ssl/t1_enc.c:786: error: BUFFER_OVERRUN_S2
  Offset: `llen` + 65 Size: [`llen` + 64, `llen` + `contextlen` + 66].
Showing all 13 steps of the trace


ssl/t1_enc.c:748:1: <Offset trace>
746.   }
747.   
748. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
749.                                   const char *label, size_t llen,
750.                                   const unsigned char *context,

ssl/t1_enc.c:748:1: Parameter `llen`
746.   }
747.   
748. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
749.                                   const char *label, size_t llen,
750.                                   const unsigned char *context,

ssl/t1_enc.c:777:5: Assignment
775.       currentvalpos = 0;
776.       memcpy(val + currentvalpos, (unsigned char *)label, llen);
777.       currentvalpos += llen;
           ^
778.       memcpy(val + currentvalpos, s->s3->client_random, SSL3_RANDOM_SIZE);
779.       currentvalpos += SSL3_RANDOM_SIZE;

ssl/t1_enc.c:779:5: Assignment
777.       currentvalpos += llen;
778.       memcpy(val + currentvalpos, s->s3->client_random, SSL3_RANDOM_SIZE);
779.       currentvalpos += SSL3_RANDOM_SIZE;
           ^
780.       memcpy(val + currentvalpos, s->s3->server_random, SSL3_RANDOM_SIZE);
781.       currentvalpos += SSL3_RANDOM_SIZE;

ssl/t1_enc.c:781:5: Assignment
779.       currentvalpos += SSL3_RANDOM_SIZE;
780.       memcpy(val + currentvalpos, s->s3->server_random, SSL3_RANDOM_SIZE);
781.       currentvalpos += SSL3_RANDOM_SIZE;
           ^
782.   
783.       if (use_context) {

ssl/t1_enc.c:785:9: Assignment
783.       if (use_context) {
784.           val[currentvalpos] = (contextlen >> 8) & 0xff;
785.           currentvalpos++;
               ^
786.           val[currentvalpos] = contextlen & 0xff;
787.           currentvalpos++;

ssl/t1_enc.c:748:1: <Length trace>
746.   }
747.   
748. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
749.                                   const char *label, size_t llen,
750.                                   const unsigned char *context,

ssl/t1_enc.c:748:1: Parameter `llen`
746.   }
747.   
748. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
749.                                   const char *label, size_t llen,
750.                                   const unsigned char *context,

ssl/t1_enc.c:767:5: Assignment
765.        * concatenation of values does not create a prohibited label.
766.        */
767.       vallen = llen + SSL3_RANDOM_SIZE * 2;
           ^
768.       if (use_context) {
769.           vallen += 2 + contextlen;

ssl/t1_enc.c:772:11: Call
770.       }
771.   
772.       val = OPENSSL_malloc(vallen);
                 ^
773.       if (val == NULL)
774.           goto err2;

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

ssl/t1_enc.c:772:5: Assignment
770.       }
771.   
772.       val = OPENSSL_malloc(vallen);
           ^
773.       if (val == NULL)
774.           goto err2;

ssl/t1_enc.c:786:9: Array access: Offset: llen + 65 Size: [llen + 64, llen + contextlen + 66]
784.           val[currentvalpos] = (contextlen >> 8) & 0xff;
785.           currentvalpos++;
786.           val[currentvalpos] = contextlen & 0xff;
               ^
787.           currentvalpos++;
788.           if ((contextlen > 0) || (context != NULL)) {
