crypto/evp/e_aes.c:1337: error: INTEGER_OVERFLOW_L2
  ([0, 3071] - [1, 3071]):unsigned64 by call to `CRYPTO_gcm128_encrypt_ctr32`.
Showing all 9 steps of the trace


crypto/evp/e_aes.c:1296:1: Parameter `len`
1294.    */
1295.   
1296. > static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
1297.   		const unsigned char *in, size_t len)
1298.   	{

crypto/evp/e_aes.c:1317:2: Assignment
1315.   	in += EVP_GCM_TLS_EXPLICIT_IV_LEN;
1316.   	out += EVP_GCM_TLS_EXPLICIT_IV_LEN;
1317.   	len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;
         ^
1318.   	if (ctx->encrypt)
1319.   		{

crypto/evp/e_aes.c:1337:8: Call
1335.   				}
1336.   #endif
1337.   			if (CRYPTO_gcm128_encrypt_ctr32(&gctx->gcm,
               ^
1338.   							in +bulk,
1339.   							out+bulk,

crypto/modes/gcm128.c:1236:1: <LHS trace>
1234.   }
1235.   
1236. > int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
1237.   		const unsigned char *in, unsigned char *out,
1238.   		size_t len, ctr128_f stream)

crypto/modes/gcm128.c:1236:1: Parameter `len`
  1234.   }
  1235.   
  1236. > int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
  1237.   		const unsigned char *in, unsigned char *out,
  1238.   		size_t len, ctr128_f stream)

crypto/modes/gcm128.c:1236:1: <RHS trace>
1234.   }
1235.   
1236. > int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
1237.   		const unsigned char *in, unsigned char *out,
1238.   		size_t len, ctr128_f stream)

crypto/modes/gcm128.c:1236:1: Parameter `len`
  1234.   }
  1235.   
  1236. > int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
  1237.   		const unsigned char *in, unsigned char *out,
  1238.   		size_t len, ctr128_f stream)

crypto/modes/gcm128.c:1296:7: Assignment
  1294.   	}
  1295.   #endif
  1296.   	if ((i = (len&(size_t)-16))) {
                ^
  1297.   		size_t j=i/16;
  1298.   

crypto/modes/gcm128.c:1306:3: Binary operation: ([0, 3071] - [1, 3071]):unsigned64 by call to `CRYPTO_gcm128_encrypt_ctr32` 
  1304.   			ctx->Yi.d[3] = ctr;
  1305.   		in  += i;
  1306.   		len -= i;
            ^
  1307.   #if defined(GHASH)
  1308.   		GHASH(ctx,out,i);

