ssl/statem/statem_dtls.c:477: error: BUFFER_OVERRUN_L3
  Offset: 11 (⇐ 9 + 2) Size: [1, 2147483644].
Showing all 11 steps of the trace


ssl/statem/statem_dtls.c:445:10: <Length trace>
443.   
444.    again:
445.       ok = dtls_get_reassembled_message(s, &tmplen);
                ^
446.       if (tmplen == DTLS1_HM_BAD_FRAGMENT
447.           || tmplen == DTLS1_HM_FRAGMENT_RETRY) {

ssl/statem/statem_dtls.c:445:10: Call
443.   
444.    again:
445.       ok = dtls_get_reassembled_message(s, &tmplen);
                ^
446.       if (tmplen == DTLS1_HM_BAD_FRAGMENT
447.           || tmplen == DTLS1_HM_FRAGMENT_RETRY) {

ssl/statem/statem_dtls.c:809:1: Parameter `*s->init_buf->data`
  807.   }
  808.   
  809. > static int dtls_get_reassembled_message(SSL *s, long *len)
  810.   {
  811.       unsigned char wire[DTLS1_HM_HEADER_LENGTH];

ssl/statem/statem_dtls.c:819:21: Call
  817.    redo:
  818.       /* see if we have the required fragment already */
  819.       if ((frag_len = dtls1_retrieve_buffered_fragment(s, &ok)) || ok) {
                             ^
  820.           if (ok)
  821.               s->init_num = frag_len;

ssl/statem/statem_dtls.c:541:1: Parameter `*s->init_buf->data`
    539.   }
    540.   
    541. > static int dtls1_retrieve_buffered_fragment(SSL *s, int *ok)
    542.   {
    543.       /*-

ssl/statem/statem_dtls.c:456:5: Assignment
454.       *mt = s->s3->tmp.message_type;
455.   
456.       p = (unsigned char *)s->init_buf->data;
           ^
457.   
458.       if (*mt == SSL3_MT_CHANGE_CIPHER_SPEC) {

ssl/statem/statem_dtls.c:473:7: Assignment
471.   
472.       /* reconstruct message header */
473.       *(p++) = msg_hdr->type;
             ^
474.       l2n3(msg_len, p);
475.       s2n(msg_hdr->seq, p);

ssl/statem/statem_dtls.c:474:5: Assignment
472.       /* reconstruct message header */
473.       *(p++) = msg_hdr->type;
474.       l2n3(msg_len, p);
           ^
475.       s2n(msg_hdr->seq, p);
476.       l2n3(0, p);

ssl/statem/statem_dtls.c:475:5: Assignment
473.       *(p++) = msg_hdr->type;
474.       l2n3(msg_len, p);
475.       s2n(msg_hdr->seq, p);
           ^
476.       l2n3(0, p);
477.       l2n3(msg_len, p);

ssl/statem/statem_dtls.c:476:5: Assignment
474.       l2n3(msg_len, p);
475.       s2n(msg_hdr->seq, p);
476.       l2n3(0, p);
           ^
477.       l2n3(msg_len, p);
478.       if (s->version != DTLS1_BAD_VER) {

ssl/statem/statem_dtls.c:477:5: Array access: Offset: 11 (⇐ 9 + 2) Size: [1, 2147483644]
475.       s2n(msg_hdr->seq, p);
476.       l2n3(0, p);
477.       l2n3(msg_len, p);
           ^
478.       if (s->version != DTLS1_BAD_VER) {
479.           p -= DTLS1_HM_HEADER_LENGTH;
