ssl/s3_enc.c:308: error: BUFFER_OVERRUN_L3
  Offset added: [1, +oo] (⇐ [0, +oo] + [1, 15]) Size: [0, +oo] by call to `ssl3_generate_key_block`.
Showing all 9 steps of the trace


ssl/s3_enc.c:276:1: Global `n_cipher.iv_len`
274.   	}
275.   
276. > int ssl3_setup_key_block(SSL *s)
277.   	{
278.   	unsigned char *p;

ssl/s3_enc.c:297:2: Assignment
295.   	s->s3->tmp.new_compression=comp;
296.   
297.   	num=EVP_CIPHER_key_length(c)+EVP_MD_size(hash)+EVP_CIPHER_iv_length(c);
        ^
298.   	num*=2;
299.   

ssl/s3_enc.c:298:2: Assignment
296.   
297.   	num=EVP_CIPHER_key_length(c)+EVP_MD_size(hash)+EVP_CIPHER_iv_length(c);
298.   	num*=2;
        ^
299.   
300.   	ssl3_cleanup_key_block(s);

ssl/s3_enc.c:308:2: Call
306.   	s->s3->tmp.key_block=p;
307.   
308.   	ssl3_generate_key_block(s,p,num);
        ^
309.   
310.   	return(1);

ssl/s3_enc.c:86:1: <Offset trace>
84.   #endif
85.   
86. > static void ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
87.   	{
88.   	MD5_CTX m5;

ssl/s3_enc.c:86:1: Parameter `num`
  84.   #endif
  85.   
  86. > static void ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
  87.   	{
  88.   	MD5_CTX m5;

ssl/s3_enc.c:86:1: <Length trace>
84.   #endif
85.   
86. > static void ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
87.   	{
88.   	MD5_CTX m5;

ssl/s3_enc.c:86:1: Parameter `*km`
  84.   #endif
  85.   
  86. > static void ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
  87.   	{
  88.   	MD5_CTX m5;

ssl/s3_enc.c:116:4: Array access: Offset added: [1, +oo] (⇐ [0, +oo] + [1, 15]) Size: [0, +oo] by call to `ssl3_generate_key_block` 
  114.   			{
  115.   			MD5_Final(smd,&m5);
  116.   			memcpy(km,smd,(num-i));
            ^
  117.   			}
  118.   		else
