ssl/d1_lib.c:798: error: BUFFER_OVERRUN_L3
  Offset added: 11 (⇐ 3 + 8) Size: [1, 2147483644].
Showing all 9 steps of the trace


ssl/d1_lib.c:536:14: <Length trace>
534.           }
535.   
536.           if (!BUF_MEM_grow(bufm, SSL3_RT_MAX_PLAIN_LENGTH)) {
                    ^
537.               BUF_MEM_free(bufm);
538.               SSLerr(SSL_F_DTLSV1_LISTEN, ERR_R_MALLOC_FAILURE);

ssl/d1_lib.c:536:14: Call
534.           }
535.   
536.           if (!BUF_MEM_grow(bufm, SSL3_RT_MAX_PLAIN_LENGTH)) {
                    ^
537.               BUF_MEM_free(bufm);
538.               SSLerr(SSL_F_DTLSV1_LISTEN, ERR_R_MALLOC_FAILURE);

crypto/buffer/buffer.c:121:1: Parameter `*str->data`
  119.   }
  120.   
  121. > size_t BUF_MEM_grow(BUF_MEM *str, size_t len)
  122.   {
  123.       char *ret;

ssl/d1_lib.c:543:5: Assignment
541.           s->init_buf = bufm;
542.       }
543.       buf = (unsigned char *)s->init_buf->data;
           ^
544.   
545.       do {

ssl/d1_lib.c:778:13: Assignment
776.   
777.               /* Add the record header */
778.               p = buf;
                   ^
779.   
780.               *(p++) = SSL3_RT_HANDSHAKE;

ssl/d1_lib.c:780:15: Assignment
778.               p = buf;
779.   
780.               *(p++) = SSL3_RT_HANDSHAKE;
                     ^
781.               /*
782.                * Special case: for hello verify request, client version 1.0 and we

ssl/d1_lib.c:787:19: Assignment
785.                */
786.               if (s->method->version == DTLS_ANY_VERSION) {
787.                   *(p++) = DTLS1_VERSION >> 8;
                         ^
788.                   *(p++) = DTLS1_VERSION & 0xff;
789.               } else {

ssl/d1_lib.c:788:19: Assignment
786.               if (s->method->version == DTLS_ANY_VERSION) {
787.                   *(p++) = DTLS1_VERSION >> 8;
788.                   *(p++) = DTLS1_VERSION & 0xff;
                         ^
789.               } else {
790.                   *(p++) = s->version >> 8;

ssl/d1_lib.c:798:13: Array access: Offset added: 11 (⇐ 3 + 8) Size: [1, 2147483644]
796.                * ClientHello
797.                */
798.               memcpy(p, seq, SEQ_NUM_SIZE);
                   ^
799.               p += SEQ_NUM_SIZE;
800.   
