ssl/statem/statem_clnt.c:786: error: BUFFER_OVERRUN_L3
  Offset added: [32, +oo] (⇐ [0, +oo] + 32) Size: [1, 2147483644] by call to `WPACKET_memcpy`.
Showing all 13 steps of the trace


ssl/statem/statem_clnt.c:702:10: Call
700.       WPACKET pkt;
701.   
702.       if (!WPACKET_init(&pkt, s->init_buf)
                ^
703.               || !WPACKET_set_max_size(&pkt, SSL3_RT_MAX_PLAIN_LENGTH)) {
704.           /* Should not happen */

ssl/packet.c:99:12: Call
  97.   int WPACKET_init(WPACKET *pkt, BUF_MEM *buf)
  98.   {
  99.       return WPACKET_init_len(pkt, buf, 0);
                    ^
  100.   }
  101.   

ssl/packet.c:63:1: Parameter `pkt->curr`
    61.   }
    62.   
    63. > int WPACKET_init_len(WPACKET *pkt, BUF_MEM *buf, size_t lenbytes)
    64.   {
    65.       unsigned char *lenchars;

ssl/statem/statem_clnt.c:785:10: Call
783.        * the negotiated version.
784.        */
785.       if (!WPACKET_put_bytes_u16(&pkt, s->client_version)
                ^
786.               || !WPACKET_memcpy(&pkt, s->s3->client_random, SSL3_RANDOM_SIZE)) {
787.           SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);

ssl/packet.c:237:1: Parameter `pkt->curr`
  235.   }
  236.   
  237. > int WPACKET_put_bytes__(WPACKET *pkt, unsigned int val, size_t size)
  238.   {
  239.       unsigned char *data;

ssl/statem/statem_clnt.c:786:17: Call
784.        */
785.       if (!WPACKET_put_bytes_u16(&pkt, s->client_version)
786.               || !WPACKET_memcpy(&pkt, s->s3->client_random, SSL3_RANDOM_SIZE)) {
                       ^
787.           SSLerr(SSL_F_TLS_CONSTRUCT_CLIENT_HELLO, ERR_R_INTERNAL_ERROR);
788.           goto err;

ssl/packet.c:278:1: <Offset trace>
276.   }
277.   
278. > int WPACKET_memcpy(WPACKET *pkt, const void *src, size_t len)
279.   {
280.       unsigned char *dest;

ssl/packet.c:278:1: Parameter `len`
  276.   }
  277.   
  278. > int WPACKET_memcpy(WPACKET *pkt, const void *src, size_t len)
  279.   {
  280.       unsigned char *dest;

ssl/packet.c:278:1: <Length trace>
276.   }
277.   
278. > int WPACKET_memcpy(WPACKET *pkt, const void *src, size_t len)
279.   {
280.       unsigned char *dest;

ssl/packet.c:278:1: Parameter `*pkt->buf->data`
  276.   }
  277.   
  278. > int WPACKET_memcpy(WPACKET *pkt, const void *src, size_t len)
  279.   {
  280.       unsigned char *dest;

ssl/packet.c:285:10: Call
  283.           return 1;
  284.   
  285.       if (!WPACKET_allocate_bytes(pkt, len, &dest))
                  ^
  286.           return 0;
  287.   

ssl/packet.c:15:1: Parameter `**allocbytes`
    13.   #define DEFAULT_BUF_SIZE    256
    14.   
    15. > int WPACKET_allocate_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
    16.   {
    17.       /* Internal API, so should not fail */

ssl/packet.c:288:5: Array access: Offset added: [32, +oo] (⇐ [0, +oo] + 32) Size: [1, 2147483644] by call to `WPACKET_memcpy` 
  286.           return 0;
  287.   
  288.       memcpy(dest, src, len);
             ^
  289.   
  290.       return 1;
