crypto/evp/e_chacha20_poly1305.c:241: error: INTEGER_OVERFLOW_L2
  (0 - [max(0, `ctx->cipher_data->tls_payload_length`), 64]):unsigned64.
Showing all 3 steps of the trace


crypto/evp/e_chacha20_poly1305.c:201:1: <RHS trace>
199.   static const unsigned char zero[2 * CHACHA_BLK_SIZE] = { 0 };
200.   
201. > static int chacha20_poly1305_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
202.                                           const unsigned char *in, size_t len)
203.   {

crypto/evp/e_chacha20_poly1305.c:201:1: Parameter `len`
199.   static const unsigned char zero[2 * CHACHA_BLK_SIZE] = { 0 };
200.   
201. > static int chacha20_poly1305_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
202.                                           const unsigned char *in, size_t len)
203.   {

crypto/evp/e_chacha20_poly1305.c:241:9: Binary operation: (0 - [max(0, ctx->cipher_data->tls_payload_length), 64]):unsigned64
239.           out += i;
240.   
241.           tail = (0 - i) & (POLY1305_BLOCK_SIZE - 1);
               ^
242.           memset(ctr + i, 0, tail);
243.           ctr += i + tail;

static int chacha20_poly1305_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
                                        const unsigned char *in, size_t len)
{
    EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);
    size_t i, tail, tohash_len, plen = actx->tls_payload_length;
    unsigned char *buf, *tohash, *ctr, storage[2 * CHACHA_BLK_SIZE + 32];
    if (len != plen + POLY1305_BLOCK_SIZE)
        return -1;
    buf = storage + ((0 - (size_t)storage) & 15);
    ctr = buf + CHACHA_BLK_SIZE;
    tohash = buf + CHACHA_BLK_SIZE - POLY1305_BLOCK_SIZE;
    if (plen <= CHACHA_BLK_SIZE) {
        actx->key.counter[0] = 0;
        ChaCha20_ctr32(buf, zero, 2 * CHACHA_BLK_SIZE, actx->key.key.d,
                       actx->key.counter);
        Poly1305_Init(POLY1305_ctx(actx), buf);
        actx->key.partial_len = 0;
        memcpy(tohash, actx->tls_aad, POLY1305_BLOCK_SIZE);
        tohash_len = POLY1305_BLOCK_SIZE;
        actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
        actx->len.text = plen;
        if (ctx->encrypt) {
            for (i = 0; i < plen; i++) {
                out[i] = ctr[i] ^= in[i];
            }
        } else {
            for (i = 0; i < plen; i++) {
                unsigned char c = in[i];
                out[i] = ctr[i] ^ c;
                ctr[i] = c;
            }
        }
        in += i;
        out += i;
        tail = (0 - i) & (POLY1305_BLOCK_SIZE - 1);
        memset(ctr + i, 0, tail);
        ctr += i + tail;
        tohash_len += i + tail;
    } else {
        actx->key.counter[0] = 0;
        ChaCha20_ctr32(buf, zero, CHACHA_BLK_SIZE, actx->key.key.d,
                       actx->key.counter);
        Poly1305_Init(POLY1305_ctx(actx), buf);
        actx->key.counter[0] = 1;
        actx->key.partial_len = 0;
        Poly1305_Update(POLY1305_ctx(actx), actx->tls_aad, POLY1305_BLOCK_SIZE);
        tohash = ctr;
        tohash_len = 0;
        actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;
        actx->len.text = plen;
        if (ctx->encrypt) {
            ChaCha20_ctr32(out, in, plen, actx->key.key.d, actx->key.counter);
            Poly1305_Update(POLY1305_ctx(actx), out, plen);
