crypto/evp/e_aes.c:1572: error: INTEGER_OVERFLOW_L2
  ([0, 3071] - [1, 3071]):unsigned64 by call to `CRYPTO_gcm128_encrypt_ctr32`.
Showing all 9 steps of the trace


crypto/evp/e_aes.c:1532:1: Parameter `len`
1530.    */
1531.   
1532. > static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
1533.                                 const unsigned char *in, size_t len)
1534.   {

crypto/evp/e_aes.c:1556:5: Assignment
1554.       in += EVP_GCM_TLS_EXPLICIT_IV_LEN;
1555.       out += EVP_GCM_TLS_EXPLICIT_IV_LEN;
1556.       len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
            ^
1557.       if (EVP_CIPHER_CTX_encrypting(ctx)) {
1558.           /* Encrypt payload */

crypto/evp/e_aes.c:1572:17: Call
1570.               }
1571.   #endif
1572.               if (CRYPTO_gcm128_encrypt_ctr32(&gctx->gcm,
                        ^
1573.                                               in + bulk,
1574.                                               out + bulk,

crypto/modes/gcm128.c:1387:1: <LHS trace>
1385.   }
1386.   
1387. > int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
1388.                                   const unsigned char *in, unsigned char *out,
1389.                                   size_t len, ctr128_f stream)

crypto/modes/gcm128.c:1387:1: Parameter `len`
  1385.   }
  1386.   
  1387. > int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
  1388.                                   const unsigned char *in, unsigned char *out,
  1389.                                   size_t len, ctr128_f stream)

crypto/modes/gcm128.c:1387:1: <RHS trace>
1385.   }
1386.   
1387. > int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
1388.                                   const unsigned char *in, unsigned char *out,
1389.                                   size_t len, ctr128_f stream)

crypto/modes/gcm128.c:1387:1: Parameter `len`
  1385.   }
  1386.   
  1387. > int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
  1388.                                   const unsigned char *in, unsigned char *out,
  1389.                                   size_t len, ctr128_f stream)

crypto/modes/gcm128.c:1462:10: Assignment
  1460.       }
  1461.   # endif
  1462.       if ((i = (len & (size_t)-16))) {
                   ^
  1463.           size_t j = i / 16;
  1464.   

crypto/modes/gcm128.c:1476:9: Binary operation: ([0, 3071] - [1, 3071]):unsigned64 by call to `CRYPTO_gcm128_encrypt_ctr32` 
  1474.               ctx->Yi.d[3] = ctr;
  1475.           in += i;
  1476.           len -= i;
                  ^
  1477.   # if defined(GHASH)
  1478.           GHASH(ctx, out, i);

