crypto/evp/e_chacha20_poly1305.c:304: error: BUFFER_OVERRUN_L2
  Offset: [1, 57] Size: 16 by call to `Poly1305_Final`.
Showing all 12 steps of the trace


crypto/evp/e_chacha20_poly1305.c:219:9: Call
217.           ChaCha20_ctr32(buf, zero, 2 * CHACHA_BLK_SIZE, actx->key.key.d,
218.                          actx->key.counter);
219.           Poly1305_Init(POLY1305_ctx(actx), buf);
               ^
220.           actx->key.partial_len = 0;
221.           memcpy(tohash, actx->tls_aad, POLY1305_BLOCK_SIZE);

crypto/poly1305/poly1305.c:457:5: Assignment
  455.   #endif
  456.   
  457.       ctx->num = 0;
             ^
  458.   
  459.   }

crypto/evp/e_chacha20_poly1305.c:302:5: Call
300.       }
301.   
302.       Poly1305_Update(POLY1305_ctx(actx), tohash, tohash_len);
           ^
303.       OPENSSL_cleanse(buf, 2 * CHACHA_BLK_SIZE);
304.       Poly1305_Final(POLY1305_ctx(actx), ctx->encrypt ? actx->tag

crypto/poly1305/poly1305.c:470:1: Parameter `len`
  468.   #endif
  469.   
  470. > void Poly1305_Update(POLY1305 *ctx, const unsigned char *inp, size_t len)
  471.   {
  472.   #ifdef POLY1305_ASM

crypto/poly1305/poly1305.c:493:13: Assignment
  491.               /* Still not enough data to process a block. */
  492.               memcpy(ctx->data + num, inp, len);
  493.               ctx->num = num + len;
                     ^
  494.               return;
  495.           }

crypto/evp/e_chacha20_poly1305.c:304:5: Call
302.       Poly1305_Update(POLY1305_ctx(actx), tohash, tohash_len);
303.       OPENSSL_cleanse(buf, 2 * CHACHA_BLK_SIZE);
304.       Poly1305_Final(POLY1305_ctx(actx), ctx->encrypt ? actx->tag
           ^
305.                                                       : tohash);
306.   

crypto/poly1305/poly1305.c:512:1: <Offset trace>
510.   }
511.   
512. > void Poly1305_Final(POLY1305 *ctx, unsigned char mac[16])
513.   {
514.   #ifdef POLY1305_ASM

crypto/poly1305/poly1305.c:512:1: Parameter `ctx->num`
  510.   }
  511.   
  512. > void Poly1305_Final(POLY1305 *ctx, unsigned char mac[16])
  513.   {
  514.   #ifdef POLY1305_ASM

crypto/poly1305/poly1305.c:520:10: Assignment
  518.       size_t num;
  519.   
  520.       if ((num = ctx->num)) {
                  ^
  521.           ctx->data[num++] = 1;   /* pad bit */
  522.           while (num < POLY1305_BLOCK_SIZE)

crypto/poly1305/poly1305.c:512:1: <Length trace>
510.   }
511.   
512. > void Poly1305_Final(POLY1305 *ctx, unsigned char mac[16])
513.   {
514.   #ifdef POLY1305_ASM

crypto/poly1305/poly1305.c:512:1: Parameter `ctx->data[*]`
  510.   }
  511.   
  512. > void Poly1305_Final(POLY1305 *ctx, unsigned char mac[16])
  513.   {
  514.   #ifdef POLY1305_ASM

crypto/poly1305/poly1305.c:521:9: Array access: Offset: [1, 57] Size: 16 by call to `Poly1305_Final` 
  519.   
  520.       if ((num = ctx->num)) {
  521.           ctx->data[num++] = 1;   /* pad bit */
                 ^
  522.           while (num < POLY1305_BLOCK_SIZE)
  523.               ctx->data[num++] = 0;

