ssl/t1_lib.c:1421: error: BUFFER_OVERRUN_S2
  Offset added: [`s->alpn_client_proto_list_len` + 6, `s->alpn_client_proto_list_len` + 12] (⇐ [6, 12] + `s->alpn_client_proto_list_len`) Size: [1, +oo].
Showing all 9 steps of the trace


ssl/t1_lib.c:1106:1: <Offset trace>
1104.   }
1105.   
1106. > unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf,
1107.                                             unsigned char *limit, int *al)
1108.   {

ssl/t1_lib.c:1106:1: Parameter `*limit`
1104.   }
1105.   
1106. > unsigned char *ssl_add_clienthello_tlsext(SSL *s, unsigned char *buf,
1107.                                             unsigned char *limit, int *al)
1108.   {

ssl/t1_lib.c:1303:13: <Length trace>
1301.               s->session->tlsext_ticklen = ticklen;
1302.           } else
1303.               ticklen = 0;
                    ^
1304.           if (ticklen == 0 && s->tlsext_session_ticket &&
1305.               s->tlsext_session_ticket->data == NULL)

ssl/t1_lib.c:1303:13: Assignment
1301.               s->session->tlsext_ticklen = ticklen;
1302.           } else
1303.               ticklen = 0;
                    ^
1304.           if (ticklen == 0 && s->tlsext_session_ticket &&
1305.               s->tlsext_session_ticket->data == NULL)

ssl/t1_lib.c:1317:13: Assignment
1315.           if (ticklen) {
1316.               memcpy(ret, s->session->tlsext_tick, ticklen);
1317.               ret += ticklen;
                    ^
1318.           }
1319.       }

ssl/t1_lib.c:1418:9: Assignment
1416.           if ((size_t)(limit - ret) < 6 + s->alpn_client_proto_list_len)
1417.               return NULL;
1418.           s2n(TLSEXT_TYPE_application_layer_protocol_negotiation, ret);
                ^
1419.           s2n(2 + s->alpn_client_proto_list_len, ret);
1420.           s2n(s->alpn_client_proto_list_len, ret);

ssl/t1_lib.c:1419:9: Assignment
1417.               return NULL;
1418.           s2n(TLSEXT_TYPE_application_layer_protocol_negotiation, ret);
1419.           s2n(2 + s->alpn_client_proto_list_len, ret);
                ^
1420.           s2n(s->alpn_client_proto_list_len, ret);
1421.           memcpy(ret, s->alpn_client_proto_list, s->alpn_client_proto_list_len);

ssl/t1_lib.c:1420:9: Assignment
1418.           s2n(TLSEXT_TYPE_application_layer_protocol_negotiation, ret);
1419.           s2n(2 + s->alpn_client_proto_list_len, ret);
1420.           s2n(s->alpn_client_proto_list_len, ret);
                ^
1421.           memcpy(ret, s->alpn_client_proto_list, s->alpn_client_proto_list_len);
1422.           ret += s->alpn_client_proto_list_len;

ssl/t1_lib.c:1421:9: Array access: Offset added: [s->alpn_client_proto_list_len + 6, s->alpn_client_proto_list_len + 12] (⇐ [6, 12] + s->alpn_client_proto_list_len) Size: [1, +oo]
1419.           s2n(2 + s->alpn_client_proto_list_len, ret);
1420.           s2n(s->alpn_client_proto_list_len, ret);
1421.           memcpy(ret, s->alpn_client_proto_list, s->alpn_client_proto_list_len);
                ^
1422.           ret += s->alpn_client_proto_list_len;
1423.       }
