ssl/t1_enc.c:1042: error: BUFFER_OVERRUN_L2
  Offset: [-oo, 58+max(0, `ssl->s3->read_mac_secret_size`)] Size: 13 by call to `ssl3_cbc_digest_record`.
Showing all 7 steps of the trace


ssl/t1_enc.c:975:1: Array declaration
973.   	}
974.   
975. > int tls1_mac(SSL *ssl, unsigned char *md, int send)
976.   	{
977.   	SSL3_RECORD *rec;

ssl/t1_enc.c:1042:3: Call
1040.   		 * data we are hashing because that gives an attacker a
1041.   		 * timing-oracle. */
1042.   		ssl3_cbc_digest_record(
          ^
1043.   			mac_ctx,
1044.   			md, &md_size,

ssl/s3_cbc.c:402:1: <Offset trace>
400.    * padding too. ) 
401.    */
402. > void ssl3_cbc_digest_record(
403.   	const EVP_MD_CTX *ctx,
404.   	unsigned char* md_out,

ssl/s3_cbc.c:402:1: Parameter `data_plus_mac_plus_padding_size`
  400.    * padding too. ) 
  401.    */
  402. > void ssl3_cbc_digest_record(
  403.   	const EVP_MD_CTX *ctx,
  404.   	unsigned char* md_out,

ssl/s3_cbc.c:402:1: <Length trace>
400.    * padding too. ) 
401.    */
402. > void ssl3_cbc_digest_record(
403.   	const EVP_MD_CTX *ctx,
404.   	unsigned char* md_out,

ssl/s3_cbc.c:402:1: Parameter `*header`
  400.    * padding too. ) 
  401.    */
  402. > void ssl3_cbc_digest_record(
  403.   	const EVP_MD_CTX *ctx,
  404.   	unsigned char* md_out,

ssl/s3_cbc.c:648:9: Array access: Offset: [-oo, 58+max(0, ssl->s3->read_mac_secret_size)] Size: 13 by call to `ssl3_cbc_digest_record` 
  646.   			unsigned char b = 0, is_past_c, is_past_cp1;
  647.   			if (k < header_length)
  648.   				b = header[k];
                 ^
  649.   			else if (k < data_plus_mac_plus_padding_size + header_length)
  650.   				b = data[k-header_length];