int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
                                const unsigned char *in, unsigned char *out,
                                size_t len, ctr128_f stream)
{
#if defined(OPENSSL_SMALL_FOOTPRINT)
    return CRYPTO_gcm128_encrypt(ctx, in, out, len);
#else
    const union {
        long one;
        char little;
    } is_endian = { 1 };
    unsigned int n, ctr;
    size_t i;
    u64 mlen = ctx->len.u[1];
    void *key = ctx->key;
# ifdef GCM_FUNCREF_4BIT
    void (*gcm_gmult_p) (u64 Xi[2], const u128 Htable[16]) = ctx->gmult;
#  ifdef GHASH
    void (*gcm_ghash_p) (u64 Xi[2], const u128 Htable[16],
                         const u8 *inp, size_t len) = ctx->ghash;
#  endif
# endif
    mlen += len;
    if (mlen > ((U64(1) << 36) - 32) || (sizeof(len) == 8 && mlen < len))
        return -1;
    ctx->len.u[1] = mlen;
    if (ctx->ares) {
        GCM_MUL(ctx, Xi);
        ctx->ares = 0;
    }
    if (is_endian.little)
# ifdef BSWAP4
        ctr = BSWAP4(ctx->Yi.d[3]);
# else
        ctr = GETU32(ctx->Yi.c + 12);
# endif
    else
        ctr = ctx->Yi.d[3];
    n = ctx->mres;
    if (n) {
        while (n && len) {
            ctx->Xi.c[n] ^= *(out++) = *(in++) ^ ctx->EKi.c[n];
            --len;
            n = (n + 1) % 16;
        }
        if (n == 0)
            GCM_MUL(ctx, Xi);
        else {
            ctx->mres = n;
            return 0;
        }
    }
# if defined(GHASH) && defined(GHASH_CHUNK)
    while (len >= GHASH_CHUNK) {
        (*stream) (in, out, GHASH_CHUNK / 16, key, ctx->Yi.c);
        ctr += GHASH_CHUNK / 16;
        if (is_endian.little)
#  ifdef BSWAP4
            ctx->Yi.d[3] = BSWAP4(ctr);
#  else
            PUTU32(ctx->Yi.c + 12, ctr);
#  endif
        else
            ctx->Yi.d[3] = ctr;
        GHASH(ctx, out, GHASH_CHUNK);
        out += GHASH_CHUNK;
        in += GHASH_CHUNK;
        len -= GHASH_CHUNK;
    }
# endif
    if ((i = (len & (size_t)-16))) {
        size_t j = i / 16;
        (*stream) (in, out, j, key, ctx->Yi.c);
        ctr += (unsigned int)j;
        if (is_endian.little)
# ifdef BSWAP4
            ctx->Yi.d[3] = BSWAP4(ctr);
# else
            PUTU32(ctx->Yi.c + 12, ctr);
# endif
        else
            ctx->Yi.d[3] = ctr;
        in += i;
        len -= i;
# if defined(GHASH)
        GHASH(ctx, out, i);
        out += i;
# else
        while (j--) {
            for (i = 0; i < 16; ++i)
                ctx->Xi.c[i] ^= out[i];
            GCM_MUL(ctx, Xi);
            out += 16;
        }
# endif
    }
    if (len) {
        (*ctx->block) (ctx->Yi.c, ctx->EKi.c, key);
        ++ctr;
        if (is_endian.little)
# ifdef BSWAP4
            ctx->Yi.d[3] = BSWAP4(ctr);
# else
            PUTU32(ctx->Yi.c + 12, ctr);
# endif
        else
            ctx->Yi.d[3] = ctr;
        while (len--) {
            ctx->Xi.c[n] ^= out[n] = in[n] ^ ctx->EKi.c[n];
            ++n;
        }
    }
    ctx->mres = n;
    return 0;
#endif
}
['static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,\n                              const unsigned char *in, size_t len)\n{\n    EVP_AES_GCM_CTX *gctx = EVP_C_DATA(EVP_AES_GCM_CTX,ctx);\n    int rv = -1;\n    if (out != in\n        || len < (EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN))\n        return -1;\n    if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CIPHER_CTX_encrypting(ctx) ?\n                            EVP_CTRL_GCM_IV_GEN : EVP_CTRL_GCM_SET_IV_INV,\n                            EVP_GCM_TLS_EXPLICIT_IV_LEN, out) <= 0)\n        goto err;\n    if (CRYPTO_gcm128_aad(&gctx->gcm, EVP_CIPHER_CTX_buf_noconst(ctx),\n                          gctx->tls_aad_len))\n        goto err;\n    in += EVP_GCM_TLS_EXPLICIT_IV_LEN;\n    out += EVP_GCM_TLS_EXPLICIT_IV_LEN;\n    len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;\n    if (EVP_CIPHER_CTX_encrypting(ctx)) {\n        if (gctx->ctr) {\n            size_t bulk = 0;\n#if defined(AES_GCM_ASM)\n            if (len >= 32 && AES_GCM_ASM(gctx)) {\n                if (CRYPTO_gcm128_encrypt(&gctx->gcm, NULL, NULL, 0))\n                    return -1;\n                bulk = AES_gcm_encrypt(in, out, len,\n                                       gctx->gcm.key,\n                                       gctx->gcm.Yi.c, gctx->gcm.Xi.u);\n                gctx->gcm.len.u[1] += bulk;\n            }\n#endif\n            if (CRYPTO_gcm128_encrypt_ctr32(&gctx->gcm,\n                                            in + bulk,\n                                            out + bulk,\n                                            len - bulk, gctx->ctr))\n                goto err;\n        } else {\n            size_t bulk = 0;\n#if defined(AES_GCM_ASM2)\n            if (len >= 32 && AES_GCM_ASM2(gctx)) {\n                if (CRYPTO_gcm128_encrypt(&gctx->gcm, NULL, NULL, 0))\n                    return -1;\n                bulk = AES_gcm_encrypt(in, out, len,\n                                       gctx->gcm.key,\n                                       gctx->gcm.Yi.c, gctx->gcm.Xi.u);\n                gctx->gcm.len.u[1] += bulk;\n            }\n#endif\n            if (CRYPTO_gcm128_encrypt(&gctx->gcm,\n                                      