crypto/md2/md2_one.c:74: error: BUFFER_OVERRUN_L3
  Offset added: 16 Size: [0, +oo] by call to `MD2_Update`.
Showing all 8 steps of the trace


crypto/md2/md2_one.c:72:2: Call
70.   
71.   	if (md == NULL) md=m;
72.   	MD2_Init(&c);
       ^
73.   #ifndef CHARSET_EBCDIC
74.   	MD2_Update(&c,d,n);

crypto/md2/md2_dgst.c:120:2: Assignment
  118.   int MD2_Init(MD2_CTX *c)
  119.   	{
  120.   	c->num=0;
          ^
  121.   	memset(c->state,0,MD2_BLOCK*sizeof(MD2_INT));
  122.   	memset(c->cksm,0,MD2_BLOCK*sizeof(MD2_INT));

crypto/md2/md2_one.c:74:2: Call
72.   	MD2_Init(&c);
73.   #ifndef CHARSET_EBCDIC
74.   	MD2_Update(&c,d,n);
       ^
75.   #else
76.   	{

crypto/md2/md2_dgst.c:127:1: <Offset trace>
125.   	}
126.   
127. > int MD2_Update(MD2_CTX *c, const unsigned char *data, unsigned long len)
128.   	{
129.   	register UCHAR *p;

crypto/md2/md2_dgst.c:127:1: Parameter `len`
  125.   	}
  126.   
  127. > int MD2_Update(MD2_CTX *c, const unsigned char *data, unsigned long len)
  128.   	{
  129.   	register UCHAR *p;

crypto/md2/md2_dgst.c:127:1: <Length trace>
125.   	}
126.   
127. > int MD2_Update(MD2_CTX *c, const unsigned char *data, unsigned long len)
128.   	{
129.   	register UCHAR *p;

crypto/md2/md2_dgst.c:127:1: Parameter `c->data[*]`
  125.   	}
  126.   
  127. > int MD2_Update(MD2_CTX *c, const unsigned char *data, unsigned long len)
  128.   	{
  129.   	register UCHAR *p;

crypto/md2/md2_dgst.c:138:4: Array access: Offset added: 16 Size: [0, +oo] by call to `MD2_Update` 
  136.   		if ((c->num+len) >= MD2_BLOCK)
  137.   			{
  138.   			memcpy(&(p[c->num]),data,MD2_BLOCK-c->num);
            ^
  139.   			md2_block(c,c->data);
  140.   			data+=(MD2_BLOCK - c->num);

int MD2_Update(MD2_CTX *c, const unsigned char *data, unsigned long len)
	{
	register UCHAR *p;
	if (len == 0) return 1;
	p=c->data;
	if (c->num != 0)
		{
		if ((c->num+len) >= MD2_BLOCK)
			{
			memcpy(&(p[c->num]),data,MD2_BLOCK-c->num);
			md2_block(c,c->data);
			data+=(MD2_BLOCK - c->num);
			len-=(MD2_BLOCK - c->num);
			c->num=0;
			}
		else
			{
			memcpy(&(p[c->num]),data,(int)len);
			c->num+=(int)len;
			return 1;
			}
		}
	while (len >= MD2_BLOCK)
		{
		md2_block(c,data);
		data+=MD2_BLOCK;
		len-=MD2_BLOCK;
		}
	memcpy(p,data,(int)len);
	c->num=(int)len;
	return 1;
	}
['unsigned char *MD2(const unsigned char *d, unsigned long n, unsigned char *md)\n\t{\n\tMD2_CTX c;\n\tstatic unsigned char m[MD2_DIGEST_LENGTH];\n\tif (md == NULL) md=m;\n\tMD2_Init(&c);\n#ifndef CHARSET_EBCDIC\n\tMD2_Update(&c,d,n);\n#else\n\t{\n\t\tchar temp[1024];\n\t\tunsigned long chunk;\n\t\twhile (n > 0)\n\t\t{\n\t\t\tchunk = (n > sizeof(temp)) ? sizeof(temp) : n;\n\t\t\tebcdic2ascii(temp, d, chunk);\n\t\t\tMD2_Update(&c,temp,chunk);\n\t\t\tn -= chunk;\n\t\t\td += chunk;\n\t\t}\n\t}\n#endif\n\tMD2_Final(md,&c);\n\tmemset(&c,0,sizeof(c));\n\treturn(md);\n\t}', 'int MD2_Init(MD2_CTX *c)\n\t{\n\tc->num=0;\n\tmemset(c->state,0,MD2_BLOCK*sizeof(MD2_INT));\n\tmemset(c->cksm,0,MD2_BLOCK*sizeof(MD2_INT));\n\tmemset(c->data,0,MD2_BLOCK);\n\treturn 1;\n\t}', 'int MD2_Update(MD2_CTX *c, const unsigned char *data, unsigned long len)\n\t{\n\tregister UCHAR *p;\n\tif (len == 0) return 1;\n\tp=c->data;\n\tif (c->num != 0)\n\t\t{\n\t\tif ((c->num+len) >= MD2_BLOCK)\n\t\t\t{\n\t\t\tmemcpy(&(p[c->num]),data,MD2_BLOCK-c->num);\n\t\t\tmd2_block(c,c->data);\n\t\t\tdata+=(MD2_BLOCK - c->num);\n\t\t\tlen-=(MD2_BLOCK - c->num);\n\t\t\tc->num=0;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tmemcpy(&(p[c->num]),data,(int)len);\n\t\t\tc->num+=(int)len;\n\t\t\treturn 1;\n\t\t\t}\n\t\t}\n\twhile (len >= MD2_BLOCK)\n\t\t{\n\t\tmd2_block(c,data);\n\t\tdata+=MD2_BLOCK;\n\t\tlen-=MD2_BLOCK;\n\t\t}\n\tmemcpy(p,data,(int)len);\n\tc->num=(int)len;\n\treturn 1;\n\t}']