ssl/ssl_lib.c:2928: error: BUFFER_OVERRUN_L2
  Offset: [min(-1, `s->s3->tmp.cert_idx`), max(7, `s->s3->tmp.cert_idx`)] Size: 7.
Showing all 8 steps of the trace


ssl/ssl_lib.c:2916:1: <Offset trace>
2914.   }
2915.   
2916. > int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
2917.                                      size_t *serverinfo_length)
2918.   {

ssl/ssl_lib.c:2916:1: Parameter `s->s3->tmp.cert_idx`
2914.   }
2915.   
2916. > int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
2917.                                      size_t *serverinfo_length)
2918.   {

ssl/ssl_lib.c:2924:9: Call
2922.   
2923.       c = s->cert;
2924.       i = ssl_get_server_cert_index(s);
                ^
2925.   
2926.       if (i == -1)

ssl/ssl_lib.c:2844:13: Assignment
  2842.           if (s->s3->tmp.sigalg == NULL) {
  2843.               SSLerr(SSL_F_SSL_GET_SERVER_CERT_INDEX, ERR_R_INTERNAL_ERROR);
  2844.               return -1;
                      ^
  2845.           }
  2846.           return s->s3->tmp.cert_idx;

ssl/ssl_lib.c:2924:5: Assignment
2922.   
2923.       c = s->cert;
2924.       i = ssl_get_server_cert_index(s);
            ^
2925.   
2926.       if (i == -1)

ssl/ssl_lib.c:2916:1: <Length trace>
2914.   }
2915.   
2916. > int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
2917.                                      size_t *serverinfo_length)
2918.   {

ssl/ssl_lib.c:2916:1: Parameter `s->cert->pkeys[*]`
2914.   }
2915.   
2916. > int ssl_get_server_cert_serverinfo(SSL *s, const unsigned char **serverinfo,
2917.                                      size_t *serverinfo_length)
2918.   {

ssl/ssl_lib.c:2928:9: Array access: Offset: [min(-1, s->s3->tmp.cert_idx), max(7, s->s3->tmp.cert_idx)] Size: 7
2926.       if (i == -1)
2927.           return 0;
2928.       if (c->pkeys[i].serverinfo == NULL)
                ^
2929.           return 0;
2930.   
