crypto/evp/e_aes.c:1029: error: BUFFER_OVERRUN_L3
  Offset added: [2, 16] Size: [0, +oo] by call to `CRYPTO_ccm128_tag`.
Showing all 7 steps of the trace


crypto/evp/e_aes.c:991:1: Parameter `arg`
989.   BLOCK_CIPHER_custom(NID_aes,256,1,16,xts,XTS,EVP_CIPH_FLAG_FIPS|CUSTOM_FLAGS)
990.   
991. > static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
992.   	{
993.   	EVP_AES_CCM_CTX *cctx = c->cipher_data;

crypto/evp/e_aes.c:1029:7: Call
1027.   		if (!c->encrypt || !cctx->tag_set)
1028.   			return 0;
1029.   		if(!CRYPTO_ccm128_tag(&cctx->ccm, ptr, (size_t)arg))
              ^
1030.   			return 0;
1031.   		cctx->tag_set = 0;

crypto/modes/ccm128.c:434:1: <Offset trace>
432.   }
433.   
434. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx,unsigned char *tag,size_t len)
435.   {	unsigned int M = (ctx->nonce.c[0]>>3)&7;	/* the M parameter */
436.   

crypto/modes/ccm128.c:434:1: Parameter `len`
  432.   }
  433.   
  434. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx,unsigned char *tag,size_t len)
  435.   {	unsigned int M = (ctx->nonce.c[0]>>3)&7;	/* the M parameter */
  436.   

crypto/modes/ccm128.c:434:1: <Length trace>
432.   }
433.   
434. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx,unsigned char *tag,size_t len)
435.   {	unsigned int M = (ctx->nonce.c[0]>>3)&7;	/* the M parameter */
436.   

crypto/modes/ccm128.c:434:1: Parameter `ctx->cmac.c[*]`
  432.   }
  433.   
  434. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx,unsigned char *tag,size_t len)
  435.   {	unsigned int M = (ctx->nonce.c[0]>>3)&7;	/* the M parameter */
  436.   

crypto/modes/ccm128.c:439:2: Array access: Offset added: [2, 16] Size: [0, +oo] by call to `CRYPTO_ccm128_tag` 
  437.   	M *= 2; M += 2;
  438.   	if (len<M)	return 0;
  439.   	memcpy(tag,ctx->cmac.c,M);
          ^
  440.   	return M;
  441.   }

size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx,unsigned char *tag,size_t len)
{	unsigned int M = (ctx->nonce.c[0]>>3)&7;
	M *= 2; M += 2;
	if (len<M)	return 0;
	memcpy(tag,ctx->cmac.c,M);
	return M;
}
['static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)\n\t{\n\tEVP_AES_CCM_CTX *cctx = c->cipher_data;\n\tswitch (type)\n\t\t{\n\tcase EVP_CTRL_INIT:\n\t\tcctx->key_set = 0;\n\t\tcctx->iv_set = 0;\n\t\tcctx->L = 8;\n\t\tcctx->M = 12;\n\t\tcctx->tag_set = 0;\n\t\tcctx->len_set = 0;\n\t\treturn 1;\n\tcase EVP_CTRL_CCM_SET_IVLEN:\n\t\targ = 15 - arg;\n\tcase EVP_CTRL_CCM_SET_L:\n\t\tif (arg < 2 || arg > 8)\n\t\t\treturn 0;\n\t\tcctx->L = arg;\n\t\treturn 1;\n\tcase EVP_CTRL_CCM_SET_TAG:\n\t\tif ((arg & 1) || arg < 4 || arg > 16)\n\t\t\treturn 0;\n\t\tif ((c->encrypt && ptr) || (!c->encrypt && !ptr))\n\t\t\treturn 0;\n\t\tif (ptr)\n\t\t\t{\n\t\t\tcctx->tag_set = 1;\n\t\t\tmemcpy(c->buf, ptr, arg);\n\t\t\t}\n\t\tcctx->M = arg;\n\t\treturn 1;\n\tcase EVP_CTRL_CCM_GET_TAG:\n\t\tif (!c->encrypt || !cctx->tag_set)\n\t\t\treturn 0;\n\t\tif(!CRYPTO_ccm128_tag(&cctx->ccm, ptr, (size_t)arg))\n\t\t\treturn 0;\n\t\tcctx->tag_set = 0;\n\t\tcctx->iv_set = 0;\n\t\tcctx->len_set = 0;\n\t\treturn 1;\n\tdefault:\n\t\treturn -1;\n\t\t}\n\t}', 'size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx,unsigned char *tag,size_t len)\n{\tunsigned int M = (ctx->nonce.c[0]>>3)&7;\n\tM *= 2; M += 2;\n\tif (len<M)\treturn 0;\n\tmemcpy(tag,ctx->cmac.c,M);\n\treturn M;\n}']