crypto/rand/drbg_rand.c:201: error: INTEGER_OVERFLOW_L2
  (1 - [-37, 15]):unsigned64 by call to `ctr_BCC_update`.
Showing all 13 steps of the trace


crypto/rand/drbg_rand.c:197:5: Assignment
195.       *p++ = 0;
196.       *p = (unsigned char)((cctx->keylen + 16) & 0xff);
197.       cctx->bltmp_pos = 8;
           ^
198.       ctr_BCC_update(cctx, in1, in1len);
199.       ctr_BCC_update(cctx, in2, in2len);

crypto/rand/drbg_rand.c:198:5: Call
196.       *p = (unsigned char)((cctx->keylen + 16) & 0xff);
197.       cctx->bltmp_pos = 8;
198.       ctr_BCC_update(cctx, in1, in1len);
           ^
199.       ctr_BCC_update(cctx, in2, in2len);
200.       ctr_BCC_update(cctx, in3, in3len);

crypto/rand/drbg_rand.c:129:1: Parameter `cctx->bltmp_pos`
  127.    * Process several blocks into BCC algorithm, some possibly partial
  128.    */
  129. > static void ctr_BCC_update(DRBG_CTR_CTX *cctx,
  130.                              const unsigned char *in, size_t inlen)
  131.   {

crypto/rand/drbg_rand.c:199:5: Call
197.       cctx->bltmp_pos = 8;
198.       ctr_BCC_update(cctx, in1, in1len);
199.       ctr_BCC_update(cctx, in2, in2len);
           ^
200.       ctr_BCC_update(cctx, in3, in3len);
201.       ctr_BCC_update(cctx, &c80, 1);

crypto/rand/drbg_rand.c:129:1: Parameter `cctx->bltmp_pos`
  127.    * Process several blocks into BCC algorithm, some possibly partial
  128.    */
  129. > static void ctr_BCC_update(DRBG_CTR_CTX *cctx,
  130.                              const unsigned char *in, size_t inlen)
  131.   {

crypto/rand/drbg_rand.c:200:5: Call
198.       ctr_BCC_update(cctx, in1, in1len);
199.       ctr_BCC_update(cctx, in2, in2len);
200.       ctr_BCC_update(cctx, in3, in3len);
           ^
201.       ctr_BCC_update(cctx, &c80, 1);
202.       ctr_BCC_final(cctx);

crypto/rand/drbg_rand.c:129:1: Parameter `cctx->bltmp_pos`
  127.    * Process several blocks into BCC algorithm, some possibly partial
  128.    */
  129. > static void ctr_BCC_update(DRBG_CTR_CTX *cctx,
  130.                              const unsigned char *in, size_t inlen)
  131.   {

crypto/rand/drbg_rand.c:201:5: Call
199.       ctr_BCC_update(cctx, in2, in2len);
200.       ctr_BCC_update(cctx, in3, in3len);
201.       ctr_BCC_update(cctx, &c80, 1);
           ^
202.       ctr_BCC_final(cctx);
203.       /* Set up key K */

crypto/rand/drbg_rand.c:129:1: <LHS trace>
127.    * Process several blocks into BCC algorithm, some possibly partial
128.    */
129. > static void ctr_BCC_update(DRBG_CTR_CTX *cctx,
130.                              const unsigned char *in, size_t inlen)
131.   {

crypto/rand/drbg_rand.c:129:1: Parameter `inlen`
  127.    * Process several blocks into BCC algorithm, some possibly partial
  128.    */
  129. > static void ctr_BCC_update(DRBG_CTR_CTX *cctx,
  130.                              const unsigned char *in, size_t inlen)
  131.   {

crypto/rand/drbg_rand.c:129:1: <RHS trace>
127.    * Process several blocks into BCC algorithm, some possibly partial
128.    */
129. > static void ctr_BCC_update(DRBG_CTR_CTX *cctx,
130.                              const unsigned char *in, size_t inlen)
131.   {

