crypto/rand/drbg_hash.c:134: error: INTEGER_OVERFLOW_L2
  ([0, max(255, `*dst`)] + 1):unsigned8.
Showing all 3 steps of the trace


crypto/rand/drbg_hash.c:112:1: <LHS trace>
110.    * where dst size is drbg->seedlen, and inlen <= drbg->seedlen.
111.    */
112. > static int add_bytes(RAND_DRBG *drbg, unsigned char *dst,
113.                        unsigned char *in, size_t inlen)
114.   {

crypto/rand/drbg_hash.c:112:1: Parameter `*dst`
110.    * where dst size is drbg->seedlen, and inlen <= drbg->seedlen.
111.    */
112. > static int add_bytes(RAND_DRBG *drbg, unsigned char *dst,
113.                        unsigned char *in, size_t inlen)
114.   {

crypto/rand/drbg_hash.c:134:13: Binary operation: ([0, max(255, *dst)] + 1):unsigned8
132.           /* Add the carry to the top of the dst if inlen is not the same size */
133.           for (i = drbg->seedlen - inlen; i > 0; --i, d--) {
134.               *d += 1;     /* Carry can only be 1 */
                   ^
135.               if (*d != 0) /* exit if carry doesnt propagate to the next byte */
136.                   break;

static int add_bytes(RAND_DRBG *drbg, unsigned char *dst,
                     unsigned char *in, size_t inlen)
{
    size_t i;
    int result;
    const unsigned char *add;
    unsigned char carry = 0, *d;
    assert(drbg->seedlen >= 1 && inlen >= 1 && inlen <= drbg->seedlen);
    d = &dst[drbg->seedlen - 1];
    add = &in[inlen - 1];
    for (i = inlen; i > 0; i--, d--, add--) {
        result = *d + *add + carry;
        carry = (unsigned char)(result >> 8);
        *d = (unsigned char)(result & 0xff);
    }
    if (carry != 0) {
        for (i = drbg->seedlen - inlen; i > 0; --i, d--) {
            *d += 1;
            if (*d != 0)
                break;
        }
    }
    return 1;
}
['static int add_bytes(RAND_DRBG *drbg, unsigned char *dst,\n                     unsigned char *in, size_t inlen)\n{\n    size_t i;\n    int result;\n    const unsigned char *add;\n    unsigned char carry = 0, *d;\n    assert(drbg->seedlen >= 1 && inlen >= 1 && inlen <= drbg->seedlen);\n    d = &dst[drbg->seedlen - 1];\n    add = &in[inlen - 1];\n    for (i = inlen; i > 0; i--, d--, add--) {\n        result = *d + *add + carry;\n        carry = (unsigned char)(result >> 8);\n        *d = (unsigned char)(result & 0xff);\n    }\n    if (carry != 0) {\n        for (i = drbg->seedlen - inlen; i > 0; --i, d--) {\n            *d += 1;\n            if (*d != 0)\n                break;\n        }\n    }\n    return 1;\n}']