ssl/t1_enc.c:1036: error: BUFFER_OVERRUN_L2
  Offset: [-oo, 58+max(0, `ssl->s3->read_mac_secret_size`)] Size: 13 by call to `ssl3_cbc_digest_record`.
Showing all 7 steps of the trace


ssl/t1_enc.c:975:1: Array declaration
973.   }
974.   
975. > int tls1_mac(SSL *ssl, unsigned char *md, int send)
976.   {
977.       SSL3_RECORD *rec;

ssl/t1_enc.c:1036:9: Call
1034.            */
1035.           /* Final param == not SSLv3 */
1036.           ssl3_cbc_digest_record(mac_ctx,
                ^
1037.                                  md, &md_size,
1038.                                  header, rec->input,

ssl/s3_cbc.c:409:1: <Offset trace>
407.    * padding too. )
408.    */
409. > void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
410.                               unsigned char *md_out,
411.                               size_t *md_out_size,

ssl/s3_cbc.c:409:1: Parameter `data_plus_mac_plus_padding_size`
  407.    * padding too. )
  408.    */
  409. > void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
  410.                               unsigned char *md_out,
  411.                               size_t *md_out_size,

ssl/s3_cbc.c:409:1: <Length trace>
407.    * padding too. )
408.    */
409. > void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
410.                               unsigned char *md_out,
411.                               size_t *md_out_size,

ssl/s3_cbc.c:409:1: Parameter `*header`
  407.    * padding too. )
  408.    */
  409. > void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
  410.                               unsigned char *md_out,
  411.                               size_t *md_out_size,

ssl/s3_cbc.c:675:21: Array access: Offset: [-oo, 58+max(0, ssl->s3->read_mac_secret_size)] Size: 13 by call to `ssl3_cbc_digest_record` 
  673.               unsigned char b = 0, is_past_c, is_past_cp1;
  674.               if (k < header_length)
  675.                   b = header[k];
                             ^
  676.               else if (k < data_plus_mac_plus_padding_size + header_length)
  677.                   b = data[k - header_length];
