func: int CVE_2014_3509_VULN_ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n, int *al) unsigned short length ; unsigned short type ; unsigned short size ; unsigned char * data = * p ; s -> s3 -> next_proto_neg_seen = 0; s -> tlsext_heartbeat &= ~ ( SSL_TLSEXT_HB_ENABLED | SSL_TLSEXT_HB_DONT_SEND_REQUESTS ); if ( data >= ( d + n - 2 ) )  if ( data + length != d + n )  while ( data <= ( d + n - 4 ) )  if ( data + size > ( d + n ) )  if ( type == TLSEXT_TYPE_server_name )  if ( s -> tlsext_hostname == NULL || size > 0 )  if ( type == TLSEXT_TYPE_ec_point_formats && s -> version != DTLS1_VERSION )  unsigned char * sdata = data ; int ecpointformatlist_length = * ( sdata ++ ) ; if ( ecpointformatlist_length != size - 1 )  s -> session -> tlsext_ecpointformatlist_length = 0; if ( ( s -> session -> tlsext_ecpointformatlist = OPENSSL_malloc ( ecpointformatlist_length ) ) == NULL )  s -> session -> tlsext_ecpointformatlist_length = ecpointformatlist_length; fprintf ( stderr , "CVE_2014_3509_VULN_ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist " ); fprintf ( stderr , "%i " , * ( sdata ++ ) ); fprintf ( stderr , "\n" ); if ( type == TLSEXT_TYPE_session_ticket )  if ( s -> tls_session_ticket_ext_cb && ! s -> tls_session_ticket_ext_cb ( s , data , size , s -> tls_session_ticket_ext_cb_arg ) )  if ( ( SSL_get_options ( s ) & SSL_OP_NO_TICKET ) || ( size > 0 ) )  s -> tlsext_ticket_expected = 1; if ( type == TLSEXT_TYPE_opaque_prf_input && s -> version != DTLS1_VERSION )  unsigned char * sdata = data ; if ( size < 2 )  if ( s -> s3 -> server_opaque_prf_input_len != size - 2 )  if ( s -> s3 -> server_opaque_prf_input_len == 0 )  s -> s3 -> server_opaque_prf_input = OPENSSL_malloc ( 1 ); s -> s3 -> server_opaque_prf_input = BUF_memdup ( sdata , s -> s3 -> server_opaque_prf_input_len ); if ( s -> s3 -> server_opaque_prf_input == NULL )  if ( type == TLSEXT_TYPE_status_request && s -> version != DTLS1_VERSION )  if ( ( s -> tlsext_status_type == - 1 ) || ( size > 0 ) )  s -> tlsext_status_expected = 1; if ( type == TLSEXT_TYPE_next_proto_neg && s -> s3 -> tmp . finish_md_len == 0 )  unsigned char * selected ; unsigned char selected_len ; if ( s -> ctx -> next_proto_select_cb == NULL )  if ( ! ssl_next_proto_validate ( data , size ) )  if ( s -> ctx -> next_proto_select_cb ( s , & selected , & selected_len , data , size , s -> ctx -> next_proto_select_cb_arg ) != SSL_TLSEXT_ERR_OK )  s -> next_proto_negotiated = OPENSSL_malloc ( selected_len ); if ( ! s -> next_proto_negotiated )  memcpy ( s -> next_proto_negotiated , selected , selected_len ); s -> next_proto_negotiated_len = selected_len; s -> s3 -> next_proto_neg_seen = 1; if ( type == TLSEXT_TYPE_renegotiate )  if ( ! ssl_parse_serverhello_renegotiate_ext ( s , data , size , al ) )  if ( type == TLSEXT_TYPE_heartbeat )  switch ( data [ 0 ] )  s -> tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED; s -> tlsext_heartbeat |= SSL_TLSEXT_HB_ENABLED; s -> tlsext_heartbeat |= SSL_TLSEXT_HB_DONT_SEND_REQUESTS; if ( type == TLSEXT_TYPE_use_srtp )  if ( ssl_parse_serverhello_use_srtp_ext ( s , data , size , al ) )  data += size; 