ssl/statem/statem_clnt.c:2855: error: BUFFER_OVERRUN_L3
  Offset: [-2, 9] Size: 10 by call to `tls1_check_chain`.
Showing all 6 steps of the trace


ssl/statem/statem_clnt.c:2855:10: Call
2853.        */
2854.       if (s->cert->cert_flags & SSL_CERT_FLAGS_CHECK_TLS_STRICT &&
2855.           !tls1_check_chain(s, NULL, NULL, NULL, -2))
                 ^
2856.           return 0;
2857.       alg_k = s->s3->tmp.new_cipher->algorithm_mkey;

ssl/t1_lib.c:3959:1: <Offset trace>
3957.            | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
3958.   
3959. > int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
3960.                        int idx)
3961.   {

ssl/t1_lib.c:3959:1: Parameter `idx`
  3957.            | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
  3958.   
  3959. > int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
  3960.                        int idx)
  3961.   {

ssl/t1_lib.c:3959:1: <Length trace>
3957.            | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
3958.   
3959. > int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
3960.                        int idx)
3961.   {

ssl/t1_lib.c:3959:1: Parameter `s->s3->tmp.md[*]`
  3957.            | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
  3958.   
  3959. > int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
  3960.                        int idx)
  3961.   {

ssl/t1_lib.c:4205:18: Array access: Offset: [-2, 9] Size: 10 by call to `tls1_check_chain` 
  4203.           if (*pvalid & CERT_PKEY_EXPLICIT_SIGN)
  4204.               rv |= CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN;
  4205.           else if (s->s3->tmp.md[idx] != NULL)
                           ^
  4206.               rv |= CERT_PKEY_SIGN;
  4207.       } else
