ssl/ssl_lib.c:245: error: BUFFER_OVERRUN_S2
  Offset: [`dctx->mdmax` + 1, `mtype` - 1] Size: [1, 8⋅`mtype` + 8].
Showing all 8 steps of the trace


ssl/ssl_lib.c:214:1: <Offset trace>
212.   }
213.   
214. > static int dane_mtype_set(struct dane_ctx_st *dctx,
215.                             const EVP_MD *md, uint8_t mtype, uint8_t ord)
216.   {

ssl/ssl_lib.c:214:1: Parameter `mtype`
212.   }
213.   
214. > static int dane_mtype_set(struct dane_ctx_st *dctx,
215.                             const EVP_MD *md, uint8_t mtype, uint8_t ord)
216.   {

ssl/ssl_lib.c:214:1: <Length trace>
212.   }
213.   
214. > static int dane_mtype_set(struct dane_ctx_st *dctx,
215.                             const EVP_MD *md, uint8_t mtype, uint8_t ord)
216.   {

ssl/ssl_lib.c:214:1: Parameter `*dctx->mdevp`
212.   }
213.   
214. > static int dane_mtype_set(struct dane_ctx_st *dctx,
215.                             const EVP_MD *md, uint8_t mtype, uint8_t ord)
216.   {

ssl/ssl_lib.c:229:17: Call
227.           int n = ((int)mtype) + 1;
228.   
229.           mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp));
                       ^
230.           if (mdevp == NULL) {
231.               SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);

crypto/mem.c:117:9: Assignment
  115.       if (num == 0) {
  116.           CRYPTO_free(str, file, line);
  117.           return NULL;
                 ^
  118.       }
  119.   

ssl/ssl_lib.c:229:9: Assignment
227.           int n = ((int)mtype) + 1;
228.   
229.           mdevp = OPENSSL_realloc(dctx->mdevp, n * sizeof(*mdevp));
               ^
230.           if (mdevp == NULL) {
231.               SSLerr(SSL_F_DANE_MTYPE_SET, ERR_R_MALLOC_FAILURE);

ssl/ssl_lib.c:245:13: Array access: Offset: [dctx->mdmax + 1, mtype - 1] Size: [1, 8⋅mtype + 8]
243.           /* Zero-fill any gaps */
244.           for (i = dctx->mdmax + 1; i < mtype; ++i) {
245.               mdevp[i] = NULL;
                   ^
246.               mdord[i] = 0;
247.           }
