ssl/t1_lib.c:4191: error: BUFFER_OVERRUN_L3
  Offset: [-1, 7] Size: 8 by call to `tls1_check_chain`.
Showing all 6 steps of the trace


ssl/t1_lib.c:4191:12: Call
4189.   int SSL_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain)
4190.   {
4191.       return tls1_check_chain(s, x, pk, chain, -1);
                   ^
4192.   }
4193.   

ssl/t1_lib.c:3924:1: <Offset trace>
3922.            | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
3923.   
3924. > int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
3925.                        int idx)
3926.   {

ssl/t1_lib.c:3924:1: Parameter `idx`
  3922.            | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
  3923.   
  3924. > int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
  3925.                        int idx)
  3926.   {

ssl/t1_lib.c:3924:1: <Length trace>
3922.            | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
3923.   
3924. > int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
3925.                        int idx)
3926.   {

ssl/t1_lib.c:3924:1: Parameter `s->s3->tmp.md[*]`
  3922.            | CERT_PKEY_ISSUER_NAME|CERT_PKEY_CERT_TYPE)
  3923.   
  3924. > int tls1_check_chain(SSL *s, X509 *x, EVP_PKEY *pk, STACK_OF(X509) *chain,
  3925.                        int idx)
  3926.   {

ssl/t1_lib.c:4156:18: Array access: Offset: [-1, 7] Size: 8 by call to `tls1_check_chain` 
  4154.           if (*pvalid & CERT_PKEY_EXPLICIT_SIGN)
  4155.               rv |= CERT_PKEY_EXPLICIT_SIGN | CERT_PKEY_SIGN;
  4156.           else if (s->s3->tmp.md[idx] != NULL)
                           ^
  4157.               rv |= CERT_PKEY_SIGN;
  4158.       } else
