ssl/statem/statem_srvr.c:2049: error: BUFFER_OVERRUN_S2
  Offset: [`s->method->ssl3_enc->hhlen` + 2, +oo] (⇐ [`s->method->ssl3_enc->hhlen` + 1, +oo] + 1) Size: [1, 2147483644].
Showing all 4 steps of the trace


ssl/statem/statem_srvr.c:1992:1: <Length trace>
1990.   }
1991.   
1992. > int tls_construct_certificate_request(SSL *s)
1993.   {
1994.       unsigned char *p, *d;

ssl/statem/statem_srvr.c:1992:1: Parameter `*s->init_buf->data`
1990.   }
1991.   
1992. > int tls_construct_certificate_request(SSL *s)
1993.   {
1994.       unsigned char *p, *d;

ssl/statem/statem_srvr.c:2048:5: Assignment
2046.       }
2047.       /* else no CA names */
2048.       p = ssl_handshake_start(s) + off;
            ^
2049.       s2n(nl, p);
2050.   

ssl/statem/statem_srvr.c:2049:5: Array access: Offset: [s->method->ssl3_enc->hhlen + 2, +oo] (⇐ [s->method->ssl3_enc->hhlen + 1, +oo] + 1) Size: [1, 2147483644]
2047.       /* else no CA names */
2048.       p = ssl_handshake_start(s) + off;
2049.       s2n(nl, p);
            ^
2050.   
2051.       if (!ssl_set_handshake_header(s, SSL3_MT_CERTIFICATE_REQUEST, n)) {