crypto/rand/drbg_rand.c:129:1: Parameter `inlen`
  127.    * Process several blocks into BCC algorithm, some possibly partial
  128.    */
  129. > static void ctr_BCC_update(DRBG_CTR_CTX *cctx,
  130.                              const unsigned char *in, size_t inlen)
  131.   {

crypto/rand/drbg_rand.c:144:13: Binary operation: (1 - [-37, 15]):unsigned64 by call to `ctr_BCC_update` 
  142.               ctr_BCC_blocks(cctx, cctx->bltmp);
  143.               cctx->bltmp_pos = 0;
  144.               inlen -= left;
                     ^
  145.               in += left;
  146.           }

static void ctr_BCC_update(DRBG_CTR_CTX *cctx,
                           const unsigned char *in, size_t inlen)
{
    if (in == NULL || inlen == 0)
        return;
    if (cctx->bltmp_pos) {
        size_t left = 16 - cctx->bltmp_pos;
        if (inlen >= left) {
            memcpy(cctx->bltmp + cctx->bltmp_pos, in, left);
            ctr_BCC_blocks(cctx, cctx->bltmp);
            cctx->bltmp_pos = 0;
            inlen -= left;
            in += left;
        }
    }
    for (; inlen >= 16; in += 16, inlen -= 16) {
        ctr_BCC_blocks(cctx, in);
    }
    if (inlen > 0) {
        memcpy(cctx->bltmp + cctx->bltmp_pos, in, inlen);
        cctx->bltmp_pos += inlen;
    }
}
['static void ctr_df(DRBG_CTR_CTX *cctx,\n                   const unsigned char *in1, size_t in1len,\n                   const unsigned char *in2, size_t in2len,\n                   const unsigned char *in3, size_t in3len)\n{\n    static unsigned char c80 = 0x80;\n    size_t inlen;\n    unsigned char *p = cctx->bltmp;\n    ctr_BCC_init(cctx);\n    if (in1 == NULL)\n        in1len = 0;\n    if (in2 == NULL)\n        in2len = 0;\n    if (in3 == NULL)\n        in3len = 0;\n    inlen = in1len + in2len + in3len;\n    *p++ = (inlen >> 24) & 0xff;\n    *p++ = (inlen >> 16) & 0xff;\n    *p++ = (inlen >> 8) & 0xff;\n    *p++ = inlen & 0xff;\n    *p++ = 0;\n    *p++ = 0;\n    *p++ = 0;\n    *p = (unsigned char)((cctx->keylen + 16) & 0xff);\n    cctx->bltmp_pos = 8;\n    ctr_BCC_update(cctx, in1, in1len);\n    ctr_BCC_update(cctx, in2, in2len);\n    ctr_BCC_update(cctx, in3, in3len);\n    ctr_BCC_update(cctx, &c80, 1);\n    ctr_BCC_final(cctx);\n    AES_set_encrypt_key(cctx->KX, cctx->keylen * 8, &cctx->df_kxks);\n    AES_encrypt(cctx->KX + cctx->keylen, cctx->KX, &cctx->df_kxks);\n    AES_encrypt(cctx->KX, cctx->KX + 16, &cctx->df_kxks);\n    if (cctx->keylen != 16)\n        AES_encrypt(cctx->KX + 16, cctx->KX + 32, &cctx->df_kxks);\n}', 'static void ctr_BCC_update(DRBG_CTR_CTX *cctx,\n                           const unsigned char *in, size_t inlen)\n{\n    if (in == NULL || inlen == 0)\n        return;\n    if (cctx->bltmp_pos) {\n        size_t left = 16 - cctx->bltmp_pos;\n        if (inlen >= left) {\n            memcpy(cctx->bltmp + cctx->bltmp_pos, in, left);\n            ctr_BCC_blocks(cctx, cctx->bltmp);\n            cctx->bltmp_pos = 0;\n            inlen -= left;\n            in += left;\n        }\n    }\n    for (; inlen >= 16; in += 16, inlen -= 16) {\n        ctr_BCC_blocks(cctx, in);\n    }\n    if (inlen > 0) {\n        memcpy(cctx->bltmp + cctx->bltmp_pos, in, inlen);\n        cctx->bltmp_pos += inlen;\n    }\n}']