ssl/t1_lib.c:1440: error: BUFFER_OVERRUN_S2
  Offset added: [`s->alpn_client_proto_list_len` + 6, `s->alpn_client_proto_list_len` + 12] (⇐ [6, 12] + `s->alpn_client_proto_list_len`) Size: [1, +oo].
Showing all 9 steps of the trace


ssl/t1_lib.c:1120:1: <Offset trace>
1118.   }
1119.   
1120. > unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf,
1121.                                             unsigned char *limit, int *al)
1122.   {

ssl/t1_lib.c:1120:1: Parameter `*limit`
1118.   }
1119.   
1120. > unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf,
1121.                                             unsigned char *limit, int *al)
1122.   {

ssl/t1_lib.c:1317:13: <Length trace>
1315.               s->session->tlsext_ticklen = ticklen;
1316.           } else
1317.               ticklen = 0;
                    ^
1318.           if (ticklen == 0 && s->tlsext_session_ticket &&
1319.               s->tlsext_session_ticket->data == NULL)

ssl/t1_lib.c:1317:13: Assignment
1315.               s->session->tlsext_ticklen = ticklen;
1316.           } else
1317.               ticklen = 0;
                    ^
1318.           if (ticklen == 0 && s->tlsext_session_ticket &&
1319.               s->tlsext_session_ticket->data == NULL)

ssl/t1_lib.c:1331:13: Assignment
1329.           if (ticklen) {
1330.               memcpy(ret, s->session->tlsext_tick, ticklen);
1331.               ret += ticklen;
                    ^
1332.           }
1333.       }

ssl/t1_lib.c:1437:9: Assignment
1435.           if ((size_t)(limit - ret) < 6 + s->alpn_client_proto_list_len)
1436.               return NULL;
1437.           s2n(TLSEXT_TYPE_application_layer_protocol_negotiation, ret);
                ^
1438.           s2n(2 + s->alpn_client_proto_list_len, ret);
1439.           s2n(s->alpn_client_proto_list_len, ret);

ssl/t1_lib.c:1438:9: Assignment
1436.               return NULL;
1437.           s2n(TLSEXT_TYPE_application_layer_protocol_negotiation, ret);
1438.           s2n(2 + s->alpn_client_proto_list_len, ret);
                ^
1439.           s2n(s->alpn_client_proto_list_len, ret);
1440.           memcpy(ret, s->alpn_client_proto_list, s->alpn_client_proto_list_len);

ssl/t1_lib.c:1439:9: Assignment
1437.           s2n(TLSEXT_TYPE_application_layer_protocol_negotiation, ret);
1438.           s2n(2 + s->alpn_client_proto_list_len, ret);
1439.           s2n(s->alpn_client_proto_list_len, ret);
                ^
1440.           memcpy(ret, s->alpn_client_proto_list, s->alpn_client_proto_list_len);
1441.           ret += s->alpn_client_proto_list_len;

ssl/t1_lib.c:1440:9: Array access: Offset added: [s->alpn_client_proto_list_len + 6, s->alpn_client_proto_list_len + 12] (⇐ [6, 12] + s->alpn_client_proto_list_len) Size: [1, +oo]
1438.           s2n(2 + s->alpn_client_proto_list_len, ret);
1439.           s2n(s->alpn_client_proto_list_len, ret);
1440.           memcpy(ret, s->alpn_client_proto_list, s->alpn_client_proto_list_len);
                ^
1441.           ret += s->alpn_client_proto_list_len;
1442.           s->s3->alpn_sent = 1;
