ssl/statem/statem_dtls.c:369: error: BUFFER_OVERRUN_L3
  Offset: 11 (⇐ 9 + 2) Size: [1, 2147483644].
Showing all 11 steps of the trace


ssl/statem/statem_dtls.c:338:10: <Length trace>
336.   
337.    again:
338.       ok = dtls_get_reassembled_message(s, &tmplen);
                ^
339.       if (tmplen == DTLS1_HM_BAD_FRAGMENT || tmplen == DTLS1_HM_FRAGMENT_RETRY) {
340.           /* bad fragment received */

ssl/statem/statem_dtls.c:338:10: Call
336.   
337.    again:
338.       ok = dtls_get_reassembled_message(s, &tmplen);
                ^
339.       if (tmplen == DTLS1_HM_BAD_FRAGMENT || tmplen == DTLS1_HM_FRAGMENT_RETRY) {
340.           /* bad fragment received */

ssl/statem/statem_dtls.c:699:1: Parameter `*s->init_buf->data`
  697.   }
  698.   
  699. > static int dtls_get_reassembled_message(SSL *s, long *len)
  700.   {
  701.       unsigned char wire[DTLS1_HM_HEADER_LENGTH];

ssl/statem/statem_dtls.c:709:21: Call
  707.    redo:
  708.       /* see if we have the required fragment already */
  709.       if ((frag_len = dtls1_retrieve_buffered_fragment(s, &ok)) || ok) {
                             ^
  710.           if (ok)
  711.               s->init_num = frag_len;

ssl/statem/statem_dtls.c:432:1: Parameter `*s->init_buf->data`
    430.   }
    431.   
    432. > static int dtls1_retrieve_buffered_fragment(SSL *s, int *ok)
    433.   {
    434.       /*-

ssl/statem/statem_dtls.c:348:5: Assignment
346.       *mt = s->s3->tmp.message_type;
347.   
348.       p = (unsigned char *)s->init_buf->data;
           ^
349.   
350.       if (*mt == SSL3_MT_CHANGE_CIPHER_SPEC) {

ssl/statem/statem_dtls.c:365:7: Assignment
363.   
364.       /* reconstruct message header */
365.       *(p++) = msg_hdr->type;
             ^
366.       l2n3(msg_len, p);
367.       s2n(msg_hdr->seq, p);

ssl/statem/statem_dtls.c:366:5: Assignment
364.       /* reconstruct message header */
365.       *(p++) = msg_hdr->type;
366.       l2n3(msg_len, p);
           ^
367.       s2n(msg_hdr->seq, p);
368.       l2n3(0, p);

ssl/statem/statem_dtls.c:367:5: Assignment
365.       *(p++) = msg_hdr->type;
366.       l2n3(msg_len, p);
367.       s2n(msg_hdr->seq, p);
           ^
368.       l2n3(0, p);
369.       l2n3(msg_len, p);

ssl/statem/statem_dtls.c:368:5: Assignment
366.       l2n3(msg_len, p);
367.       s2n(msg_hdr->seq, p);
368.       l2n3(0, p);
           ^
369.       l2n3(msg_len, p);
370.       if (s->version != DTLS1_BAD_VER) {

ssl/statem/statem_dtls.c:369:5: Array access: Offset: 11 (⇐ 9 + 2) Size: [1, 2147483644]
367.       s2n(msg_hdr->seq, p);
368.       l2n3(0, p);
369.       l2n3(msg_len, p);
           ^
370.       if (s->version != DTLS1_BAD_VER) {
371.           p -= DTLS1_HM_HEADER_LENGTH;
