crypto/cms/cms_pwri.c:195: error: INTEGER_OVERFLOW_L2
  (0 - [-oo, 32]):unsigned64 by call to `EVP_DecryptUpdate`.
Showing all 7 steps of the trace


crypto/cms/cms_pwri.c:195:10: Call
193.           return 0;
194.       /* setup IV by decrypting last two blocks */
195.       if (!EVP_DecryptUpdate(ctx, tmp + inlen - 2 * blocklen, &outl,
                ^
196.                              in + inlen - 2 * blocklen, blocklen * 2)
197.           /*

crypto/evp/evp_enc.c:416:1: Parameter `ctx->cipher->block_size`
  414.   }
  415.   
  416. > int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
  417.                         const unsigned char *in, int inl)
  418.   {

crypto/evp/evp_enc.c:422:5: Assignment
  420.       unsigned int b;
  421.   
  422.       b = ctx->cipher->block_size;
             ^
  423.   
  424.       if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) {

crypto/evp/evp_enc.c:452:16: Call
  450.           /* see comment about PTRDIFF_T comparison above */
  451.           if (((PTRDIFF_T)out == (PTRDIFF_T)in)
  452.               || is_partially_overlapping(out, in, b)) {
                        ^
  453.               EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_PARTIALLY_OVERLAPPING);
  454.               return 0;

crypto/evp/evp_enc.c:279:1: <RHS trace>
277.   #endif
278.   
279. > int is_partially_overlapping(const void *ptr1, const void *ptr2, int len)
280.   {
281.       PTRDIFF_T diff = (PTRDIFF_T)ptr1-(PTRDIFF_T)ptr2;

crypto/evp/evp_enc.c:279:1: Parameter `len`
    277.   #endif
    278.   
    279. > int is_partially_overlapping(const void *ptr1, const void *ptr2, int len)
    280.   {
    281.       PTRDIFF_T diff = (PTRDIFF_T)ptr1-(PTRDIFF_T)ptr2;

crypto/evp/evp_enc.c:288:50: Binary operation: (0 - [-oo, 32]):unsigned64 by call to `EVP_DecryptUpdate` 
    286.        */
    287.       int overlapped = (len > 0) & (diff != 0) & ((diff < (PTRDIFF_T)len) |
    288.                                                   (diff > (0 - (PTRDIFF_T)len)));
                                                            ^
    289.       assert(!overlapped);
    290.       return overlapped;

int is_partially_overlapping(const void *ptr1, const void *ptr2, int len)
{
    PTRDIFF_T diff = (PTRDIFF_T)ptr1-(PTRDIFF_T)ptr2;
    int overlapped = (len > 0) & (diff != 0) & ((diff < (PTRDIFF_T)len) |
                                                (diff > (0 - (PTRDIFF_T)len)));
    assert(!overlapped);
    return overlapped;
}
['static int kek_unwrap_key(unsigned char *out, size_t *outlen,\n                          const unsigned char *in, size_t inlen,\n                          EVP_CIPHER_CTX *ctx)\n{\n    size_t blocklen = EVP_CIPHER_CTX_block_size(ctx);\n    unsigned char *tmp;\n    int outl, rv = 0;\n    if (inlen < 2 * blocklen) {\n        return 0;\n    }\n    if (inlen % blocklen) {\n        return 0;\n    }\n    tmp = OPENSSL_malloc(inlen);\n    if (tmp == NULL)\n        return 0;\n    if (!EVP_DecryptUpdate(ctx, tmp + inlen - 2 * blocklen, &outl,\n                           in + inlen - 2 * blocklen, blocklen * 2)\n        || !EVP_DecryptUpdate(ctx, tmp, &outl,\n                              tmp + inlen - blocklen, blocklen)\n        || !EVP_DecryptUpdate(ctx, tmp, &outl, in, inlen - blocklen)\n        || !EVP_DecryptInit_ex(ctx, NULL, NULL, NULL, NULL)\n        || !EVP_DecryptUpdate(ctx, tmp, &outl, tmp, inlen))\n        goto err;\n    if (((tmp[1] ^ tmp[4]) & (tmp[2] ^ tmp[5]) & (tmp[3] ^ tmp[6])) != 0xff) {\n        goto err;\n    }\n    if (inlen < (size_t)(tmp[0] - 4)) {\n        goto err;\n    }\n    *outlen = (size_t)tmp[0];\n    memcpy(out, tmp + 4, *outlen);\n    rv = 1;\n err:\n    OPENSSL_clear_free(tmp, inlen);\n    return rv;\n}', 'int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,\n                      const unsigned char *in, int inl)\n{\n    int fix_len;\n    unsigned int b;\n    b = ctx->cipher->block_size;\n    if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) {\n        if (b == 1 && is_partially_overlapping(out, in, inl)) {\n            EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_PARTIALLY_OVERLAPPING);\n            return 0;\n        }\n        fix_len = ctx->cipher->do_cipher(ctx, out, in, inl);\n        if (fix_len < 0) {\n            *outl = 0;\n            return 0;\n        } else\n            *outl = fix_len;\n        return 1;\n    }\n    if (inl <= 0) {\n        *outl = 0;\n        return inl == 0;\n    }\n    if (ctx->flags & EVP_CIPH_NO_PADDING)\n        return EVP_EncryptUpdate(ctx, out, outl, in, inl);\n    OPENSSL_assert(b <= sizeof ctx->final);\n    if (ctx->final_used) {\n        if (((PTRDIFF_T)out == (PTRDIFF_T)in)\n            || is_partially_overlapping(out, in, b)) {\n            EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_PARTIALLY_OVERLAPPING);\n            return 0;\n        }\n        memcpy(out, ctx->final, b);\n        out += b;\n        fix_len = 1;\n    } else\n        fix_len = 0;\n    if (!EVP_EncryptUpdate(ctx, out, outl, in, inl))\n        return 0;\n    if (b > 1 && !ctx->buf_len) {\n        *outl -= b;\n        ctx->final_used = 1;\n        memcpy(ctx->final, &out[*outl], b);\n    } else\n        ctx->final_used = 0;\n    if (fix_len)\n        *outl += b;\n    return 1;\n}', 'int is_partially_overlapping(const void *ptr1, const void *ptr2, int len)\n{\n    PTRDIFF_T diff = (PTRDIFF_T)ptr1-(PTRDIFF_T)ptr2;\n    int overlapped = (len > 0) & (diff != 0) & ((diff < (PTRDIFF_T)len) |\n                                                (diff > (0 - (PTRDIFF_T)len)));\n    assert(!overlapped);\n    return overlapped;\n}']