ssl/t1_enc.c:595: error: BUFFER_OVERRUN_S2
  Offset added: `llen` + `contextlen` + 66 (⇐ `llen` + 66 + `contextlen`) Size: [`llen` + 64, `llen` + `contextlen` + 66].
Showing all 9 steps of the trace


ssl/t1_enc.c:559:1: <Offset trace>
557.   }
558.   
559. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
560.                                   const char *label, size_t llen,
561.                                   const unsigned char *context,

ssl/t1_enc.c:559:1: Parameter `contextlen`
557.   }
558.   
559. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
560.                                   const char *label, size_t llen,
561.                                   const unsigned char *context,

ssl/t1_enc.c:559:1: <Length trace>
557.   }
558.   
559. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
560.                                   const char *label, size_t llen,
561.                                   const unsigned char *context,

ssl/t1_enc.c:559:1: Parameter `llen`
557.   }
558.   
559. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
560.                                   const char *label, size_t llen,
561.                                   const unsigned char *context,

ssl/t1_enc.c:573:5: Assignment
571.        * concatenation of values does not create a prohibited label.
572.        */
573.       vallen = llen + SSL3_RANDOM_SIZE * 2;
           ^
574.       if (use_context) {
575.           vallen += 2 + contextlen;

ssl/t1_enc.c:578:11: Call
576.       }
577.   
578.       val = OPENSSL_malloc(vallen);
                 ^
579.       if (val == NULL)
580.           goto err2;

crypto/mem.c:166:9: Assignment
  164.   
  165.       if (num == 0)
  166.           return NULL;
                 ^
  167.   
  168.       FAILTEST();

ssl/t1_enc.c:578:5: Assignment
576.       }
577.   
578.       val = OPENSSL_malloc(vallen);
           ^
579.       if (val == NULL)
580.           goto err2;

ssl/t1_enc.c:595:13: Array access: Offset added: llen + contextlen + 66 (⇐ llen + 66 + contextlen) Size: [llen + 64, llen + contextlen + 66]
593.           currentvalpos++;
594.           if ((contextlen > 0) || (context != NULL)) {
595.               memcpy(val + currentvalpos, context, contextlen);
                   ^
596.           }
597.       }