void Poly1305_Final(POLY1305 *ctx, unsigned char mac[16])
{
#ifdef POLY1305_ASM
    poly1305_blocks_f poly1305_blocks_p = ctx->func.blocks;
    poly1305_emit_f poly1305_emit_p = ctx->func.emit;
#endif
    size_t num;
    if ((num = ctx->num)) {
        ctx->data[num++] = 1;
        while (num < POLY1305_BLOCK_SIZE)
            ctx->data[num++] = 0;
        poly1305_blocks(ctx->opaque, ctx->data, POLY1305_BLOCK_SIZE, 0);
    }
    poly1305_emit(ctx->opaque, mac, ctx->nonce);
    OPENSSL_cleanse(ctx, sizeof(*ctx));
}
['static int chacha20_poly1305_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,\n                                        const unsigned char *in, size_t len)\n{\n    EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);\n    size_t i, tail, tohash_len, plen = actx->tls_payload_length;\n    unsigned char *buf, *tohash, *ctr, storage[2 * CHACHA_BLK_SIZE + 32];\n    if (len != plen + POLY1305_BLOCK_SIZE)\n        return -1;\n    buf = storage + ((0 - (size_t)storage) & 15);\n    ctr = buf + CHACHA_BLK_SIZE;\n    tohash = buf + CHACHA_BLK_SIZE - POLY1305_BLOCK_SIZE;\n    if (plen <= CHACHA_BLK_SIZE) {\n        actx->key.counter[0] = 0;\n        ChaCha20_ctr32(buf, zero, 2 * CHACHA_BLK_SIZE, actx->key.key.d,\n                       actx->key.counter);\n        Poly1305_Init(POLY1305_ctx(actx), buf);\n        actx->key.partial_len = 0;\n        memcpy(tohash, actx->tls_aad, POLY1305_BLOCK_SIZE);\n        tohash_len = POLY1305_BLOCK_SIZE;\n        actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;\n        actx->len.text = plen;\n        if (ctx->encrypt) {\n            for (i = 0; i < plen; i++) {\n                out[i] = ctr[i] ^= in[i];\n            }\n        } else {\n            for (i = 0; i < plen; i++) {\n                unsigned char c = in[i];\n                out[i] = ctr[i] ^ c;\n                ctr[i] = c;\n            }\n        }\n        in += i;\n        out += i;\n        tail = (0 - i) & (POLY1305_BLOCK_SIZE - 1);\n        memset(ctr + i, 0, tail);\n        ctr += i + tail;\n        tohash_len += i + tail;\n    } else {\n        actx->key.counter[0] = 0;\n        ChaCha20_ctr32(buf, zero, CHACHA_BLK_SIZE, actx->key.key.d,\n                       actx->key.counter);\n        Poly1305_Init(POLY1305_ctx(actx), buf);\n        actx->key.counter[0] = 1;\n        actx->key.partial_len = 0;\n        Poly1305_Update(POLY1305_ctx(actx), actx->tls_aad, POLY1305_BLOCK_SIZE);\n        tohash = ctr;\n        tohash_len = 0;\n        actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;\n        actx->len.text = plen;\n        if (ctx->encrypt) {\n            ChaCha20_ctr32(out, in, plen, actx->key.key.d, actx->key.counter);\n            Poly1305_Update(POLY1305_ctx(actx), out, plen);\n        } else {\n            Poly1305_Update(POLY1305_ctx(actx), in, plen);\n            ChaCha20_ctr32(out, in, plen, actx->key.key.d, actx->key.counter);\n        }\n        in += plen;\n        out += plen;\n        tail = (0 - plen) & (POLY1305_BLOCK_SIZE - 1);\n        Poly1305_Update(POLY1305_ctx(actx), zero, tail);\n    }\n    {\n        const union {\n            long one;\n            char little;\n        } is_endian = { 1 };\n        if (is_endian.little) {\n            memcpy(ctr, (unsigned char *)&actx->len, POLY1305_BLOCK_SIZE);\n        } else {\n            ctr[0]  = (unsigned char)(actx->len.aad);\n            ctr[1]  = (unsigned