ssl/s3_cbc.c:486: error: BUFFER_OVERRUN_L2
  Offset: [-72, 79] Size: 16.
Showing all 5 steps of the trace


ssl/s3_cbc.c:193:5: <Offset trace>
191.       void (*md_final_raw) (void *ctx, unsigned char *md_out);
192.       void (*md_transform) (void *ctx, const unsigned char *block);
193.       unsigned md_size, md_block_size = 64;
           ^
194.       unsigned sslv3_pad_length = 40, header_length, variance_blocks,
195.           len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:193:5: Assignment
191.       void (*md_final_raw) (void *ctx, unsigned char *md_out);
192.       void (*md_transform) (void *ctx, const unsigned char *block);
193.       unsigned md_size, md_block_size = 64;
           ^
194.       unsigned sslv3_pad_length = 40, header_length, variance_blocks,
195.           len, max_mac_bytes, num_blocks,

ssl/s3_cbc.c:177:1: <Length trace>
175.    * Returns 1 on success or 0 on error
176.    */
177. > int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
178.                               unsigned char *md_out,
179.                               size_t *md_out_size,

ssl/s3_cbc.c:177:1: Array declaration
175.    * Returns 1 on success or 0 on error
176.    */
177. > int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
178.                               unsigned char *md_out,
179.                               size_t *md_out_size,

ssl/s3_cbc.c:486:44: Array access: Offset: [-72, 79] Size: 16
484.                   /* If this is index_b, write a length byte. */
485.                   b = constant_time_select_8(is_block_b,
486.                                              length_bytes[j -
                                                  ^
487.                                                           (md_block_size -
488.                                                            md_length_size)], b);
