crypto/aes/aes_cfb.c:188: error: BUFFER_OVERRUN_L2
  Offset: [1, 32] Size: 32.
Showing all 5 steps of the trace


crypto/aes/aes_cfb.c:187:10: <Offset trace>
185.   	    memcpy(ivec,ovec+num,AES_BLOCK_SIZE);
186.   	else
187.   	    for(n=0 ; n < AES_BLOCK_SIZE ; ++n)
                ^
188.   		ivec[n] = ovec[n+num]<<rem | ovec[n+num+1]>>(8-rem);
189.   

crypto/aes/aes_cfb.c:187:10: Assignment
185.   	    memcpy(ivec,ovec+num,AES_BLOCK_SIZE);
186.   	else
187.   	    for(n=0 ; n < AES_BLOCK_SIZE ; ++n)
                ^
188.   		ivec[n] = ovec[n+num]<<rem | ovec[n+num+1]>>(8-rem);
189.   

crypto/aes/aes_cfb.c:161:1: <Length trace>
159.   /* This expects a single block of size nbits for both in and out. Note that
160.      it corrupts any extra bits in the last byte of out */
161. > void AES_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,
162.   			    const int nbits,const AES_KEY *key,
163.   			    unsigned char *ivec,const int enc)

crypto/aes/aes_cfb.c:161:1: Array declaration
159.   /* This expects a single block of size nbits for both in and out. Note that
160.      it corrupts any extra bits in the last byte of out */
161. > void AES_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,
162.   			    const int nbits,const AES_KEY *key,
163.   			    unsigned char *ivec,const int enc)

crypto/aes/aes_cfb.c:188:32: Array access: Offset: [1, 32] Size: 32
186.   	else
187.   	    for(n=0 ; n < AES_BLOCK_SIZE ; ++n)
188.   		ivec[n] = ovec[n+num]<<rem | ovec[n+num+1]>>(8-rem);
                                      ^
189.   
190.       /* it is not necessary to cleanse ovec, since the IV is not secret */

void AES_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,
			    const int nbits,const AES_KEY *key,
			    unsigned char *ivec,const int enc)
    {
    int n,rem,num;
    unsigned char ovec[AES_BLOCK_SIZE*2];
    if (nbits<=0 || nbits>128) return;
	memcpy(ovec,ivec,AES_BLOCK_SIZE);
	AES_encrypt(ivec,ivec,key);
	num = (nbits+7)/8;
	if (enc)
	    for(n=0 ; n < num ; ++n)
		out[n] = (ovec[AES_BLOCK_SIZE+n] = in[n] ^ ivec[n]);
	else
	    for(n=0 ; n < num ; ++n)
		out[n] = (ovec[AES_BLOCK_SIZE+n] = in[n]) ^ ivec[n];
	rem = nbits%8;
	num = nbits/8;
	if(rem==0)
	    memcpy(ivec,ovec+num,AES_BLOCK_SIZE);
	else
	    for(n=0 ; n < AES_BLOCK_SIZE ; ++n)
		ivec[n] = ovec[n+num]<<rem | ovec[n+num+1]>>(8-rem);
    }
['void AES_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,\n\t\t\t    const int nbits,const AES_KEY *key,\n\t\t\t    unsigned char *ivec,const int enc)\n    {\n    int n,rem,num;\n    unsigned char ovec[AES_BLOCK_SIZE*2];\n    if (nbits<=0 || nbits>128) return;\n\tmemcpy(ovec,ivec,AES_BLOCK_SIZE);\n\tAES_encrypt(ivec,ivec,key);\n\tnum = (nbits+7)/8;\n\tif (enc)\n\t    for(n=0 ; n < num ; ++n)\n\t\tout[n] = (ovec[AES_BLOCK_SIZE+n] = in[n] ^ ivec[n]);\n\telse\n\t    for(n=0 ; n < num ; ++n)\n\t\tout[n] = (ovec[AES_BLOCK_SIZE+n] = in[n]) ^ ivec[n];\n\trem = nbits%8;\n\tnum = nbits/8;\n\tif(rem==0)\n\t    memcpy(ivec,ovec+num,AES_BLOCK_SIZE);\n\telse\n\t    for(n=0 ; n < AES_BLOCK_SIZE ; ++n)\n\t\tivec[n] = ovec[n+num]<<rem | ovec[n+num+1]>>(8-rem);\n    }']