        } else {
            Poly1305_Update(POLY1305_ctx(actx), in, plen);
            ChaCha20_ctr32(out, in, plen, actx->key.key.d, actx->key.counter);
        }
        in += plen;
        out += plen;
        tail = (0 - plen) & (POLY1305_BLOCK_SIZE - 1);
        Poly1305_Update(POLY1305_ctx(actx), zero, tail);
    }
    {
        const union {
            long one;
            char little;
        } is_endian = { 1 };
        if (is_endian.little) {
            memcpy(ctr, (unsigned char *)&actx->len, POLY1305_BLOCK_SIZE);
        } else {
            ctr[0]  = (unsigned char)(actx->len.aad);
            ctr[1]  = (unsigned char)(actx->len.aad>>8);
            ctr[2]  = (unsigned char)(actx->len.aad>>16);
            ctr[3]  = (unsigned char)(actx->len.aad>>24);
            ctr[4]  = (unsigned char)(actx->len.aad>>32);
            ctr[5]  = (unsigned char)(actx->len.aad>>40);
            ctr[6]  = (unsigned char)(actx->len.aad>>48);
            ctr[7]  = (unsigned char)(actx->len.aad>>56);
            ctr[8]  = (unsigned char)(actx->len.text);
            ctr[9]  = (unsigned char)(actx->len.text>>8);
            ctr[10] = (unsigned char)(actx->len.text>>16);
            ctr[11] = (unsigned char)(actx->len.text>>24);
            ctr[12] = (unsigned char)(actx->len.text>>32);
            ctr[13] = (unsigned char)(actx->len.text>>40);
            ctr[14] = (unsigned char)(actx->len.text>>48);
            ctr[15] = (unsigned char)(actx->len.text>>56);
        }
        tohash_len += POLY1305_BLOCK_SIZE;
    }
    Poly1305_Update(POLY1305_ctx(actx), tohash, tohash_len);
    OPENSSL_cleanse(buf, 2 * CHACHA_BLK_SIZE);
    Poly1305_Final(POLY1305_ctx(actx), ctx->encrypt ? actx->tag
                                                    : tohash);
    actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;
    if (ctx->encrypt) {
        memcpy(out, actx->tag, POLY1305_BLOCK_SIZE);
    } else {
        if (CRYPTO_memcmp(tohash, in, POLY1305_BLOCK_SIZE)) {
            memset(out - (len - POLY1305_BLOCK_SIZE), 0,
                   len - POLY1305_BLOCK_SIZE);
            return -1;
        }
    }
    return len;
}
['static int chacha20_poly1305_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,\n                                        const unsigned char *in, size_t len)\n{\n    EVP_CHACHA_AEAD_CTX *actx = aead_data(ctx);\n    size_t i, tail, tohash_len, plen = actx->tls_payload_length;\n    unsigned char *buf, *tohash, *ctr, storage[2 * CHACHA_BLK_SIZE + 32];\n    if (len != plen + POLY1305_BLOCK_SIZE)\n        return -1;\n    buf = storage + ((0 - (size_t)storage) & 15);\n    ctr = buf + CHACHA_BLK_SIZE;\n    tohash = buf + CHACHA_BLK_SIZE - POLY1305_BLOCK_SIZE;\n    if (plen <= CHACHA_BLK_SIZE) {\n        actx->key.counter[0] = 0;\n        ChaCha20_ctr32(buf, zero, 2 * CHACHA_BLK_SIZE, actx->key.key.d,\n                       actx->key.counter);\n        Poly1305_Init(POLY1305_ctx(actx), buf);\n        actx->key.partial_len = 0;\n        memcpy(tohash, actx->tls_aad, POLY1305_BLOCK_SIZE);\n        tohash_len = POLY1305_BLOCK_SIZE;\n        actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;\n        actx->len.text = plen;\n        if (ctx->encrypt) {\n            for (i = 0; i < plen; i++) {\n                