       rr->data = rr->input;
360.       rr->orig_len = rr->length;
           ^
361.       /*
362.        * If in encrypt-then-mac mode calculate mac from encrypted record. All

ssl/record/ssl3_record.c:440:13: Call
438.                */
439.               mac = mac_tmp;
440.               ssl3_cbc_copy_mac(mac_tmp, rr, mac_size);
                   ^
441.               rr->length -= mac_size;
442.           } else {

ssl/record/ssl3_record.c:1141:1: <Offset trace>
1139.   #define CBC_MAC_ROTATE_IN_PLACE
1140.   
1141. > void ssl3_cbc_copy_mac(unsigned char *out,
1142.                          const SSL3_RECORD *rec, unsigned md_size)
1143.   {

ssl/record/ssl3_record.c:1141:1: Parameter `md_size`
  1139.   #define CBC_MAC_ROTATE_IN_PLACE
  1140.   
  1141. > void ssl3_cbc_copy_mac(unsigned char *out,
  1142.                          const SSL3_RECORD *rec, unsigned md_size)
  1143.   {

ssl/record/ssl3_record.c:1141:1: <Length trace>
1139.   #define CBC_MAC_ROTATE_IN_PLACE
1140.   
1141. > void ssl3_cbc_copy_mac(unsigned char *out,
1142.                          const SSL3_RECORD *rec, unsigned md_size)
1143.   {

ssl/record/ssl3_record.c:1141:1: Array declaration
  1139.   #define CBC_MAC_ROTATE_IN_PLACE
  1140.   
  1141. > void ssl3_cbc_copy_mac(unsigned char *out,
  1142.                          const SSL3_RECORD *rec, unsigned md_size)
  1143.   {

ssl/record/ssl3_record.c:1169:5: Assignment
  1167.   
  1168.   #if defined(CBC_MAC_ROTATE_IN_PLACE)
  1169.       rotated_mac = rotated_mac_buf + ((0 - (size_t)rotated_mac_buf) & 63);
              ^
  1170.   #endif
  1171.   

ssl/record/ssl3_record.c:1187:5: Array access: Offset added: [0, 34112] Size: 128 by call to `ssl3_cbc_copy_mac` 
  1185.       rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;
  1186.   
  1187.       memset(rotated_mac, 0, md_size);
              ^
  1188.       for (i = scan_start, j = 0; i < rec->orig_len; i++) {
  1189.           unsigned char mac_started = constant_time_ge_8(i, mac_start);
