ssl/statem/statem_srvr.c:2960: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [1, 65280] by call to `i2d_SSL_SESSION`.
Showing all 32 steps of the trace


ssl/statem/statem_srvr.c:2941:17: Call
2939.   
2940.       /* get session encoding length */
2941.       slen_full = i2d_SSL_SESSION(s->session, NULL);
                        ^
2942.       /*
2943.        * Some length values are 16 bits, so forget it if session is too

ssl/ssl_asn1.c:195:9: Assignment
  193.   
  194.       if ((in == NULL) || ((in->cipher == NULL) && (in->cipher_id == 0)))
  195.           return 0;
                 ^
  196.   
  197.       memset(&as, 0, sizeof(as));

ssl/statem/statem_srvr.c:2941:5: Assignment
2939.   
2940.       /* get session encoding length */
2941.       slen_full = i2d_SSL_SESSION(s->session, NULL);
            ^
2942.       /*
2943.        * Some length values are 16 bits, so forget it if session is too

ssl/statem/statem_srvr.c:2950:12: Call
2948.           return 0;
2949.       }
2950.       senc = OPENSSL_malloc(slen_full);
                   ^
2951.       if (senc == NULL) {
2952.           ossl_statem_set_error(s);

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

ssl/statem/statem_srvr.c:2950:5: Assignment
2948.           return 0;
2949.       }
2950.       senc = OPENSSL_malloc(slen_full);
            ^
2951.       if (senc == NULL) {
2952.           ossl_statem_set_error(s);

ssl/statem/statem_srvr.c:2959:5: Assignment
2957.       hctx = HMAC_CTX_new();
2958.   
2959.       p = senc;
            ^
2960.       if (!i2d_SSL_SESSION(s->session, &p))
2961.           goto err;

ssl/statem/statem_srvr.c:2960:10: Call
2958.   
2959.       p = senc;
2960.       if (!i2d_SSL_SESSION(s->session, &p))
                 ^
2961.           goto err;
2962.   

ssl/ssl_asn1.c:168:1: Parameter `**pp`
  166.   }
  167.   
  168. > int i2d_SSL_SESSION(SSL_SESSION *in, unsigned char **pp)
  169.   {
  170.   

ssl/ssl_asn1.c:252:12: Call
  250.       as.flags = in->flags;
  251.   
  252.       return i2d_SSL_SESSION_ASN1(&as, pp);
                    ^
  253.   
  254.   }

ssl/ssl_asn1.c:143:1: Parameter `**out`
    141.   } static_ASN1_SEQUENCE_END(SSL_SESSION_ASN1)
    142.   
    143. > IMPLEMENT_STATIC_ASN1_ENCODE_FUNCTIONS(SSL_SESSION_ASN1)
    144.   
    145.   /* Utility functions for i2d_SSL_SESSION */

ssl/ssl_asn1.c:143:1: Call
    141.   } static_ASN1_SEQUENCE_END(SSL_SESSION_ASN1)
    142.   
    143. > IMPLEMENT_STATIC_ASN1_ENCODE_FUNCTIONS(SSL_SESSION_ASN1)
    144.   
    145.   /* Utility functions for i2d_SSL_SESSION */

crypto/asn1/tasn_enc.c:92:1: Parameter `**out`
      90.   }
      91.   
      92. > int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)
      93.   {
      94.       return asn1_item_flags_i2d(val, out, it, 0);

crypto/asn1/tasn_enc.c:94:12: Call
      92.   int ASN1_item_i2d(ASN1_VALUE *val, unsigned char **out, const ASN1_ITEM *it)
      93.   {
      94.       return asn1_item_flags_i2d(val, out, it, 0);
                       ^
      95.   }
      96.   

crypto/asn1/tasn_enc.c:104:1: Parameter `**out`
        102.    */
        103.   
        104. > static int asn1_item_flags_i2d(ASN1_VALUE *val, unsigned char **out,
        105.                                  const ASN1_ITEM *it, int flags)
        106.   {

crypto/asn1/tasn_enc.c:122:12: Call
        120.       }
        121.   
        122.       return ASN1_item_ex_i2d(&val, out, it, -1, flags);
                          ^
        123.   }
        124.   

