crypto/evp/e_aes.c:710: error: BUFFER_OVERRUN_L3
  Offset added: [2, 16] Size: [0, +oo] by call to `CRYPTO_ccm128_tag`.
Showing all 7 steps of the trace


crypto/evp/e_aes.c:662:1: Parameter `ctx->cipher_data->M`
660.   	}
661.   
662. > static int aes_ccm(EVP_CIPHER_CTX *ctx, unsigned char *out,
663.   		const unsigned char *in, size_t len)
664.   	{

crypto/evp/e_aes.c:710:8: Call
708.   			{
709.   			unsigned char tag[16];
710.   			if (CRYPTO_ccm128_tag(ccm, tag, cctx->M))
              ^
711.   				{
712.   				if (!memcmp(tag, ctx->buf, cctx->M))

crypto/modes/ccm128.c:305:1: <Offset trace>
303.   }
304.   
305. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx,unsigned char *tag,size_t len)
306.   {	unsigned int M = (ctx->nonce.c[0]>>3)&7;	/* the M parameter */
307.   

crypto/modes/ccm128.c:305:1: Parameter `len`
  303.   }
  304.   
  305. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx,unsigned char *tag,size_t len)
  306.   {	unsigned int M = (ctx->nonce.c[0]>>3)&7;	/* the M parameter */
  307.   

crypto/modes/ccm128.c:305:1: <Length trace>
303.   }
304.   
305. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx,unsigned char *tag,size_t len)
306.   {	unsigned int M = (ctx->nonce.c[0]>>3)&7;	/* the M parameter */
307.   

crypto/modes/ccm128.c:305:1: Parameter `ctx->cmac.c[*]`
  303.   }
  304.   
  305. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx,unsigned char *tag,size_t len)
  306.   {	unsigned int M = (ctx->nonce.c[0]>>3)&7;	/* the M parameter */
  307.   

crypto/modes/ccm128.c:310:2: Array access: Offset added: [2, 16] Size: [0, +oo] by call to `CRYPTO_ccm128_tag` 
  308.   	M *= 2; M += 2;
  309.   	if (len<M)	return 0;
  310.   	memcpy(tag,ctx->cmac.c,M);
          ^
  311.   	return M;
  312.   }

size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx,unsigned char *tag,size_t len)
{	unsigned int M = (ctx->nonce.c[0]>>3)&7;
	M *= 2; M += 2;
	if (len<M)	return 0;
	memcpy(tag,ctx->cmac.c,M);
	return M;
}
['static int aes_ccm(EVP_CIPHER_CTX *ctx, unsigned char *out,\n\t\tconst unsigned char *in, size_t len)\n\t{\n\tEVP_AES_CCM_CTX *cctx = ctx->cipher_data;\n\tCCM128_CONTEXT *ccm = &cctx->ccm;\n\tif (!cctx->iv_set && !cctx->key_set)\n\t\treturn -1;\n\tif (!ctx->encrypt && !cctx->tag_set)\n\t\treturn -1;\n\tif (!out)\n\t\t{\n\t\tif (!in)\n\t\t\t{\n\t\t\tif (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L,len))\n\t\t\t\treturn -1;\n\t\t\tcctx->len_set = 1;\n\t\t\treturn len;\n\t\t\t}\n\t\tif (!cctx->len_set && len)\n\t\t\treturn -1;\n\t\tCRYPTO_ccm128_aad(ccm, in, len);\n\t\treturn len;\n\t\t}\n\tif (!in)\n\t\treturn 0;\n\tif (!cctx->len_set)\n\t\t{\n\t\tif (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L, len))\n\t\t\treturn -1;\n\t\tcctx->len_set = 1;\n\t\t}\n\tif (ctx->encrypt)\n\t\t{\n\t\tif (CRYPTO_ccm128_encrypt(ccm, in, out, len))\n\t\t\treturn -1;\n\t\tcctx->tag_set = 1;\n\t\treturn len;\n\t\t}\n\telse\n\t\t{\n\t\tint rv = -1;\n\t\tif (!CRYPTO_ccm128_decrypt(ccm, in, out, len))\n\t\t\t{\n\t\t\tunsigned char tag[16];\n\t\t\tif (CRYPTO_ccm128_tag(ccm, tag, cctx->M))\n\t\t\t\t{\n\t\t\t\tif (!memcmp(tag, ctx->buf, cctx->M))\n\t\t\t\t\trv = len;\n\t\t\t\t}\n\t\t\t}\n\t\tif (rv == -1)\n\t\t\tOPENSSL_cleanse(out, len);\n\t\tcctx->iv_set = 0;\n\t\tcctx->tag_set = 0;\n\t\tcctx->len_set = 0;\n\t\treturn rv;\n\t\t}\n\t}', 'size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx,unsigned char *tag,size_t len)\n{\tunsigned int M = (ctx->nonce.c[0]>>3)&7;\n\tM *= 2; M += 2;\n\tif (len<M)\treturn 0;\n\tmemcpy(tag,ctx->cmac.c,M);\n\treturn M;\n}']