crypto/modes/ccm128.c:430: error: BUFFER_OVERRUN_S2
  Offset added: [max(2, `len`), min(16, `len`)] Size: [0, +oo].
Showing all 5 steps of the trace


crypto/modes/ccm128.c:422:1: <Offset trace>
420.   }
421.   
422. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx, unsigned char *tag, size_t len)
423.   {
424.       unsigned int M = (ctx->nonce.c[0] >> 3) & 7; /* the M parameter */

crypto/modes/ccm128.c:422:1: Parameter `len`
420.   }
421.   
422. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx, unsigned char *tag, size_t len)
423.   {
424.       unsigned int M = (ctx->nonce.c[0] >> 3) & 7; /* the M parameter */

crypto/modes/ccm128.c:422:1: <Length trace>
420.   }
421.   
422. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx, unsigned char *tag, size_t len)
423.   {
424.       unsigned int M = (ctx->nonce.c[0] >> 3) & 7; /* the M parameter */

crypto/modes/ccm128.c:422:1: Parameter `ctx->cmac.c[*]`
420.   }
421.   
422. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx, unsigned char *tag, size_t len)
423.   {
424.       unsigned int M = (ctx->nonce.c[0] >> 3) & 7; /* the M parameter */

crypto/modes/ccm128.c:430:5: Array access: Offset added: [max(2, len), min(16, len)] Size: [0, +oo]
428.       if (len != M)
429.           return 0;
430.       memcpy(tag, ctx->cmac.c, M);
           ^
431.       return M;
432.   }

size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx, unsigned char *tag, size_t len)
{
    unsigned int M = (ctx->nonce.c[0] >> 3) & 7;
    M *= 2;
    M += 2;
    if (len != M)
        return 0;
    memcpy(tag, ctx->cmac.c, M);
    return M;
}
['size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx, unsigned char *tag, size_t len)\n{\n    unsigned int M = (ctx->nonce.c[0] >> 3) & 7;\n    M *= 2;\n    M += 2;\n    if (len != M)\n        return 0;\n    memcpy(tag, ctx->cmac.c, M);\n    return M;\n}']