ssl/statem/statem_lib.c:358: error: BUFFER_OVERRUN_S2
  Offset: [`s->method->ssl3_enc->hhlen` + 3, `s->method->ssl3_enc->hhlen` + 3] Size: [1, 2147483644] by call to `ssl_add_cert_chain`.
Showing all 9 steps of the trace


ssl/statem/statem_lib.c:353:1: Parameter `s->method->ssl3_enc->hhlen`
351.   }
352.   
353. > unsigned long ssl3_output_cert_chain(SSL *s, CERT_PKEY *cpk)
354.   {
355.       unsigned char *p;

ssl/statem/statem_lib.c:356:5: Assignment
354.   {
355.       unsigned char *p;
356.       unsigned long l = 3 + SSL_HM_HEADER_LENGTH(s);
           ^
357.   
358.       if (!ssl_add_cert_chain(s, cpk, &l))

ssl/statem/statem_lib.c:358:10: Call
356.       unsigned long l = 3 + SSL_HM_HEADER_LENGTH(s);
357.   
358.       if (!ssl_add_cert_chain(s, cpk, &l))
                ^
359.           return 0;
360.   

ssl/ssl_cert.c:841:1: Parameter `*l`
  839.   
  840.   /* Add certificate chain to internal SSL BUF_MEM strcuture */
  841. > int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l)
  842.   {
  843.       BUF_MEM *buf = s->init_buf;

ssl/ssl_cert.c:913:14: Call
  911.               return 0;
  912.           }
  913.           if (!ssl_add_cert_to_buf(buf, l, x))
                      ^
  914.               return 0;
  915.           for (i = 0; i < sk_X509_num(extra_certs); i++) {

ssl/ssl_cert.c:822:1: <Length trace>
820.   /* Add a certificate to a BUF_MEM structure */
821.   
822. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
823.   {
824.       int n;

ssl/ssl_cert.c:822:1: Parameter `*l`
    820.   /* Add a certificate to a BUF_MEM structure */
    821.   
    822. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
    823.   {
    824.       int n;

ssl/ssl_cert.c:832:5: Assignment
    830.           return 0;
    831.       }
    832.       p = (unsigned char *)&(buf->data[*l]);
               ^
    833.       l2n3(n, p);
    834.       i2d_X509(x, &p);

ssl/ssl_cert.c:833:5: Array access: Offset: [s->method->ssl3_enc->hhlen + 3, s->method->ssl3_enc->hhlen + 3] Size: [1, 2147483644] by call to `ssl_add_cert_chain` 
    831.       }
    832.       p = (unsigned char *)&(buf->data[*l]);
    833.       l2n3(n, p);
               ^
    834.       i2d_X509(x, &p);
    835.       *l += n + 3;
