ssl/t1_enc.c:592: error: BUFFER_OVERRUN_S2
  Offset: `llen` + 65 Size: [`llen` + 64, `llen` + `contextlen` + 66].
Showing all 13 steps of the trace


ssl/t1_enc.c:559:1: <Offset trace>
557.   }
558.   
559. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
560.                                   const char *label, size_t llen,
561.                                   const unsigned char *context,

ssl/t1_enc.c:559:1: Parameter `llen`
557.   }
558.   
559. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
560.                                   const char *label, size_t llen,
561.                                   const unsigned char *context,

ssl/t1_enc.c:583:5: Assignment
581.       currentvalpos = 0;
582.       memcpy(val + currentvalpos, (unsigned char *)label, llen);
583.       currentvalpos += llen;
           ^
584.       memcpy(val + currentvalpos, s->s3->client_random, SSL3_RANDOM_SIZE);
585.       currentvalpos += SSL3_RANDOM_SIZE;

ssl/t1_enc.c:585:5: Assignment
583.       currentvalpos += llen;
584.       memcpy(val + currentvalpos, s->s3->client_random, SSL3_RANDOM_SIZE);
585.       currentvalpos += SSL3_RANDOM_SIZE;
           ^
586.       memcpy(val + currentvalpos, s->s3->server_random, SSL3_RANDOM_SIZE);
587.       currentvalpos += SSL3_RANDOM_SIZE;

ssl/t1_enc.c:587:5: Assignment
585.       currentvalpos += SSL3_RANDOM_SIZE;
586.       memcpy(val + currentvalpos, s->s3->server_random, SSL3_RANDOM_SIZE);
587.       currentvalpos += SSL3_RANDOM_SIZE;
           ^
588.   
589.       if (use_context) {

ssl/t1_enc.c:591:9: Assignment
589.       if (use_context) {
590.           val[currentvalpos] = (contextlen >> 8) & 0xff;
591.           currentvalpos++;
               ^
592.           val[currentvalpos] = contextlen & 0xff;
593.           currentvalpos++;

ssl/t1_enc.c:559:1: <Length trace>
557.   }
558.   
559. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
560.                                   const char *label, size_t llen,
561.                                   const unsigned char *context,

ssl/t1_enc.c:559:1: Parameter `llen`
557.   }
558.   
559. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
560.                                   const char *label, size_t llen,
561.                                   const unsigned char *context,

ssl/t1_enc.c:573:5: Assignment
571.        * concatenation of values does not create a prohibited label.
572.        */
573.       vallen = llen + SSL3_RANDOM_SIZE * 2;
           ^
574.       if (use_context) {
575.           vallen += 2 + contextlen;

ssl/t1_enc.c:578:11: Call
576.       }
577.   
578.       val = OPENSSL_malloc(vallen);
                 ^
579.       if (val == NULL)
580.           goto err2;

crypto/mem.c:166:9: Assignment
  164.   
  165.       if (num == 0)
  166.           return NULL;
                 ^
  167.   
  168.       FAILTEST();

ssl/t1_enc.c:578:5: Assignment
576.       }
577.   
578.       val = OPENSSL_malloc(vallen);
           ^
579.       if (val == NULL)
580.           goto err2;

ssl/t1_enc.c:592:9: Array access: Offset: llen + 65 Size: [llen + 64, llen + contextlen + 66]
590.           val[currentvalpos] = (contextlen >> 8) & 0xff;
591.           currentvalpos++;
592.           val[currentvalpos] = contextlen & 0xff;
               ^
593.           currentvalpos++;
594.           if ((contextlen > 0) || (context != NULL)) {
