ssl/s3_enc.c:308: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `ssl3_generate_key_block`.
Showing all 13 steps of the trace


ssl/s3_enc.c:276:1: Global `n_cipher.iv_len`
274.   	}
275.   
276. > int ssl3_setup_key_block(SSL *s)
277.   	{
278.   	unsigned char *p;

ssl/s3_enc.c:297:2: Assignment
295.   	s->s3->tmp.new_compression=comp;
296.   
297.   	num=EVP_CIPHER_key_length(c)+EVP_MD_size(hash)+EVP_CIPHER_iv_length(c);
        ^
298.   	num*=2;
299.   

ssl/s3_enc.c:298:2: Assignment
296.   
297.   	num=EVP_CIPHER_key_length(c)+EVP_MD_size(hash)+EVP_CIPHER_iv_length(c);
298.   	num*=2;
        ^
299.   
300.   	ssl3_cleanup_key_block(s);

ssl/s3_enc.c:302:26: Array declaration
300.   	ssl3_cleanup_key_block(s);
301.   
302.   	if ((p=(unsigned char *)Malloc(num)) == NULL)
                                ^
303.   		goto err;
304.   

ssl/s3_enc.c:302:7: Assignment
300.   	ssl3_cleanup_key_block(s);
301.   
302.   	if ((p=(unsigned char *)Malloc(num)) == NULL)
             ^
303.   		goto err;
304.   

ssl/s3_enc.c:308:2: Call
306.   	s->s3->tmp.key_block=p;
307.   
308.   	ssl3_generate_key_block(s,p,num);
        ^
309.   
310.   	return(1);

ssl/s3_enc.c:86:1: Parameter `*km`
  84.   #endif
  85.   
  86. > static void ssl3_generate_key_block(SSL *s, unsigned char *km, int num)
  87.   	{
  88.   	MD5_CTX m5;

ssl/s3_enc.c:119:4: Call
  117.   			}
  118.   		else
  119.   			MD5_Final(km,&m5);
            ^
  120.   
  121.   		km+=MD5_DIGEST_LENGTH;

crypto/md5/md5_dgst.c:362:1: <Length trace>
360.   #endif
361.   
362. > void MD5_Final(unsigned char *md, MD5_CTX *c)
363.   	{
364.   	register int i,j;

crypto/md5/md5_dgst.c:362:1: Parameter `*md`
    360.   #endif
    361.   
    362. > void MD5_Final(unsigned char *md, MD5_CTX *c)
    363.   	{
    364.   	register int i,j;

crypto/md5/md5_dgst.c:404:2: Assignment
    402.   	p[MD5_LBLOCK-1]=c->Nh;
    403.   	md5_block(c,p,64);
    404.   	cp=md;
            ^
    405.   	l=c->A; l2c(l,cp);
    406.   	l=c->B; l2c(l,cp);

crypto/md5/md5_dgst.c:405:10: Assignment
    403.   	md5_block(c,p,64);
    404.   	cp=md;
    405.   	l=c->A; l2c(l,cp);
                    ^
    406.   	l=c->B; l2c(l,cp);
    407.   	l=c->C; l2c(l,cp);

crypto/md5/md5_dgst.c:405:10: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `ssl3_generate_key_block` 
    403.   	md5_block(c,p,64);
    404.   	cp=md;
    405.   	l=c->A; l2c(l,cp);
                    ^
    406.   	l=c->B; l2c(l,cp);
    407.   	l=c->C; l2c(l,cp);
