ssl/statem/statem_srvr.c:3055: error: BUFFER_OVERRUN_S2
  Offset: [`s->method->ssl3_enc->hhlen` + 5, `s->method->ssl3_enc->hhlen` + 5] (⇐ [`s->method->ssl3_enc->hhlen` + 4, `s->method->ssl3_enc->hhlen` + 4] + 1) Size: [1, 2147483644].
Showing all 4 steps of the trace


ssl/statem/statem_srvr.c:2926:1: <Length trace>
2924.   }
2925.   
2926. > int tls_construct_new_session_ticket(SSL *s)
2927.   {
2928.       unsigned char *senc = NULL;

ssl/statem/statem_srvr.c:2926:1: Parameter `s->method->ssl3_enc->hhlen`
2924.   }
2925.   
2926. > int tls_construct_new_session_ticket(SSL *s)
2927.   {
2928.       unsigned char *senc = NULL;

ssl/statem/statem_srvr.c:3054:5: Assignment
3052.       len = p - ssl_handshake_start(s);
3053.       /* Skip ticket lifetime hint */
3054.       p = ssl_handshake_start(s) + 4;
            ^
3055.       s2n(len - 6, p);
3056.       if (!ssl_set_handshake_header(s, SSL3_MT_NEWSESSION_TICKET, len))

ssl/statem/statem_srvr.c:3055:5: Array access: Offset: [s->method->ssl3_enc->hhlen + 5, s->method->ssl3_enc->hhlen + 5] (⇐ [s->method->ssl3_enc->hhlen + 4, s->method->ssl3_enc->hhlen + 4] + 1) Size: [1, 2147483644]
3053.       /* Skip ticket lifetime hint */
3054.       p = ssl_handshake_start(s) + 4;
3055.       s2n(len - 6, p);
            ^
3056.       if (!ssl_set_handshake_header(s, SSL3_MT_NEWSESSION_TICKET, len))
3057.           goto err;
