ssl/statem/statem_srvr.c:3067: error: BUFFER_OVERRUN_S2
  Offset: [`s->method->ssl3_enc->hhlen` + 5, `s->method->ssl3_enc->hhlen` + 5] (⇐ [`s->method->ssl3_enc->hhlen` + 4, `s->method->ssl3_enc->hhlen` + 4] + 1) Size: [1, 2147483644].
Showing all 8 steps of the trace


ssl/statem/statem_srvr.c:2982:1: <Length trace>
2980.   }
2981.   
2982. > int tls_construct_new_session_ticket(SSL *s)
2983.   {
2984.       unsigned char *senc = NULL;

ssl/statem/statem_srvr.c:2982:1: Parameter `s->method->ssl3_enc->hhlen`
2980.   }
2981.   
2982. > int tls_construct_new_session_ticket(SSL *s)
2983.   {
2984.       unsigned char *senc = NULL;

ssl/statem/statem_srvr.c:3055:5: Assignment
3053.           goto err;
3054.   
3055.       p = ssl_handshake_start(s);
            ^
3056.       /*
3057.        * Initialize HMAC and cipher contexts. If callback present it does

ssl/statem/statem_srvr.c:3066:13: Assignment
3064.   
3065.           if (ret == 0) {
3066.               l2n(0, p);          /* timeout */
                    ^
3067.               s2n(0, p);          /* length */
3068.               if (!ssl_set_handshake_header

ssl/statem/statem_srvr.c:3066:13: Assignment
3064.   
3065.           if (ret == 0) {
3066.               l2n(0, p);          /* timeout */
                    ^
3067.               s2n(0, p);          /* length */
3068.               if (!ssl_set_handshake_header

ssl/statem/statem_srvr.c:3066:13: Assignment
3064.   
3065.           if (ret == 0) {
3066.               l2n(0, p);          /* timeout */
                    ^
3067.               s2n(0, p);          /* length */
3068.               if (!ssl_set_handshake_header

ssl/statem/statem_srvr.c:3066:13: Assignment
3064.   
3065.           if (ret == 0) {
3066.               l2n(0, p);          /* timeout */
                    ^
3067.               s2n(0, p);          /* length */
3068.               if (!ssl_set_handshake_header

ssl/statem/statem_srvr.c:3067:13: Array access: Offset: [s->method->ssl3_enc->hhlen + 5, s->method->ssl3_enc->hhlen + 5] (⇐ [s->method->ssl3_enc->hhlen + 4, s->method->ssl3_enc->hhlen + 4] + 1) Size: [1, 2147483644]
3065.           if (ret == 0) {
3066.               l2n(0, p);          /* timeout */
3067.               s2n(0, p);          /* length */
                    ^
3068.               if (!ssl_set_handshake_header
3069.                   (s, SSL3_MT_NEWSESSION_TICKET, p - ssl_handshake_start(s)))
