crypto/camellia/cmll_cfb.c:198: error: BUFFER_OVERRUN_L2
  Offset: [1, 32] Size: 32.
Showing all 5 steps of the trace


crypto/camellia/cmll_cfb.c:197:7: <Offset trace>
195.   		memcpy(ivec,ovec+num,CAMELLIA_BLOCK_SIZE);
196.   	else
197.   		for(n=0 ; n < CAMELLIA_BLOCK_SIZE ; ++n)
             ^
198.   			ivec[n] = ovec[n+num]<<rem | ovec[n+num+1]>>(8-rem);
199.   

crypto/camellia/cmll_cfb.c:197:7: Assignment
195.   		memcpy(ivec,ovec+num,CAMELLIA_BLOCK_SIZE);
196.   	else
197.   		for(n=0 ; n < CAMELLIA_BLOCK_SIZE ; ++n)
             ^
198.   			ivec[n] = ovec[n+num]<<rem | ovec[n+num+1]>>(8-rem);
199.   

crypto/camellia/cmll_cfb.c:171:1: <Length trace>
169.   /* This expects a single block of size nbits for both in and out. Note that
170.      it corrupts any extra bits in the last byte of out */
171. > void Camellia_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,
172.   	const int nbits,const CAMELLIA_KEY *key,
173.   	unsigned char *ivec,const int enc)

crypto/camellia/cmll_cfb.c:171:1: Array declaration
169.   /* This expects a single block of size nbits for both in and out. Note that
170.      it corrupts any extra bits in the last byte of out */
171. > void Camellia_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,
172.   	const int nbits,const CAMELLIA_KEY *key,
173.   	unsigned char *ivec,const int enc)

crypto/camellia/cmll_cfb.c:198:33: Array access: Offset: [1, 32] Size: 32
196.   	else
197.   		for(n=0 ; n < CAMELLIA_BLOCK_SIZE ; ++n)
198.   			ivec[n] = ovec[n+num]<<rem | ovec[n+num+1]>>(8-rem);
                                       ^
199.   
200.   	/* it is not necessary to cleanse ovec, since the IV is not secret */

void Camellia_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,
	const int nbits,const CAMELLIA_KEY *key,
	unsigned char *ivec,const int enc)
	{
	int n,rem,num;
	unsigned char ovec[CAMELLIA_BLOCK_SIZE*2];
	if (nbits<=0 || nbits>128) return;
	memcpy(ovec,ivec,CAMELLIA_BLOCK_SIZE);
	Camellia_encrypt(ivec,ivec,key);
	num = (nbits+7)/8;
	if (enc)
		for(n=0 ; n < num ; ++n)
			out[n] = (ovec[CAMELLIA_BLOCK_SIZE+n] = in[n] ^ ivec[n]);
	else
		for(n=0 ; n < num ; ++n)
			out[n] = (ovec[CAMELLIA_BLOCK_SIZE+n] = in[n]) ^ ivec[n];
	rem = nbits%8;
	num = nbits/8;
	if(rem==0)
		memcpy(ivec,ovec+num,CAMELLIA_BLOCK_SIZE);
	else
		for(n=0 ; n < CAMELLIA_BLOCK_SIZE ; ++n)
			ivec[n] = ovec[n+num]<<rem | ovec[n+num+1]>>(8-rem);
	}
['void Camellia_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,\n\tconst int nbits,const CAMELLIA_KEY *key,\n\tunsigned char *ivec,const int enc)\n\t{\n\tint n,rem,num;\n\tunsigned char ovec[CAMELLIA_BLOCK_SIZE*2];\n\tif (nbits<=0 || nbits>128) return;\n\tmemcpy(ovec,ivec,CAMELLIA_BLOCK_SIZE);\n\tCamellia_encrypt(ivec,ivec,key);\n\tnum = (nbits+7)/8;\n\tif (enc)\n\t\tfor(n=0 ; n < num ; ++n)\n\t\t\tout[n] = (ovec[CAMELLIA_BLOCK_SIZE+n] = in[n] ^ ivec[n]);\n\telse\n\t\tfor(n=0 ; n < num ; ++n)\n\t\t\tout[n] = (ovec[CAMELLIA_BLOCK_SIZE+n] = in[n]) ^ ivec[n];\n\trem = nbits%8;\n\tnum = nbits/8;\n\tif(rem==0)\n\t\tmemcpy(ivec,ovec+num,CAMELLIA_BLOCK_SIZE);\n\telse\n\t\tfor(n=0 ; n < CAMELLIA_BLOCK_SIZE ; ++n)\n\t\t\tivec[n] = ovec[n+num]<<rem | ovec[n+num+1]>>(8-rem);\n\t}']