ssl/record/ssl3_record.c:422: error: BUFFER_OVERRUN_L3
  Offset: [-320, +oo] Size: 17728 by call to `ssl3_cbc_copy_mac`.
Showing all 8 steps of the trace


ssl/record/ssl3_record.c:422:17: Call
420.                    */
421.                   mac = mac_tmp;
422.                   ssl3_cbc_copy_mac(mac_tmp, &rr[j], mac_size);
                       ^
423.                   rr[j].length -= mac_size;
424.               } else {

ssl/record/ssl3_record.c:1189:1: Parameter `md_size`
  1187.   #define CBC_MAC_ROTATE_IN_PLACE
  1188.   
  1189. > void ssl3_cbc_copy_mac(unsigned char *out,
  1190.                          const SSL3_RECORD *rec, unsigned md_size)
  1191.   {

ssl/record/ssl3_record.c:422:17: Call
420.                    */
421.                   mac = mac_tmp;
422.                   ssl3_cbc_copy_mac(mac_tmp, &rr[j], mac_size);
                       ^
423.                   rr[j].length -= mac_size;
424.               } else {

ssl/record/ssl3_record.c:1189:1: <Offset trace>
1187.   #define CBC_MAC_ROTATE_IN_PLACE
1188.   
1189. > void ssl3_cbc_copy_mac(unsigned char *out,
1190.                          const SSL3_RECORD *rec, unsigned md_size)
1191.   {

ssl/record/ssl3_record.c:1189:1: Parameter `md_size`
  1187.   #define CBC_MAC_ROTATE_IN_PLACE
  1188.   
  1189. > void ssl3_cbc_copy_mac(unsigned char *out,
  1190.                          const SSL3_RECORD *rec, unsigned md_size)
  1191.   {

ssl/record/ssl3_record.c:1189:1: <Length trace>
1187.   #define CBC_MAC_ROTATE_IN_PLACE
1188.   
1189. > void ssl3_cbc_copy_mac(unsigned char *out,
1190.                          const SSL3_RECORD *rec, unsigned md_size)
1191.   {

ssl/record/ssl3_record.c:1189:1: Parameter `*rec->data`
  1187.   #define CBC_MAC_ROTATE_IN_PLACE
  1188.   
  1189. > void ssl3_cbc_copy_mac(unsigned char *out,
  1190.                          const SSL3_RECORD *rec, unsigned md_size)
  1191.   {

ssl/record/ssl3_record.c:1239:27: Array access: Offset: [-320, +oo] Size: 17728 by call to `ssl3_cbc_copy_mac` 
  1237.           unsigned char mac_started = constant_time_ge_8(i, mac_start);
  1238.           unsigned char mac_ended = constant_time_ge_8(i, mac_end);
  1239.           unsigned char b = rec->data[i];
                                    ^
  1240.           rotated_mac[j++] |= b & mac_started & ~mac_ended;
  1241.           j &= constant_time_lt(j, md_size);
