crypto/evp/e_aes.c:1896: error: BUFFER_OVERRUN_L3
  Offset added: [2, 16] Size: [0, +oo] by call to `CRYPTO_ccm128_tag`.
Showing all 7 steps of the trace


crypto/evp/e_aes.c:1860:1: Parameter `arg`
1858.       BLOCK_CIPHER_custom(NID_aes, 256, 1, 16, xts, XTS, XTS_FLAGS)
1859.   
1860. > static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
1861.   {
1862.       EVP_AES_CCM_CTX *cctx = c->cipher_data;

crypto/evp/e_aes.c:1896:14: Call
1894.           if (!c->encrypt || !cctx->tag_set)
1895.               return 0;
1896.           if (!CRYPTO_ccm128_tag(&cctx->ccm, ptr, (size_t)arg))
                     ^
1897.               return 0;
1898.           cctx->tag_set = 0;

crypto/modes/ccm128.c:469:1: <Offset trace>
467.   }
468.   
469. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx, unsigned char *tag, size_t len)
470.   {
471.       unsigned int M = (ctx->nonce.c[0] >> 3) & 7; /* the M parameter */

crypto/modes/ccm128.c:469:1: Parameter `len`
  467.   }
  468.   
  469. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx, unsigned char *tag, size_t len)
  470.   {
  471.       unsigned int M = (ctx->nonce.c[0] >> 3) & 7; /* the M parameter */

crypto/modes/ccm128.c:469:1: <Length trace>
467.   }
468.   
469. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx, unsigned char *tag, size_t len)
470.   {
471.       unsigned int M = (ctx->nonce.c[0] >> 3) & 7; /* the M parameter */

crypto/modes/ccm128.c:469:1: Parameter `ctx->cmac.c[*]`
  467.   }
  468.   
  469. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx, unsigned char *tag, size_t len)
  470.   {
  471.       unsigned int M = (ctx->nonce.c[0] >> 3) & 7; /* the M parameter */

crypto/modes/ccm128.c:477:5: Array access: Offset added: [2, 16] Size: [0, +oo] by call to `CRYPTO_ccm128_tag` 
  475.       if (len < M)
  476.           return 0;
  477.       memcpy(tag, ctx->cmac.c, M);
             ^
  478.       return M;
  479.   }

size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx, unsigned char *tag, size_t len)
{
    unsigned int M = (ctx->nonce.c[0] >> 3) & 7;
    M *= 2;
    M += 2;
    if (len < M)
        return 0;
    memcpy(tag, ctx->cmac.c, M);
    return M;
}
['static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)\n{\n    EVP_AES_CCM_CTX *cctx = c->cipher_data;\n    switch (type) {\n    case EVP_CTRL_INIT:\n        cctx->key_set = 0;\n        cctx->iv_set = 0;\n        cctx->L = 8;\n        cctx->M = 12;\n        cctx->tag_set = 0;\n        cctx->len_set = 0;\n        return 1;\n    case EVP_CTRL_CCM_SET_IVLEN:\n        arg = 15 - arg;\n    case EVP_CTRL_CCM_SET_L:\n        if (arg < 2 || arg > 8)\n            return 0;\n        cctx->L = arg;\n        return 1;\n    case EVP_CTRL_CCM_SET_TAG:\n        if ((arg & 1) || arg < 4 || arg > 16)\n            return 0;\n        if ((c->encrypt && ptr) || (!c->encrypt && !ptr))\n            return 0;\n        if (ptr) {\n            cctx->tag_set = 1;\n            memcpy(c->buf, ptr, arg);\n        }\n        cctx->M = arg;\n        return 1;\n    case EVP_CTRL_CCM_GET_TAG:\n        if (!c->encrypt || !cctx->tag_set)\n            return 0;\n        if (!CRYPTO_ccm128_tag(&cctx->ccm, ptr, (size_t)arg))\n            return 0;\n        cctx->tag_set = 0;\n        cctx->iv_set = 0;\n        cctx->len_set = 0;\n        return 1;\n    case EVP_CTRL_COPY:\n        {\n            EVP_CIPHER_CTX *out = ptr;\n            EVP_AES_CCM_CTX *cctx_out = out->cipher_data;\n            if (cctx->ccm.key) {\n                if (cctx->ccm.key != &cctx->ks)\n                    return 0;\n                cctx_out->ccm.key = &cctx_out->ks;\n            }\n            return 1;\n        }\n    default:\n        return -1;\n    }\n}', 'size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx, unsigned char *tag, size_t len)\n{\n    unsigned int M = (ctx->nonce.c[0] >> 3) & 7;\n    M *= 2;\n    M += 2;\n    if (len < M)\n        return 0;\n    memcpy(tag, ctx->cmac.c, M);\n    return M;\n}']