ssl/ssl_cert.c:901: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] (⇐ [0, +oo] + 2) Size: [1, 2147483644] by call to `ssl_add_cert_to_buf`.
Showing all 6 steps of the trace


ssl/ssl_cert.c:841:1: Parameter `*l`
839.   
840.   /* Add certificate chain to internal SSL BUF_MEM strcuture */
841. > int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l)
842.   {
843.       BUF_MEM *buf = s->init_buf;

ssl/ssl_cert.c:901:18: Call
899.               x = sk_X509_value(xs_ctx.chain, i);
900.   
901.               if (!ssl_add_cert_to_buf(buf, l, x)) {
                        ^
902.                   X509_STORE_CTX_cleanup(&xs_ctx);
903.                   return 0;

ssl/ssl_cert.c:822:1: <Length trace>
820.   /* Add a certificate to a BUF_MEM structure */
821.   
822. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
823.   {
824.       int n;

ssl/ssl_cert.c:822:1: Parameter `*l`
  820.   /* Add a certificate to a BUF_MEM structure */
  821.   
  822. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
  823.   {
  824.       int n;

ssl/ssl_cert.c:832:5: Assignment
  830.           return 0;
  831.       }
  832.       p = (unsigned char *)&(buf->data[*l]);
             ^
  833.       l2n3(n, p);
  834.       i2d_X509(x, &p);

ssl/ssl_cert.c:833:5: Array access: Offset: [2, +oo] (⇐ [0, +oo] + 2) Size: [1, 2147483644] by call to `ssl_add_cert_to_buf` 
  831.       }
  832.       p = (unsigned char *)&(buf->data[*l]);
  833.       l2n3(n, p);
             ^
  834.       i2d_X509(x, &p);
  835.       *l += n + 3;
