ssl/statem/statem_dtls.c:994: error: BUFFER_OVERRUN_L3
  Offset added: [1, 3] Size: [1, 3] by call to `dtls1_buffer_message`.
Showing all 10 steps of the trace


ssl/statem/statem_dtls.c:980:5: Assignment
978.       *p++ = SSL3_MT_CCS;
979.       s->d1->handshake_write_seq = s->d1->next_handshake_write_seq;
980.       s->init_num = DTLS1_CCS_HEADER_LENGTH;
           ^
981.   
982.       if (s->version == DTLS1_BAD_VER) {

ssl/statem/statem_dtls.c:994:10: Call
992.   
993.       /* buffer the message to handle re-xmits */
994.       if (!dtls1_buffer_message(s, 1)) {
                ^
995.           SSLerr(SSL_F_DTLS_CONSTRUCT_CHANGE_CIPHER_SPEC, ERR_R_INTERNAL_ERROR);
996.           return 0;

ssl/statem/statem_dtls.c:1092:1: <Offset trace>
1090.   }
1091.   
1092. > int dtls1_buffer_message(SSL *s, int is_ccs)
1093.   {
1094.       pitem *item;

ssl/statem/statem_dtls.c:1092:1: Parameter `s->init_num`
  1090.   }
  1091.   
  1092. > int dtls1_buffer_message(SSL *s, int is_ccs)
  1093.   {
  1094.       pitem *item;

ssl/statem/statem_dtls.c:1092:1: <Length trace>
1090.   }
1091.   
1092. > int dtls1_buffer_message(SSL *s, int is_ccs)
1093.   {
1094.       pitem *item;

ssl/statem/statem_dtls.c:1092:1: Parameter `s->init_num`
  1090.   }
  1091.   
  1092. > int dtls1_buffer_message(SSL *s, int is_ccs)
  1093.   {
  1094.       pitem *item;

ssl/statem/statem_dtls.c:1104:12: Call
  1102.       OPENSSL_assert(s->init_off == 0);
  1103.   
  1104.       frag = dtls1_hm_fragment_new(s->init_num, 0);
                     ^
  1105.       if (frag == NULL)
  1106.           return 0;

ssl/statem/statem_dtls.c:167:5: Assignment
    165.   {
    166.       hm_fragment *frag = NULL;
    167.       unsigned char *buf = NULL;
               ^
    168.       unsigned char *bitmask = NULL;
    169.   

ssl/statem/statem_dtls.c:183:5: Assignment
    181.   
    182.       /* zero length fragment gets zero frag->fragment */
    183.       frag->fragment = buf;
               ^
    184.   
    185.       /* Initialize reassembly bitmask if necessary */

ssl/statem/statem_dtls.c:1108:5: Array access: Offset added: [1, 3] Size: [1, 3] by call to `dtls1_buffer_message` 
  1106.           return 0;
  1107.   
  1108.       memcpy(frag->fragment, s->init_buf->data, s->init_num);
              ^
  1109.   
  1110.       if (is_ccs) {
