ssl/record/ssl3_record.c:1556: error: BUFFER_OVERRUN_L2
  Offset added: [0, 17728] Size: 128 by call to `dtls1_process_record`.
Showing all 11 steps of the trace


ssl/record/ssl3_record.c:1437:13: Assignment
1435.           /* this packet contained a partial record, dump it */
1436.           if (RECORD_LAYER_get_packet_length(&s->rlayer) != DTLS1_RT_HEADER_LENGTH) {
1437.               RECORD_LAYER_reset_packet_length(&s->rlayer);
                    ^
1438.               goto again;
1439.           }

ssl/record/ssl3_record.c:1556:10: Call
1554.       }
1555.   
1556.       if (!dtls1_process_record(s)) {
                 ^
1557.           rr->length = 0;
1558.           RECORD_LAYER_reset_packet_length(&s->rlayer);   /* dump this record */

ssl/record/ssl3_record.c:1218:1: Parameter `s->rlayer.rrec.length`
  1216.   }
  1217.   
  1218. > int dtls1_process_record(SSL *s)
  1219.   {
  1220.       int i, al;

ssl/record/ssl3_record.c:1257:5: Assignment
  1255.       /* decrypt in place in 'rr->input' */
  1256.       rr->data = rr->input;
  1257.       rr->orig_len = rr->length;
              ^
  1258.   
  1259.       enc_err = s->method->ssl3_enc->enc(s, 0);

ssl/record/ssl3_record.c:1314:13: Call
  1312.                */
  1313.               mac = mac_tmp;
  1314.               ssl3_cbc_copy_mac(mac_tmp, rr, mac_size);
                      ^
  1315.               rr->length -= mac_size;
  1316.           } else {

ssl/record/ssl3_record.c:1141:1: <Offset trace>
1139.   #define CBC_MAC_ROTATE_IN_PLACE
1140.   
1141. > void ssl3_cbc_copy_mac(unsigned char *out,
1142.                          const SSL3_RECORD *rec, unsigned md_size)
1143.   {

ssl/record/ssl3_record.c:1141:1: Parameter `md_size`
    1139.   #define CBC_MAC_ROTATE_IN_PLACE
    1140.   
    1141. > void ssl3_cbc_copy_mac(unsigned char *out,
    1142.                          const SSL3_RECORD *rec, unsigned md_size)
    1143.   {

ssl/record/ssl3_record.c:1141:1: <Length trace>
1139.   #define CBC_MAC_ROTATE_IN_PLACE
1140.   
1141. > void ssl3_cbc_copy_mac(unsigned char *out,
1142.                          const SSL3_RECORD *rec, unsigned md_size)
1143.   {

ssl/record/ssl3_record.c:1141:1: Array declaration
    1139.   #define CBC_MAC_ROTATE_IN_PLACE
    1140.   
    1141. > void ssl3_cbc_copy_mac(unsigned char *out,
    1142.                          const SSL3_RECORD *rec, unsigned md_size)
    1143.   {

ssl/record/ssl3_record.c:1169:5: Assignment
    1167.   
    1168.   #if defined(CBC_MAC_ROTATE_IN_PLACE)
    1169.       rotated_mac = rotated_mac_buf + ((0 - (size_t)rotated_mac_buf) & 63);
                ^
    1170.   #endif
    1171.   

ssl/record/ssl3_record.c:1187:5: Array access: Offset added: [0, 17728] Size: 128 by call to `dtls1_process_record` 
    1185.       rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;
    1186.   
    1187.       memset(rotated_mac, 0, md_size);
                ^
    1188.       for (i = scan_start, j = 0; i < rec->orig_len; i++) {
    1189.           unsigned char mac_started = constant_time_ge_8(i, mac_start);
