ssl/record/ssl3_record.c:1629: error: BUFFER_OVERRUN_L2
  Offset added: [0, 17728] Size: 128 by call to `ssl3_cbc_copy_mac`.
Showing all 9 steps of the trace


ssl/record/ssl3_record.c:1496:1: Parameter `s->rlayer.rrec.length`
1494.   }
1495.   
1496. > int dtls1_process_record(SSL *s, DTLS1_BITMAP *bitmap)
1497.   {
1498.       int i, al;

ssl/record/ssl3_record.c:1536:5: Assignment
1534.       /* decrypt in place in 'rr->input' */
1535.       rr->data = rr->input;
1536.       rr->orig_len = rr->length;
            ^
1537.   
1538.       if (SSL_READ_ETM(s) && s->read_hash) {

ssl/record/ssl3_record.c:1629:18: Call
1627.                */
1628.               mac = mac_tmp;
1629.               if (!ssl3_cbc_copy_mac(mac_tmp, rr, mac_size)) {
                         ^
1630.                   al = SSL_AD_INTERNAL_ERROR;
1631.                   SSLerr(SSL_F_DTLS1_PROCESS_RECORD, ERR_R_INTERNAL_ERROR);

ssl/record/ssl3_record.c:1421:1: <Offset trace>
1419.   #define CBC_MAC_ROTATE_IN_PLACE
1420.   
1421. > int ssl3_cbc_copy_mac(unsigned char *out,
1422.                          const SSL3_RECORD *rec, size_t md_size)
1423.   {

ssl/record/ssl3_record.c:1421:1: Parameter `md_size`
  1419.   #define CBC_MAC_ROTATE_IN_PLACE
  1420.   
  1421. > int ssl3_cbc_copy_mac(unsigned char *out,
  1422.                          const SSL3_RECORD *rec, size_t md_size)
  1423.   {

ssl/record/ssl3_record.c:1421:1: <Length trace>
1419.   #define CBC_MAC_ROTATE_IN_PLACE
1420.   
1421. > int ssl3_cbc_copy_mac(unsigned char *out,
1422.                          const SSL3_RECORD *rec, size_t md_size)
1423.   {

ssl/record/ssl3_record.c:1421:1: Array declaration
  1419.   #define CBC_MAC_ROTATE_IN_PLACE
  1420.   
  1421. > int ssl3_cbc_copy_mac(unsigned char *out,
  1422.                          const SSL3_RECORD *rec, size_t md_size)
  1423.   {

ssl/record/ssl3_record.c:1450:5: Assignment
  1448.   
  1449.   #if defined(CBC_MAC_ROTATE_IN_PLACE)
  1450.       rotated_mac = rotated_mac_buf + ((0 - (size_t)rotated_mac_buf) & 63);
              ^
  1451.   #endif
  1452.   

ssl/record/ssl3_record.c:1459:5: Array access: Offset added: [0, 17728] Size: 128 by call to `ssl3_cbc_copy_mac` 
  1457.       in_mac = 0;
  1458.       rotate_offset = 0;
  1459.       memset(rotated_mac, 0, md_size);
              ^
  1460.       for (i = scan_start, j = 0; i < rec->orig_len; i++) {
  1461.           size_t mac_started = constant_time_eq_s(i, mac_start);
