ssl/t1_enc.c:586: error: BUFFER_OVERRUN_S2
  Offset added: `llen` + `contextlen` + 66 (⇐ `llen` + 66 + `contextlen`) Size: [`llen` + 64, `llen` + `contextlen` + 66].
Showing all 9 steps of the trace


ssl/t1_enc.c:550:1: <Offset trace>
548.   }
549.   
550. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
551.                                   const char *label, size_t llen,
552.                                   const unsigned char *context,

ssl/t1_enc.c:550:1: Parameter `contextlen`
548.   }
549.   
550. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
551.                                   const char *label, size_t llen,
552.                                   const unsigned char *context,

ssl/t1_enc.c:550:1: <Length trace>
548.   }
549.   
550. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
551.                                   const char *label, size_t llen,
552.                                   const unsigned char *context,

ssl/t1_enc.c:550:1: Parameter `llen`
548.   }
549.   
550. > int tls1_export_keying_material(SSL *s, unsigned char *out, size_t olen,
551.                                   const char *label, size_t llen,
552.                                   const unsigned char *context,

ssl/t1_enc.c:564:5: Assignment
562.        * concatenation of values does not create a prohibited label.
563.        */
564.       vallen = llen + SSL3_RANDOM_SIZE * 2;
           ^
565.       if (use_context) {
566.           vallen += 2 + contextlen;

ssl/t1_enc.c:569:11: Call
567.       }
568.   
569.       val = OPENSSL_malloc(vallen);
                 ^
570.       if (val == NULL)
571.           goto err2;

crypto/mem.c:165:9: Assignment
  163.   
  164.       if (num <= 0)
  165.           return NULL;
                 ^
  166.   
  167.       FAILTEST();

ssl/t1_enc.c:569:5: Assignment
567.       }
568.   
569.       val = OPENSSL_malloc(vallen);
           ^
570.       if (val == NULL)
571.           goto err2;

ssl/t1_enc.c:586:13: Array access: Offset added: llen + contextlen + 66 (⇐ llen + 66 + contextlen) Size: [llen + 64, llen + contextlen + 66]
584.           currentvalpos++;
585.           if ((contextlen > 0) || (context != NULL)) {
586.               memcpy(val + currentvalpos, context, contextlen);
                   ^
587.           }
588.       }