char)(actx->len.aad>>8);\n            ctr[2]  = (unsigned char)(actx->len.aad>>16);\n            ctr[3]  = (unsigned char)(actx->len.aad>>24);\n            ctr[4]  = (unsigned char)(actx->len.aad>>32);\n            ctr[5]  = (unsigned char)(actx->len.aad>>40);\n            ctr[6]  = (unsigned char)(actx->len.aad>>48);\n            ctr[7]  = (unsigned char)(actx->len.aad>>56);\n            ctr[8]  = (unsigned char)(actx->len.text);\n            ctr[9]  = (unsigned char)(actx->len.text>>8);\n            ctr[10] = (unsigned char)(actx->len.text>>16);\n            ctr[11] = (unsigned char)(actx->len.text>>24);\n            ctr[12] = (unsigned char)(actx->len.text>>32);\n            ctr[13] = (unsigned char)(actx->len.text>>40);\n            ctr[14] = (unsigned char)(actx->len.text>>48);\n            ctr[15] = (unsigned char)(actx->len.text>>56);\n        }\n        tohash_len += POLY1305_BLOCK_SIZE;\n    }\n    Poly1305_Update(POLY1305_ctx(actx), tohash, tohash_len);\n    OPENSSL_cleanse(buf, 2 * CHACHA_BLK_SIZE);\n    Poly1305_Final(POLY1305_ctx(actx), ctx->encrypt ? actx->tag\n                                                    : tohash);\n    actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;\n    if (ctx->encrypt) {\n        memcpy(out, actx->tag, POLY1305_BLOCK_SIZE);\n    } else {\n        if (CRYPTO_memcmp(tohash, in, POLY1305_BLOCK_SIZE)) {\n            memset(out - (len - POLY1305_BLOCK_SIZE), 0,\n                   len - POLY1305_BLOCK_SIZE);\n            return -1;\n        }\n    }\n    return len;\n}', 'void Poly1305_Init(POLY1305 *ctx, const unsigned char key[32])\n{\n    ctx->nonce[0] = U8TOU32(&key[16]);\n    ctx->nonce[1] = U8TOU32(&key[20]);\n    ctx->nonce[2] = U8TOU32(&key[24]);\n    ctx->nonce[3] = U8TOU32(&key[28]);\n#ifndef POLY1305_ASM\n    poly1305_init(ctx->opaque, key);\n#else\n    if (!poly1305_init(ctx->opaque, key, &ctx->func)) {\n        ctx->func.blocks = poly1305_blocks;\n        ctx->func.emit = poly1305_emit;\n    }\n#endif\n    ctx->num = 0;\n}', 'void Poly1305_Update(POLY1305 *ctx, const unsigned char *inp, size_t len)\n{\n#ifdef POLY1305_ASM\n    poly1305_blocks_f poly1305_blocks_p = ctx->func.blocks;\n#endif\n    size_t rem, num;\n    if ((num = ctx->num)) {\n        rem = POLY1305_BLOCK_SIZE - num;\n        if (len >= rem) {\n            memcpy(ctx->data + num, inp, rem);\n            poly1305_blocks(ctx->opaque, ctx->data, POLY1305_BLOCK_SIZE, 1);\n            inp += rem;\n            len -= rem;\n        } else {\n            memcpy(ctx->data + num, inp, len);\n            ctx->num = num + len;\n            return;\n        }\n    }\n    rem = len % POLY1305_BLOCK_SIZE;\n    len -= rem;\n    if (len >= POLY1305_BLOCK_SIZE) {\n        poly1305_blocks(ctx->opaque, inp, len, 1);\n        inp += len;\n    }\n    if (rem)\n        memcpy(ctx->data, inp, rem);\n    ctx->num = rem;\n}', 'void Poly1305_Final(POLY1305 *ctx, unsigned char mac[16])\n{\n#ifdef POLY1305_ASM\n    poly1305_blocks_f poly1305_blocks_p = ctx->func.blocks;\n    poly1305_emit_f poly1305_emit_p = ctx->func.emit;\n#endif\n    size_t num;\n    if ((num = ctx->num)) {\n        ctx->data[num++] = 1;\n        while (num < POLY1305_BLOCK_SIZE)\n            ctx->data[num++] = 0;\n        poly1305_blocks(ctx->opaque, ctx->data, POLY1305_BLOCK_SIZE, 0);\n    }\n    poly1305_emit(ctx->opaque, mac, ctx->nonce);\n    OPENSSL_cleanse(ctx, sizeof(*ctx));\n}']