crypto/asn1/tasn_enc.c:130:1: Parameter `**out`
          128.    */
          129.   
          130. > int ASN1_item_ex_i2d(ASN1_VALUE **pval, unsigned char **out,
          131.                        const ASN1_ITEM *it, int tag, int aclass)
          132.   {

crypto/asn1/tasn_enc.c:154:16: Call
          152.   
          153.       case ASN1_ITYPE_MSTRING:
          154.           return asn1_i2d_ex_primitive(pval, out, it, -1, aclass);
                                ^
          155.   
          156.       case ASN1_ITYPE_CHOICE:

crypto/asn1/tasn_enc.c:472:1: Parameter `**out`
            470.   }
            471.   
            472. > static int asn1_i2d_ex_primitive(ASN1_VALUE **pval, unsigned char **out,
            473.                                    const ASN1_ITEM *it, int tag, int aclass)
            474.   {

crypto/asn1/tasn_enc.c:517:13: Call
            515.       if (out) {
            516.           if (usetag)
            517.               ASN1_put_object(out, ndef, len, tag, aclass);
                               ^
            518.           asn1_ex_i2c(pval, *out, &utype, it);
            519.           if (ndef)

crypto/asn1/asn1_lib.c:196:1: Parameter `**pp`
              194.    * class 0 is constructed constructed == 2 for indefinite length constructed
              195.    */
              196. > void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
              197.                        int xclass)
              198.   {

crypto/asn1/asn1_lib.c:199:5: Assignment
              197.                        int xclass)
              198.   {
              199.       unsigned char *p = *pp;
                         ^
              200.       int i, ttag;
              201.   

crypto/asn1/asn1_lib.c:205:11: Assignment
              203.       i |= (xclass & V_ASN1_PRIVATE);
              204.       if (tag < 31)
              205.           *(p++) = i | (tag & V_ASN1_PRIMITIVE_TAG);
                               ^
              206.       else {
              207.           *(p++) = i | V_ASN1_PRIMITIVE_TAG;

crypto/asn1/asn1_lib.c:222:9: Call
              220.           *(p++) = 0x80;
              221.       else
              222.           asn1_put_length(&p, length);
                             ^
              223.       *pp = p;
              224.   }

crypto/asn1/asn1_lib.c:243:14: <Offset trace>
241.       else {
242.           l = length;
243.           for (i = 0; l > 0; i++)
                    ^
244.               l >>= 8;
245.           *(p++) = i | 0x80;

crypto/asn1/asn1_lib.c:243:14: Assignment
                241.       else {
                242.           l = length;
                243.           for (i = 0; l > 0; i++)
                                    ^
                244.               l >>= 8;
                245.           *(p++) = i | 0x80;

crypto/asn1/asn1_lib.c:247:16: Assignment
                245.           *(p++) = i | 0x80;
                246.           l = i;
                247.           while (i-- > 0) {
                                      ^
                248.               p[i] = length & 0xff;
                249.               length >>= 8;

crypto/asn1/asn1_lib.c:235:1: <Length trace>
233.   }
234.   
235. > static void asn1_put_length(unsigned char **pp, int length)
236.   {
237.       unsigned char *p = *pp;

crypto/asn1/asn1_lib.c:235:1: Parameter `**pp`
                233.   }
                234.   
                235. > static void asn1_put_length(unsigned char **pp, int length)
                236.   {
                237.       unsigned char *p = *pp;

crypto/asn1/asn1_lib.c:237:5: Assignment
                235.   static void asn1_put_length(unsigned char **pp, int length)
                236.   {
                237.       unsigned char *p = *pp;
                           ^
                238.       int i, l;
                239.       if (length <= 127)

crypto/asn1/asn1_lib.c:245:11: Assignment
                243.           for (i = 0; l > 0; i++)
                244.               l >>= 8;
                245.           *(p++) = i | 0x80;
                                 ^
                246.           l = i;
                247.           while (i-- > 0) {

crypto/asn1/asn1_lib.c:248:13: Array access: Offset: [2, +oo] (⇐ [2, +oo] + [0, +oo]) Size: [1, 65280] by call to `i2d_SSL_SESSION` 
                246.           l = i;
                247.           while (i-- > 0) {
                248.               p[i] = length & 0xff;
                                   ^
                249.               length >>= 8;
                250.           }