in + bulk, out + bulk, len - bulk))\n                goto err;\n        }\n        out += len;\n        CRYPTO_gcm128_tag(&gctx->gcm, out, EVP_GCM_TLS_TAG_LEN);\n        rv = len + EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;\n    } else {\n        if (gctx->ctr) {\n            size_t bulk = 0;\n#if defined(AES_GCM_ASM)\n            if (len >= 16 && AES_GCM_ASM(gctx)) {\n                if (CRYPTO_gcm128_decrypt(&gctx->gcm, NULL, NULL, 0))\n                    return -1;\n                bulk = AES_gcm_decrypt(in, out, len,\n                                       gctx->gcm.key,\n                                       gctx->gcm.Yi.c, gctx->gcm.Xi.u);\n                gctx->gcm.len.u[1] += bulk;\n            }\n#endif\n            if (CRYPTO_gcm128_decrypt_ctr32(&gctx->gcm,\n                                            in + bulk,\n                                            out + bulk,\n                                            len - bulk, gctx->ctr))\n                goto err;\n        } else {\n            size_t bulk = 0;\n#if defined(AES_GCM_ASM2)\n            if (len >= 16 && AES_GCM_ASM2(gctx)) {\n                if (CRYPTO_gcm128_decrypt(&gctx->gcm, NULL, NULL, 0))\n                    return -1;\n                bulk = AES_gcm_decrypt(in, out, len,\n                                       gctx->gcm.key,\n                                       gctx->gcm.Yi.c, gctx->gcm.Xi.u);\n                gctx->gcm.len.u[1] += bulk;\n            }\n#endif\n            if (CRYPTO_gcm128_decrypt(&gctx->gcm,\n                                      in + bulk, out + bulk, len - bulk))\n                goto err;\n        }\n        CRYPTO_gcm128_tag(&gctx->gcm, EVP_CIPHER_CTX_buf_noconst(ctx),\n                          EVP_GCM_TLS_TAG_LEN);\n        if (CRYPTO_memcmp(EVP_CIPHER_CTX_buf_noconst(ctx), in + len,\n                          EVP_GCM_TLS_TAG_LEN)) {\n            OPENSSL_cleanse(out, len);\n            goto err;\n        }\n        rv = len;\n    }\n err:\n    gctx->iv_set = 0;\n    gctx->tls_aad_len = -1;\n    return rv;\n}', 'int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,\n                                const unsigned char *in, unsigned char *out,\n                                size_t len, ctr128_f stream)\n{\n#if defined(OPENSSL_SMALL_FOOTPRINT)\n    return CRYPTO_gcm128_encrypt(ctx, in, out, len);\n#else\n    const union {\n        long one;\n        char little;\n    } is_endian = { 1 };\n    unsigned int n, ctr;\n    size_t i;\n    u64 mlen = ctx->len.u[1];\n    void *key = ctx->key;\n# ifdef GCM_FUNCREF_4BIT\n    void (*gcm_gmult_p) (u64 Xi[2], const u128 Htable[16]) = ctx->gmult;\n#  ifdef GHASH\n    void (*gcm_ghash_p) (u64 Xi[2], const u128 Htable[16],\n                         const u8 *inp, size_t len) = ctx->ghash;\n#  endif\n# endif\n    mlen += len;\n    if (mlen > ((U64(1) << 36) - 32) || (sizeof(len) == 8 && mlen < len))\n        return -1;\n    ctx->len.u[1] = mlen;\n    if (ctx->ares) {\n        GCM_MUL(ctx, Xi);\n        ctx->ares = 0;\n    }\n    if (is_endian.little)\n# ifdef BSWAP4\n        ctr = BSWAP4(ctx->Yi.d[3]);\n# else\n        ctr = GETU32(ctx->Yi.c + 12);\n# endif\n    else\n        ctr = ctx->Yi.d[3];\n    n = ctx->mres;\n    if (n) {\n        while (n && len) {\n            ctx->Xi.c[n] ^= *(out++) = *(in++) ^ ctx->EKi.c[n];\n            --len;\n            n = (n + 1) % 16;\n        }\n        if (n == 0)\n            GCM_MUL(ctx, Xi);\n        else {\n            ctx->mres = n;\n            return 0;\n        }\n    }\n# if defined(GHASH) && defined(GHASH_CHUNK)\n    while (len >= GHASH_CHUNK) {\n        (*stream) (in, out, GHASH_CHUNK / 16, key, ctx->Yi.c);\n        ctr += GHASH_CHUNK / 16;\n        if (is_endian.little)\n#  ifdef BSWAP4\n            ctx->Yi.d[3] = BSWAP4(ctr);\n#  else\n            PUTU32(ctx->Yi.c + 12, ctr);\n#  endif\n        else\n            ctx->Yi.d[3] = ctr;\n        GHASH(ctx, out, GHASH_CHUNK);\n        out += GHASH_CHUNK;\n        in += GHASH_CHUNK;\n        len -= GHASH_CHUNK;\n    }\n# endif\n    if ((i = (len & (size_t)-16))) {\n        size_t j = i / 16;\n        (*stream) (in, out, j, key, ctx->Yi.c);\n        ctr += (unsigned int)j;\n        if (is_endian.little)\n# ifdef BSWAP4\n            ctx->Yi.d[3] = BSWAP4(ctr);\n# else\n            PUTU32(ctx->Yi.c + 12, ctr);\n# endif\n        else\n            ctx->Yi.d[3] = ctr;\n        in += i;\n        len -= i;\n# if defined(GHASH)\n        GHASH(ctx, out, i);\n        out += i;\n# else\n        while (j--) {\n            for (i = 0; i < 16; ++i)\n                ctx->Xi.c[i] ^= out[i];\n            GCM_MUL(ctx, Xi);\n            out += 16;\n        }\n# endif\n    }\n    if (len) {\n        (*ctx->block) (ctx->Yi.c, ctx->EKi.c, key);\n        ++ctr;\n        if (is_endian.little)\n# ifdef BSWAP4\n            ctx->Yi.d[3] = BSWAP4(ctr);\n# else\n            PUTU32(ctx->Yi.c + 12, ctr);\n# endif\n        else\n            ctx->Yi.d[3] = ctr;\n        while (len--) {\n            ctx->Xi.c[n] ^= out[n] = in[n] ^ ctx->EKi.c[n];\n            ++n;\n        }\n    }\n    ctx->mres = n;\n    return 0;\n#endif\n}']