ssl/t1_lib.c:1323: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: 28 by call to `tls_curve_allowed`.
Showing all 7 steps of the trace


ssl/t1_lib.c:1155:1: Parameter `*s->session->tlsext_ellipticcurvelist`
1153.   	}
1154.   
1155. > unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf, unsigned char *limit, int *al)
1156.   	{
1157.   	int extdatalen=0;

ssl/t1_lib.c:1323:8: Call
1321.   		for (i = 0; i < num_curves; i++, pcurves += 2)
1322.   			{
1323.   			if (tls_curve_allowed(s, pcurves, SSL_SECOP_CURVE_SUPPORTED))
               ^
1324.   				{
1325.   				*etmp++ = pcurves[0];

ssl/t1_lib.c:454:1: <Offset trace>
452.   
453.   /* See if curve is allowed by security callback */
454. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
455.   	{
456.   	const tls_curve_info *cinfo;

ssl/t1_lib.c:454:1: Parameter `*curve`
  452.   
  453.   /* See if curve is allowed by security callback */
  454. > static int tls_curve_allowed(SSL *s, const unsigned char *curve, int op)
  455.   	{
  456.   	const tls_curve_info *cinfo;

ssl/t1_lib.c:235:1: <Length trace>
233.   #define TLS_CURVE_PRIME		0x0
234.   
235. > static const tls_curve_info nid_list[] =
236.   	{
237.   		{NID_sect163k1, 80, TLS_CURVE_CHAR2},/* sect163k1 (1) */

ssl/t1_lib.c:235:1: Array declaration
  233.   #define TLS_CURVE_PRIME		0x0
  234.   
  235. > static const tls_curve_info nid_list[] =
  236.   	{
  237.   		{NID_sect163k1, 80, TLS_CURVE_CHAR2},/* sect163k1 (1) */

ssl/t1_lib.c:462:2: Array access: Offset: [-1, +oo] Size: 28 by call to `tls_curve_allowed` 
  460.   				sizeof(nid_list)/sizeof(nid_list[0])))
  461.   		return 0;
  462.   	cinfo = &nid_list[curve[1]-1];
          ^
  463.   #ifdef OPENSSL_NO_EC2M
  464.   	if (cinfo->flags & TLS_CURVE_CHAR2)