out[i] = ctr[i] ^= in[i];\n            }\n        } else {\n            for (i = 0; i < plen; i++) {\n                unsigned char c = in[i];\n                out[i] = ctr[i] ^ c;\n                ctr[i] = c;\n            }\n        }\n        in += i;\n        out += i;\n        tail = (0 - i) & (POLY1305_BLOCK_SIZE - 1);\n        memset(ctr + i, 0, tail);\n        ctr += i + tail;\n        tohash_len += i + tail;\n    } else {\n        actx->key.counter[0] = 0;\n        ChaCha20_ctr32(buf, zero, CHACHA_BLK_SIZE, actx->key.key.d,\n                       actx->key.counter);\n        Poly1305_Init(POLY1305_ctx(actx), buf);\n        actx->key.counter[0] = 1;\n        actx->key.partial_len = 0;\n        Poly1305_Update(POLY1305_ctx(actx), actx->tls_aad, POLY1305_BLOCK_SIZE);\n        tohash = ctr;\n        tohash_len = 0;\n        actx->len.aad = EVP_AEAD_TLS1_AAD_LEN;\n        actx->len.text = plen;\n        if (ctx->encrypt) {\n            ChaCha20_ctr32(out, in, plen, actx->key.key.d, actx->key.counter);\n            Poly1305_Update(POLY1305_ctx(actx), out, plen);\n        } else {\n            Poly1305_Update(POLY1305_ctx(actx), in, plen);\n            ChaCha20_ctr32(out, in, plen, actx->key.key.d, actx->key.counter);\n        }\n        in += plen;\n        out += plen;\n        tail = (0 - plen) & (POLY1305_BLOCK_SIZE - 1);\n        Poly1305_Update(POLY1305_ctx(actx), zero, tail);\n    }\n    {\n        const union {\n            long one;\n            char little;\n        } is_endian = { 1 };\n        if (is_endian.little) {\n            memcpy(ctr, (unsigned char *)&actx->len, POLY1305_BLOCK_SIZE);\n        } else {\n            ctr[0]  = (unsigned char)(actx->len.aad);\n            ctr[1]  = (unsigned char)(actx->len.aad>>8);\n            ctr[2]  = (unsigned char)(actx->len.aad>>16);\n            ctr[3]  = (unsigned char)(actx->len.aad>>24);\n            ctr[4]  = (unsigned char)(actx->len.aad>>32);\n            ctr[5]  = (unsigned char)(actx->len.aad>>40);\n            ctr[6]  = (unsigned char)(actx->len.aad>>48);\n            ctr[7]  = (unsigned char)(actx->len.aad>>56);\n            ctr[8]  = (unsigned char)(actx->len.text);\n            ctr[9]  = (unsigned char)(actx->len.text>>8);\n            ctr[10] = (unsigned char)(actx->len.text>>16);\n            ctr[11] = (unsigned char)(actx->len.text>>24);\n            ctr[12] = (unsigned char)(actx->len.text>>32);\n            ctr[13] = (unsigned char)(actx->len.text>>40);\n            ctr[14] = (unsigned char)(actx->len.text>>48);\n            ctr[15] = (unsigned char)(actx->len.text>>56);\n        }\n        tohash_len += POLY1305_BLOCK_SIZE;\n    }\n    Poly1305_Update(POLY1305_ctx(actx), tohash, tohash_len);\n    OPENSSL_cleanse(buf, 2 * CHACHA_BLK_SIZE);\n    Poly1305_Final(POLY1305_ctx(actx), ctx->encrypt ? actx->tag\n                                                    : tohash);\n    actx->tls_payload_length = NO_TLS_PAYLOAD_LENGTH;\n    if (ctx->encrypt) {\n        memcpy(out, actx->tag, POLY1305_BLOCK_SIZE);\n    } else {\n        if (CRYPTO_memcmp(tohash, in, POLY1305_BLOCK_SIZE)) {\n            memset(out - (len - POLY1305_BLOCK_SIZE), 0,\n                   len - POLY1305_BLOCK_SIZE);\n            return -1;\n        }\n    }\n    return len;\n}']