ssl/record/rec_layer_s3.c:1183: error: BUFFER_OVERRUN_L3
  Offset: 2 (⇐ 1 + 1) Size: [1, +oo] by call to `tls1_process_heartbeat`.
Showing all 10 steps of the trace


ssl/record/rec_layer_s3.c:968:1: Parameter `s->rlayer.rrec.length`
966.    *             none of our business
967.    */
968. > int ssl3_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
969.                       int len, int peek)
970.   {

ssl/record/rec_layer_s3.c:1183:17: Call
1181.           else if (SSL3_RECORD_get_type(rr)== TLS1_RT_HEARTBEAT) {
1182.               /* We can ignore 0 return values */
1183.               if (tls1_process_heartbeat(s, SSL3_RECORD_get_data(rr),
                        ^
1184.                       SSL3_RECORD_get_length(rr)) < 0) {
1185.                   return -1;

ssl/t1_lib.c:3631:1: <Length trace>
3629.   
3630.   #ifndef OPENSSL_NO_HEARTBEATS
3631. > int tls1_process_heartbeat(SSL *s, unsigned char *p, unsigned int length)
3632.   {
3633.       unsigned char *pl;

ssl/t1_lib.c:3631:1: Parameter `length`
  3629.   
  3630.   #ifndef OPENSSL_NO_HEARTBEATS
  3631. > int tls1_process_heartbeat(SSL *s, unsigned char *p, unsigned int length)
  3632.   {
  3633.       unsigned char *pl;

ssl/t1_lib.c:3660:18: Call
  3658.            * plus 2 bytes payload length, plus payload, plus padding
  3659.            */
  3660.           buffer = OPENSSL_malloc(1 + 2 + payload + padding);
                           ^
  3661.           if (buffer == NULL) {
  3662.               SSLerr(SSL_F_TLS1_PROCESS_HEARTBEAT, ERR_R_MALLOC_FAILURE);

crypto/mem.c:125:9: Assignment
    123.   
    124.       if (num <= 0)
    125.           return NULL;
                   ^
    126.   
    127.       allow_customize = 0;

ssl/t1_lib.c:3660:9: Assignment
  3658.            * plus 2 bytes payload length, plus payload, plus padding
  3659.            */
  3660.           buffer = OPENSSL_malloc(1 + 2 + payload + padding);
                  ^
  3661.           if (buffer == NULL) {
  3662.               SSLerr(SSL_F_TLS1_PROCESS_HEARTBEAT, ERR_R_MALLOC_FAILURE);

ssl/t1_lib.c:3665:9: Assignment
  3663.               return -1;
  3664.           }
  3665.           bp = buffer;
                  ^
  3666.   
  3667.           /* Enter response type, length and copy payload */

ssl/t1_lib.c:3668:10: Assignment
  3666.   
  3667.           /* Enter response type, length and copy payload */
  3668.           *bp++ = TLS1_HB_RESPONSE;
                   ^
  3669.           s2n(payload, bp);
  3670.           memcpy(bp, pl, payload);

ssl/t1_lib.c:3669:9: Array access: Offset: 2 (⇐ 1 + 1) Size: [1, +oo] by call to `tls1_process_heartbeat` 
  3667.           /* Enter response type, length and copy payload */
  3668.           *bp++ = TLS1_HB_RESPONSE;
  3669.           s2n(payload, bp);
                  ^
  3670.           memcpy(bp, pl, payload);
  3671.           bp += payload;
