providers/common/ciphers/cipher_ccm.c:304: error: BUFFER_OVERRUN_L3
  Offset added: 8 Size: [0, +oo].
Showing all 3 steps of the trace


providers/common/ciphers/cipher_ccm.c:291:1: <Length trace>
289.   }
290.   
291. > static int ccm_tls_cipher(PROV_CCM_CTX *ctx,
292.                             unsigned char *out, size_t *padlen,
293.                             const unsigned char *in, size_t len)

providers/common/ciphers/cipher_ccm.c:291:1: Parameter `ctx->buf[*]`
289.   }
290.   
291. > static int ccm_tls_cipher(PROV_CCM_CTX *ctx,
292.                             unsigned char *out, size_t *padlen,
293.                             const unsigned char *in, size_t len)

providers/common/ciphers/cipher_ccm.c:304:9: Array access: Offset added: 8 Size: [0, +oo]
302.       /* If encrypting set explicit IV from sequence number (start of AAD) */
303.       if (ctx->enc)
304.           memcpy(out, ctx->buf, EVP_CCM_TLS_EXPLICIT_IV_LEN);
               ^
305.       /* Get rest of IV from explicit IV */
306.       memcpy(ctx->iv + EVP_CCM_TLS_FIXED_IV_LEN, in, EVP_CCM_TLS_EXPLICIT_IV_LEN);

static int ccm_tls_cipher(PROV_CCM_CTX *ctx,
                          unsigned char *out, size_t *padlen,
                          const unsigned char *in, size_t len)
{
    int rv = 0;
    size_t olen = 0;
    if (out != in || len < (EVP_CCM_TLS_EXPLICIT_IV_LEN + (size_t)ctx->m))
        goto err;
    if (ctx->enc)
        memcpy(out, ctx->buf, EVP_CCM_TLS_EXPLICIT_IV_LEN);
    memcpy(ctx->iv + EVP_CCM_TLS_FIXED_IV_LEN, in, EVP_CCM_TLS_EXPLICIT_IV_LEN);
    len -= EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m;
    if (!ccm_set_iv(ctx, len))
        goto err;
    if (!ctx->hw->setaad(ctx, ctx->buf, ctx->tls_aad_len))
        goto err;
    in += EVP_CCM_TLS_EXPLICIT_IV_LEN;
    out += EVP_CCM_TLS_EXPLICIT_IV_LEN;
    if (ctx->enc) {
        if (!ctx->hw->auth_encrypt(ctx, in, out, len,  out + len, ctx->m))
            goto err;
        olen = len + EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m;
    } else {
        if (!ctx->hw->auth_decrypt(ctx, in, out, len,
                                   (unsigned char *)in + len, ctx->m))
            goto err;
        olen = len;
    }
    rv = 1;
err:
    *padlen = olen;
    return rv;
}
['static int ccm_tls_cipher(PROV_CCM_CTX *ctx,\n                          unsigned char *out, size_t *padlen,\n                          const unsigned char *in, size_t len)\n{\n    int rv = 0;\n    size_t olen = 0;\n    if (out != in || len < (EVP_CCM_TLS_EXPLICIT_IV_LEN + (size_t)ctx->m))\n        goto err;\n    if (ctx->enc)\n        memcpy(out, ctx->buf, EVP_CCM_TLS_EXPLICIT_IV_LEN);\n    memcpy(ctx->iv + EVP_CCM_TLS_FIXED_IV_LEN, in, EVP_CCM_TLS_EXPLICIT_IV_LEN);\n    len -= EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m;\n    if (!ccm_set_iv(ctx, len))\n        goto err;\n    if (!ctx->hw->setaad(ctx, ctx->buf, ctx->tls_aad_len))\n        goto err;\n    in += EVP_CCM_TLS_EXPLICIT_IV_LEN;\n    out += EVP_CCM_TLS_EXPLICIT_IV_LEN;\n    if (ctx->enc) {\n        if (!ctx->hw->auth_encrypt(ctx, in, out, len,  out + len, ctx->m))\n            goto err;\n        olen = len + EVP_CCM_TLS_EXPLICIT_IV_LEN + ctx->m;\n    } else {\n        if (!ctx->hw->auth_decrypt(ctx, in, out, len,\n                                   (unsigned char *)in + len, ctx->m))\n            goto err;\n        olen = len;\n    }\n    rv = 1;\nerr:\n    *padlen = olen;\n    return rv;\n}']