ssl/t1_lib.c:1126: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: 29 by call to `tls_curve_allowed`.
Showing all 7 steps of the trace


ssl/t1_lib.c:1016:1: Parameter `*s->session->tlsext_ellipticcurvelist`
1014.   }
1015.   
1016. > int ssl_add_clienthello_tlsext(SSL *s, WPACKET *pkt, int *al)
1017.   {
1018.   #ifndef OPENSSL_NO_EC

ssl/t1_lib.c:1126:17: Call
1124.           /* Copy curve ID if supported */
1125.           for (i = 0; i < num_curves; i++, pcurves += 2) {
1126.               if (tls_curve_allowed(s, pcurves, SSL_SECOP_CURVE_SUPPORTED)) {
                        ^
1127.                   if (!WPACKET_put_bytes_u8(pkt, pcurves[0])
1128.                       || !WPACKET_put_bytes_u8(pkt, pcurves[1])) {

ssl/t1_lib.c:303:1: <Offset trace>
301.   
302.   /* See if curve is allowed by security callback */
303. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
304.   {
305.       const tls_curve_info *cinfo;

ssl/t1_lib.c:303:1: Parameter `*curve`
  301.   
  302.   /* See if curve is allowed by security callback */
  303. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
  304.   {
  305.       const tls_curve_info *cinfo;

ssl/t1_lib.c:135:1: <Length trace>
133.    * table: the index of each entry is one less than the TLS curve id.
134.    */
135. > static const tls_curve_info nid_list[] = {
136.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
137.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:135:1: Array declaration
  133.    * table: the index of each entry is one less than the TLS curve id.
  134.    */
  135. > static const tls_curve_info nid_list[] = {
  136.       {NID_sect163k1, 80, TLS_CURVE_CHAR2}, /* sect163k1 (1) */
  137.       {NID_sect163r1, 80, TLS_CURVE_CHAR2}, /* sect163r1 (2) */

ssl/t1_lib.c:310:5: Array access: Offset: [-1, +oo] Size: 29 by call to `tls_curve_allowed` 
  308.       if ((curve[1] < 1) || ((size_t)curve[1] > OSSL_NELEM(nid_list)))
  309.           return 0;
  310.       cinfo = &nid_list[curve[1] - 1];
             ^
  311.   # ifdef OPENSSL_NO_EC2M
  312.       if (cinfo->flags & TLS_CURVE_CHAR2)
