ssl/t1_lib.c:1418: error: BUFFER_OVERRUN_L3
  Offset: [8, 10] (⇐ [7, 9] + 1) Size: [1, +oo].
Showing all 8 steps of the trace


ssl/t1_lib.c:1312:13: <Length trace>
1310.               s->session->tlsext_ticklen = ticklen;
1311.           } else
1312.               ticklen = 0;
                    ^
1313.           if (ticklen == 0 && s->tlsext_session_ticket &&
1314.               s->tlsext_session_ticket->data == NULL)

ssl/t1_lib.c:1312:13: Assignment
1310.               s->session->tlsext_ticklen = ticklen;
1311.           } else
1312.               ticklen = 0;
                    ^
1313.           if (ticklen == 0 && s->tlsext_session_ticket &&
1314.               s->tlsext_session_ticket->data == NULL)

ssl/t1_lib.c:1326:13: Assignment
1324.           if (ticklen) {
1325.               memcpy(ret, s->session->tlsext_tick, ticklen);
1326.               ret += ticklen;
                    ^
1327.           }
1328.       }

ssl/t1_lib.c:1396:5: Assignment
1394.       if ((limit - ret - 4 - 1) < 0)
1395.           return NULL;
1396.       s2n(TLSEXT_TYPE_heartbeat, ret);
            ^
1397.       s2n(1, ret);
1398.       /*-

ssl/t1_lib.c:1397:5: Assignment
1395.           return NULL;
1396.       s2n(TLSEXT_TYPE_heartbeat, ret);
1397.       s2n(1, ret);
            ^
1398.       /*-
1399.        * Set mode:

ssl/t1_lib.c:1404:11: Assignment
1402.        */
1403.       if (s->tlsext_heartbeat & SSL_TLSEXT_HB_DONT_RECV_REQUESTS)
1404.           *(ret++) = SSL_TLSEXT_HB_DONT_SEND_REQUESTS;
                  ^
1405.       else
1406.           *(ret++) = SSL_TLSEXT_HB_ENABLED;

ssl/t1_lib.c:1417:9: Assignment
1415.           if (limit - ret - 4 < 0)
1416.               return NULL;
1417.           s2n(TLSEXT_TYPE_next_proto_neg, ret);
                ^
1418.           s2n(0, ret);
1419.       }

ssl/t1_lib.c:1418:9: Array access: Offset: [8, 10] (⇐ [7, 9] + 1) Size: [1, +oo]
1416.               return NULL;
1417.           s2n(TLSEXT_TYPE_next_proto_neg, ret);
1418.           s2n(0, ret);
                ^
1419.       }
1420.   #endif
