ssl/record/ssl3_record_tls13.c:120: error: INTEGER_OVERFLOW_L2
  (0 - [-oo, 32]):unsigned64 by call to `EVP_CipherUpdate`.
Showing all 9 steps of the trace


ssl/record/ssl3_record_tls13.c:120:16: Call
118.                                                taglen,
119.                                                rec->data + rec->length) <= 0)
120.               || EVP_CipherUpdate(ctx, rec->data, &lenu, rec->input,
                      ^
121.                                   (unsigned int)rec->length) <= 0
122.               || EVP_CipherFinal_ex(ctx, rec->data + lenu, &lenf) <= 0

crypto/evp/evp_enc.c:207:1: Parameter `ctx->cipher->block_size`
  205.   }
  206.   
  207. > int EVP_CipherUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
  208.                        const unsigned char *in, int inl)
  209.   {

crypto/evp/evp_enc.c:213:16: Call
  211.           return EVP_EncryptUpdate(ctx, out, outl, in, inl);
  212.       else
  213.           return EVP_DecryptUpdate(ctx, out, outl, in, inl);
                        ^
  214.   }
  215.   

crypto/evp/evp_enc.c:418:1: Parameter `ctx->cipher->block_size`
    416.   }
    417.   
    418. > int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
    419.                         const unsigned char *in, int inl)
    420.   {

crypto/evp/evp_enc.c:424:5: Assignment
    422.       unsigned int b;
    423.   
    424.       b = ctx->cipher->block_size;
               ^
    425.   
    426.       if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) {

crypto/evp/evp_enc.c:454:16: Call
    452.           /* see comment about PTRDIFF_T comparison above */
    453.           if (((PTRDIFF_T)out == (PTRDIFF_T)in)
    454.               || is_partially_overlapping(out, in, b)) {
                          ^
    455.               EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_PARTIALLY_OVERLAPPING);
    456.               return 0;

crypto/evp/evp_enc.c:281:1: <RHS trace>
279.   #endif
280.   
281. > int is_partially_overlapping(const void *ptr1, const void *ptr2, int len)
282.   {
283.       PTRDIFF_T diff = (PTRDIFF_T)ptr1-(PTRDIFF_T)ptr2;

crypto/evp/evp_enc.c:281:1: Parameter `len`
      279.   #endif
      280.   
      281. > int is_partially_overlapping(const void *ptr1, const void *ptr2, int len)
      282.   {
      283.       PTRDIFF_T diff = (PTRDIFF_T)ptr1-(PTRDIFF_T)ptr2;

crypto/evp/evp_enc.c:290:50: Binary operation: (0 - [-oo, 32]):unsigned64 by call to `EVP_CipherUpdate` 
      288.        */
      289.       int overlapped = (len > 0) & (diff != 0) & ((diff < (PTRDIFF_T)len) |
      290.                                                   (diff > (0 - (PTRDIFF_T)len)));
                                                              ^
      291.   
      292.       return overlapped;