int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,
		const unsigned char *in, unsigned char *out,
		size_t len, ctr128_f stream)
{
	const union { long one; char little; } is_endian = {1};
	unsigned int n, ctr;
	size_t i;
	u64   mlen = ctx->len.u[1];
	void *key  = ctx->key;
#ifdef GCM_FUNCREF_4BIT
	void (*gcm_gmult_p)(u64 Xi[2],const u128 Htable[16])	= ctx->gmult;
# ifdef GHASH
	void (*gcm_ghash_p)(u64 Xi[2],const u128 Htable[16],
				const u8 *inp,size_t len)	= ctx->ghash;
# endif
#endif
	mlen += len;
	if (mlen>((U64(1)<<36)-32) || (sizeof(len)==8 && mlen<len))
		return -1;
	ctx->len.u[1] = mlen;
	if (ctx->ares) {
		GCM_MUL(ctx,Xi);
		ctx->ares = 0;
	}
	if (is_endian.little)
		ctr = GETU32(ctx->Yi.c+12);
	else
		ctr = ctx->Yi.d[3];
	n = ctx->mres;
	if (n) {
		while (n && len) {
			ctx->Xi.c[n] ^= *(out++) = *(in++)^ctx->EKi.c[n];
			--len;
			n = (n+1)%16;
		}
		if (n==0) GCM_MUL(ctx,Xi);
		else {
			ctx->mres = n;
			return 0;
		}
	}
#if defined(GHASH) && !defined(OPENSSL_SMALL_FOOTPRINT)
	while (len>=GHASH_CHUNK) {
		(*stream)(in,out,GHASH_CHUNK/16,key,ctx->Yi.c);
		ctr += GHASH_CHUNK/16;
		if (is_endian.little)
			PUTU32(ctx->Yi.c+12,ctr);
		else
			ctx->Yi.d[3] = ctr;
		GHASH(ctx,out,GHASH_CHUNK);
		out += GHASH_CHUNK;
		in  += GHASH_CHUNK;
		len -= GHASH_CHUNK;
	}
#endif
	if ((i = (len&(size_t)-16))) {
		size_t j=i/16;
		(*stream)(in,out,j,key,ctx->Yi.c);
		ctr += (unsigned int)j;
		if (is_endian.little)
			PUTU32(ctx->Yi.c+12,ctr);
		else
			ctx->Yi.d[3] = ctr;
		in  += i;
		len -= i;
#if defined(GHASH)
		GHASH(ctx,out,i);
		out += i;
#else
		while (j--) {
			for (i=0;i<16;++i) ctx->Xi.c[i] ^= out[i];
			GCM_MUL(ctx,Xi);
			out += 16;
		}
#endif
	}
	if (len) {
		(*ctx->block)(ctx->Yi.c,ctx->EKi.c,key);
		++ctr;
		if (is_endian.little)
			PUTU32(ctx->Yi.c+12,ctr);
		else
			ctx->Yi.d[3] = ctr;
		while (len--) {
			ctx->Xi.c[n] ^= out[n] = in[n]^ctx->EKi.c[n];
			++n;
		}
	}
	ctx->mres = n;
	return 0;
}
['static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,\n\t\tconst unsigned char *in, size_t len)\n\t{\n\tEVP_AES_GCM_CTX *gctx = ctx->cipher_data;\n\tint rv = -1;\n\tif (out != in || len < (EVP_GCM_TLS_EXPLICIT_IV_LEN+EVP_GCM_TLS_TAG_LEN))\n\t\treturn -1;\n\tif (EVP_CIPHER_CTX_ctrl(ctx, ctx->encrypt ?