ssl/record/ssl3_record.c:514: error: BUFFER_OVERRUN_L2
  Offset added: [0, 17728] Size: 128 by call to `ssl3_cbc_copy_mac`.
Showing all 9 steps of the trace


ssl/record/ssl3_record.c:227:1: Parameter `s->rlayer.rrec.length`
225.    */
226.   /* used only by ssl3_read_bytes */
227. > int ssl3_get_record(SSL *s)
228.   {
229.       int ssl_major, ssl_minor, al;

ssl/record/ssl3_record.c:418:9: Assignment
416.           /* decrypt in place in 'rr->input' */
417.           rr[num_recs].data = rr[num_recs].input;
418.           rr[num_recs].orig_len = rr[num_recs].length;
               ^
419.           num_recs++;
420.   

ssl/record/ssl3_record.c:514:17: Call
512.                    */
513.                   mac = mac_tmp;
514.                   ssl3_cbc_copy_mac(mac_tmp, &rr[j], mac_size);
                       ^
515.                   rr[j].length -= mac_size;
516.               } else {

ssl/record/ssl3_record.c:1281:1: <Offset trace>
1279.   #define CBC_MAC_ROTATE_IN_PLACE
1280.   
1281. > void ssl3_cbc_copy_mac(unsigned char *out,
1282.                          const SSL3_RECORD *rec, unsigned md_size)
1283.   {

ssl/record/ssl3_record.c:1281:1: Parameter `md_size`
  1279.   #define CBC_MAC_ROTATE_IN_PLACE
  1280.   
  1281. > void ssl3_cbc_copy_mac(unsigned char *out,
  1282.                          const SSL3_RECORD *rec, unsigned md_size)
  1283.   {

ssl/record/ssl3_record.c:1281:1: <Length trace>
1279.   #define CBC_MAC_ROTATE_IN_PLACE
1280.   
1281. > void ssl3_cbc_copy_mac(unsigned char *out,
1282.                          const SSL3_RECORD *rec, unsigned md_size)
1283.   {

ssl/record/ssl3_record.c:1281:1: Array declaration
  1279.   #define CBC_MAC_ROTATE_IN_PLACE
  1280.   
  1281. > void ssl3_cbc_copy_mac(unsigned char *out,
  1282.                          const SSL3_RECORD *rec, unsigned md_size)
  1283.   {

ssl/record/ssl3_record.c:1309:5: Assignment
  1307.   
  1308.   #if defined(CBC_MAC_ROTATE_IN_PLACE)
  1309.       rotated_mac = rotated_mac_buf + ((0 - (size_t)rotated_mac_buf) & 63);
              ^
  1310.   #endif
  1311.   

ssl/record/ssl3_record.c:1327:5: Array access: Offset added: [0, 17728] Size: 128 by call to `ssl3_cbc_copy_mac` 
  1325.       rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;
  1326.   
  1327.       memset(rotated_mac, 0, md_size);
              ^
  1328.       for (i = scan_start, j = 0; i < rec->orig_len; i++) {
  1329.           unsigned char mac_started = constant_time_ge_8(i, mac_start);