int is_partially_overlapping(const void *ptr1, const void *ptr2, int len)
{
    PTRDIFF_T diff = (PTRDIFF_T)ptr1-(PTRDIFF_T)ptr2;
    int overlapped = (len > 0) & (diff != 0) & ((diff < (PTRDIFF_T)len) |
                                                (diff > (0 - (PTRDIFF_T)len)));
    return overlapped;
}
['int tls13_enc(SSL *s, SSL3_RECORD *recs, size_t n_recs, int send)\n{\n    EVP_CIPHER_CTX *ctx;\n    unsigned char iv[EVP_MAX_IV_LENGTH];\n    size_t ivlen, taglen, offset, loop;\n    unsigned char *staticiv;\n    unsigned char *seq;\n    int lenu, lenf;\n    SSL3_RECORD *rec = &recs[0];\n    uint32_t alg_enc;\n    if (n_recs != 1) {\n        return -1;\n    }\n    if (send) {\n        ctx = s->enc_write_ctx;\n        staticiv = s->write_iv;\n        seq = RECORD_LAYER_get_write_sequence(&s->rlayer);\n    } else {\n        ctx = s->enc_read_ctx;\n        staticiv = s->read_iv;\n        seq = RECORD_LAYER_get_read_sequence(&s->rlayer);\n    }\n    if (ctx == NULL) {\n        memmove(rec->data, rec->input, rec->length);\n        rec->input = rec->data;\n        return 1;\n    }\n    ivlen = EVP_CIPHER_CTX_iv_length(ctx);\n    assert(s->s3->tmp.new_cipher != NULL);\n    if (s->s3->tmp.new_cipher == NULL)\n        return -1;\n    alg_enc = s->s3->tmp.new_cipher->algorithm_enc;\n    if (alg_enc & SSL_AESCCM) {\n        if (alg_enc & (SSL_AES128CCM8 | SSL_AES256CCM8))\n            taglen = EVP_CCM8_TLS_TAG_LEN;\n         else\n            taglen = EVP_CCM_TLS_TAG_LEN;\n         if (send && EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, taglen,\n                                         NULL) <= 0)\n            return -1;\n    } else if (alg_enc & SSL_AESGCM) {\n        taglen = EVP_GCM_TLS_TAG_LEN;\n    } else if (alg_enc & SSL_CHACHA20) {\n        taglen = EVP_CHACHAPOLY_TLS_TAG_LEN;\n    } else {\n        return -1;\n    }\n    if (!send) {\n        if (rec->length < taglen + 1)\n            return 0;\n        rec->length -= taglen;\n    }\n    if (ivlen < SEQ_NUM_SIZE) {\n        return -1;\n    }\n    offset = ivlen - SEQ_NUM_SIZE;\n    memcpy(iv, staticiv, offset);\n    for (loop = 0; loop < SEQ_NUM_SIZE; loop++)\n        iv[offset + loop] = staticiv[offset + loop] ^ seq[loop];\n    for (loop = SEQ_NUM_SIZE; loop > 0; loop--) {\n        ++seq[loop - 1];\n        if (seq[loop - 1] != 0)\n            break;\n    }\n    if (loop == 0) {\n        return -1;\n    }\n    if (EVP_CipherInit_ex(ctx, NULL, NULL, NULL, iv, send) <= 0\n            || (!send && EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,\n                                             taglen,\n                                             rec->data + rec->length) <= 0)\n            || EVP_CipherUpdate(ctx, rec->data, &lenu, rec->input,\n                                (unsigned int)rec->length) <= 0\n            || EVP_CipherFinal_ex(ctx, rec->data + lenu, &lenf) <= 0\n            || (size_t)(lenu + lenf) != rec->length) {\n        return -1;\n    }\n    if (send) {\n        if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, taglen,\n                                rec->data + rec->length) <= 0)\n            return -1;\n        rec->length += taglen;\n    }\n    return 1;\n}', 'int EVP_CipherUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,\n                     const unsigned char *in, int inl)\n{\n    if (ctx->encrypt)\n        return EVP_EncryptUpdate(ctx, out, outl, in, inl);\n    else\n        return EVP_DecryptUpdate(ctx, out, outl, in, inl);\n}', 'int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,\n                      const unsigned char *in, int inl)\n{\n    int fix_len;\n    unsigned int b;\n    b = ctx->cipher->block_size;\n    if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) {\n        if (b == 1 && is_partially_overlapping(out, in, inl)) {\n            EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_PARTIALLY_OVERLAPPING);\n            return 0;\n        }\n        fix_len = ctx->cipher->do_cipher(ctx, out, in, inl);\n        if (fix_len < 0) {\n            *outl = 0;\n            return 0;\n        } else\n            *outl = fix_len;\n        return 1;\n    }\n    if (inl <= 0) {\n        *outl = 0;\n        return inl == 0;\n    }\n    if (ctx->flags & EVP_CIPH_NO_PADDING)\n        return EVP_EncryptUpdate(ctx, out, outl, in, inl);\n    OPENSSL_assert(b <= sizeof ctx->final);\n    if (ctx->final_used) {\n        if (((PTRDIFF_T)out == (PTRDIFF_T)in)\n            || is_partially_overlapping(out, in, b)) {\n            EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_PARTIALLY_OVERLAPPING);\n            return 0;\n        }\n        memcpy(out, ctx->final, b);\n        out += b;\n        fix_len = 1;\n    } else\n        fix_len = 0;\n    if (!EVP_EncryptUpdate(ctx, out, outl, in, inl))\n        return 0;\n    if (b > 1 && !ctx->buf_len) {\n        *outl -= b;\n        ctx->final_used = 1;\n        memcpy(ctx->final, &out[*outl], b);\n    } else\n        ctx->final_used = 0;\n    if (fix_len)\n        *outl += b;\n    return 1;\n}', 'int is_partially_overlapping(const void *ptr1, const void *ptr2, int len)\n{\n    PTRDIFF_T diff = (PTRDIFF_T)ptr1-(PTRDIFF_T)ptr2;\n    int overlapped = (len > 0) & (diff != 0) & ((diff < (PTRDIFF_T)len) |\n                                                (diff > (0 - (PTRDIFF_T)len)));\n    return overlapped;\n}']