\n\t\t\t\tEVP_CTRL_GCM_IV_GEN : EVP_CTRL_GCM_SET_IV_INV,\n\t\t\t\tEVP_GCM_TLS_EXPLICIT_IV_LEN, out) <= 0)\n\t\tgoto err;\n\tif (CRYPTO_gcm128_aad(&gctx->gcm, ctx->buf, gctx->tls_aad_len))\n\t\tgoto err;\n\tin += EVP_GCM_TLS_EXPLICIT_IV_LEN;\n\tout += EVP_GCM_TLS_EXPLICIT_IV_LEN;\n\tlen -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;\n\tif (ctx->encrypt)\n\t\t{\n\t\tif (gctx->ctr)\n\t\t\t{\n\t\t\tsize_t bulk=0;\n#if defined(AES_GCM_ASM)\n\t\t\tif (len>=32 && AES_GCM_ASM(gctx))\n\t\t\t\t{\n\t\t\t\tif (CRYPTO_gcm128_encrypt(&gctx->gcm,NULL,NULL,0))\n\t\t\t\t\treturn -1;\n\t\t\t\tbulk = AES_gcm_encrypt(in,out,len,\n\t\t\t\t\t\t\tgctx->gcm.key,\n\t\t\t\t\t\t\tgctx->gcm.Yi.c,\n\t\t\t\t\t\t\tgctx->gcm.Xi.u);\n\t\t\t\tgctx->gcm.len.u[1] += bulk;\n\t\t\t\t}\n#endif\n\t\t\tif (CRYPTO_gcm128_encrypt_ctr32(&gctx->gcm,\n\t\t\t\t\t\t\tin +bulk,\n\t\t\t\t\t\t\tout+bulk,\n\t\t\t\t\t\t\tlen-bulk,\n\t\t\t\t\t\t\tgctx->ctr))\n\t\t\t\tgoto err;\n\t\t\t}\n\t\telse\t{\n\t\t\tsize_t bulk=0;\n#if defined(AES_GCM_ASM2)\n\t\t\tif (len>=32 && AES_GCM_ASM2(gctx))\n\t\t\t\t{\n\t\t\t\tif (CRYPTO_gcm128_encrypt(&gctx->gcm,NULL,NULL,0))\n\t\t\t\t\treturn -1;\n\t\t\t\tbulk = AES_gcm_encrypt(in,out,len,\n\t\t\t\t\t\t\tgctx->gcm.key,\n\t\t\t\t\t\t\tgctx->gcm.Yi.c,\n\t\t\t\t\t\t\tgctx->gcm.Xi.u);\n\t\t\t\tgctx->gcm.len.u[1] += bulk;\n\t\t\t\t}\n#endif\n\t\t\tif (CRYPTO_gcm128_encrypt(&gctx->gcm,\n\t\t\t\t\t\t\tin +bulk,\n\t\t\t\t\t\t\tout+bulk,\n\t\t\t\t\t\t\tlen-bulk))\n\t\t\t\tgoto err;\n\t\t\t}\n\t\tout += len;\n\t\tCRYPTO_gcm128_tag(&gctx->gcm, out, EVP_GCM_TLS_TAG_LEN);\n\t\trv = len + EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;\n\t\t}\n\telse\n\t\t{\n\t\tif (gctx->ctr)\n\t\t\t{\n\t\t\tsize_t bulk=0;\n#if defined(AES_GCM_ASM)\n\t\t\tif (len>=16 && AES_GCM_ASM(gctx))\n\t\t\t\t{\n\t\t\t\tif (CRYPTO_gcm128_decrypt(&gctx->gcm,NULL,NULL,0))\n\t\t\t\t\treturn -1;\n\t\t\t\tbulk = AES_gcm_decrypt(in,out,len,\n\t\t\t\t\t\t\tgctx->gcm.key,\n\t\t\t\t\t\t\tgctx->gcm.Yi.c,\n\t\t\t\t\t\t\tgctx->gcm.Xi.u);\n\t\t\t\tgctx->gcm.len.u[1] += bulk;\n\t\t\t\t}\n#endif\n\t\t\tif (CRYPTO_gcm128_decrypt_ctr32(&gctx->gcm,\n\t\t\t\t\t\t\tin +bulk,\n\t\t\t\t\t\t\tout+bulk,\n\t\t\t\t\t\t\tlen-bulk,\n\t\t\t\t\t\t\tgctx->ctr))\n\t\t\t\tgoto err;\n\t\t\t}\n\t\telse\t{\n\t\t\tsize_t bulk=0;\n#if defined(AES_GCM_ASM2)\n\t\t\tif (len>=16 && AES_GCM_ASM2(gctx))\n\t\t\t\t{\n\t\t\t\tif (CRYPTO_gcm128_decrypt(&gctx->gcm,NULL,NULL,0))\n\t\t\t\t\treturn -1;\n\t\t\t\tbulk = AES_gcm_decrypt(in,out,len,\n\t\t\t\t\t\t\tgctx->gcm.key,\n\t\t\t\t\t\t\tgctx->gcm.Yi.c,\n\t\t\t\t\t\t\tgctx->gcm.Xi.u);\n\t\t\t\tgctx->gcm.len.u[1] += bulk;\n\t\t\t\t}\n#endif\n\t\t\tif (CRYPTO_gcm128_decrypt(&gctx->gcm,\n\t\t\t\t\t\t\tin +bulk,\n\t\t\t\t\t\t\tout+bulk,\n\t\t\t\t\t\t\tlen-bulk))\n\t\t\t\tgoto