ssl/statem/statem_lib.c:357: error: BUFFER_OVERRUN_S2
  Offset: [`s->method->ssl3_enc->hhlen` + 3, `s->method->ssl3_enc->hhlen` + 3] Size: [1, 2147483644] by call to `ssl_add_cert_chain`.
Showing all 12 steps of the trace


ssl/statem/statem_lib.c:352:1: Parameter `s->method->ssl3_enc->hhlen`
350.   }
351.   
352. > unsigned long ssl3_output_cert_chain(SSL *s, CERT_PKEY *cpk)
353.   {
354.       unsigned char *p;

ssl/statem/statem_lib.c:355:5: Assignment
353.   {
354.       unsigned char *p;
355.       unsigned long l = 3 + SSL_HM_HEADER_LENGTH(s);
           ^
356.   
357.       if (!ssl_add_cert_chain(s, cpk, &l))

ssl/statem/statem_lib.c:357:10: Call
355.       unsigned long l = 3 + SSL_HM_HEADER_LENGTH(s);
356.   
357.       if (!ssl_add_cert_chain(s, cpk, &l))
                ^
358.           return 0;
359.   

ssl/ssl_cert.c:857:1: Parameter `*l`
  855.   
  856.   /* Add certificate chain to internal SSL BUF_MEM structure */
  857. > int ssl_add_cert_chain(SSL *s, CERT_PKEY *cpk, unsigned long *l)
  858.   {
  859.       BUF_MEM *buf = s->init_buf;

ssl/ssl_cert.c:942:14: Call
  940.               return 0;
  941.           }
  942.           if (!ssl_add_cert_to_buf(buf, l, x))
                      ^
  943.               return 0;
  944.           for (i = 0; i < sk_X509_num(extra_certs); i++) {

ssl/ssl_cert.c:833:1: <Offset trace>
831.   /* Add a certificate to a BUF_MEM structure */
832.   
833. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
834.   {
835.       int n;

ssl/ssl_cert.c:833:1: Parameter `*l`
    831.   /* Add a certificate to a BUF_MEM structure */
    832.   
    833. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
    834.   {
    835.       int n;

ssl/ssl_cert.c:833:1: <Length trace>
831.   /* Add a certificate to a BUF_MEM structure */
832.   
833. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
834.   {
835.       int n;

ssl/ssl_cert.c:833:1: Parameter `*buf->data`
    831.   /* Add a certificate to a BUF_MEM structure */
    832.   
    833. > static int ssl_add_cert_to_buf(BUF_MEM *buf, unsigned long *l, X509 *x)
    834.   {
    835.       int n;

ssl/ssl_cert.c:839:19: Call
    837.   
    838.       n = i2d_X509(x, NULL);
    839.       if (n < 0 || !BUF_MEM_grow_clean(buf, (int)(n + (*l) + 3))) {
                             ^
    840.           SSLerr(SSL_F_SSL_ADD_CERT_TO_BUF, ERR_R_BUF_LIB);
    841.           return 0;

crypto/buffer/buffer.c:157:1: Parameter `*str->data`
      155.   }
      156.   
      157. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
      158.   {
      159.       char *ret;

ssl/ssl_cert.c:843:5: Array access: Offset: [s->method->ssl3_enc->hhlen + 3, s->method->ssl3_enc->hhlen + 3] Size: [1, 2147483644] by call to `ssl_add_cert_chain` 
    841.           return 0;
    842.       }
    843.       p = (unsigned char *)&(buf->data[*l]);
               ^
    844.       l2n3(n, p);
    845.       n = i2d_X509(x, &p);