err;\n\t\t\t}\n\t\tCRYPTO_gcm128_tag(&gctx->gcm, ctx->buf,\n\t\t\t\t\tEVP_GCM_TLS_TAG_LEN);\n\t\tif (memcmp(ctx->buf, in + len, EVP_GCM_TLS_TAG_LEN))\n\t\t\t{\n\t\t\tOPENSSL_cleanse(out, len);\n\t\t\tgoto err;\n\t\t\t}\n\t\trv = len;\n\t\t}\n\terr:\n\tgctx->iv_set = 0;\n\tgctx->tls_aad_len = -1;\n\treturn rv;\n\t}', 'int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx,\n\t\tconst unsigned char *in, unsigned char *out,\n\t\tsize_t len, ctr128_f stream)\n{\n\tconst union { long one; char little; } is_endian = {1};\n\tunsigned int n, ctr;\n\tsize_t i;\n\tu64   mlen = ctx->len.u[1];\n\tvoid *key  = ctx->key;\n#ifdef GCM_FUNCREF_4BIT\n\tvoid (*gcm_gmult_p)(u64 Xi[2],const u128 Htable[16])\t= ctx->gmult;\n# ifdef GHASH\n\tvoid (*gcm_ghash_p)(u64 Xi[2],const u128 Htable[16],\n\t\t\t\tconst u8 *inp,size_t len)\t= ctx->ghash;\n# endif\n#endif\n\tmlen += len;\n\tif (mlen>((U64(1)<<36)-32) || (sizeof(len)==8 && mlen<len))\n\t\treturn -1;\n\tctx->len.u[1] = mlen;\n\tif (ctx->ares) {\n\t\tGCM_MUL(ctx,Xi);\n\t\tctx->ares = 0;\n\t}\n\tif (is_endian.little)\n\t\tctr = GETU32(ctx->Yi.c+12);\n\telse\n\t\tctr = ctx->Yi.d[3];\n\tn = ctx->mres;\n\tif (n) {\n\t\twhile (n && len) {\n\t\t\tctx->Xi.c[n] ^= *(out++) = *(in++)^ctx->EKi.c[n];\n\t\t\t--len;\n\t\t\tn = (n+1)%16;\n\t\t}\n\t\tif (n==0) GCM_MUL(ctx,Xi);\n\t\telse {\n\t\t\tctx->mres = n;\n\t\t\treturn 0;\n\t\t}\n\t}\n#if defined(GHASH) && !defined(OPENSSL_SMALL_FOOTPRINT)\n\twhile (len>=GHASH_CHUNK) {\n\t\t(*stream)(in,out,GHASH_CHUNK/16,key,ctx->Yi.c);\n\t\tctr += GHASH_CHUNK/16;\n\t\tif (is_endian.little)\n\t\t\tPUTU32(ctx->Yi.c+12,ctr);\n\t\telse\n\t\t\tctx->Yi.d[3] = ctr;\n\t\tGHASH(ctx,out,GHASH_CHUNK);\n\t\tout += GHASH_CHUNK;\n\t\tin  += GHASH_CHUNK;\n\t\tlen -= GHASH_CHUNK;\n\t}\n#endif\n\tif ((i = (len&(size_t)-16))) {\n\t\tsize_t j=i/16;\n\t\t(*stream)(in,out,j,key,ctx->Yi.c);\n\t\tctr += (unsigned int)j;\n\t\tif (is_endian.little)\n\t\t\tPUTU32(ctx->Yi.c+12,ctr);\n\t\telse\n\t\t\tctx->Yi.d[3] = ctr;\n\t\tin  += i;\n\t\tlen -= i;\n#if defined(GHASH)\n\t\tGHASH(ctx,out,i);\n\t\tout += i;\n#else\n\t\twhile (j--) {\n\t\t\tfor (i=0;i<16;++i) ctx->Xi.c[i] ^= out[i];\n\t\t\tGCM_MUL(ctx,Xi);\n\t\t\tout += 16;\n\t\t}\n#endif\n\t}\n\tif (len) {\n\t\t(*ctx->block)(ctx->Yi.c,ctx->EKi.c,key);\n\t\t++ctr;\n\t\tif (is_endian.little)\n\t\t\tPUTU32(ctx->Yi.c+12,ctr);\n\t\telse\n\t\t\tctx->Yi.d[3] = ctr;\n\t\twhile (len--) {\n\t\t\tctx->Xi.c[n] ^= out[n] = in[n]^ctx->EKi.c[n];\n\t\t\t++n;\n\t\t}\n\t}\n\tctx->mres = n;\n\treturn 0;\n}']