crypto/bf/bftest.c:357: error: BUFFER_OVERRUN_L2
  Offset: [0, 71] Size: 16 by call to `BF_set_key`.
Showing all 6 steps of the trace


crypto/bf/bftest.c:75:1: Array declaration
73.   #include <openssl/blowfish.h>
74.   
75. > char *bf_key[2]={
76.   	"abcdefghijklmnopqrstuvwxyz",
77.   	"Who is John Galt?"

crypto/bf/bftest.c:357:3: Call
355.   	for (n=0; n<2; n++)
356.   		{
357.   		BF_set_key(&key,strlen(bf_key[n]),(unsigned char *)bf_key[n]);
         ^
358.   
359.   		data[0]=bf_plain[n][0];

crypto/bf/bf_skey.c:65:1: <Length trace>
63.   #include "bf_pi.h"
64.   
65. > void BF_set_key(BF_KEY *key, int len, unsigned char *data)
66.   	{
67.   	int i;

crypto/bf/bf_skey.c:65:1: Parameter `*data`
  63.   #include "bf_pi.h"
  64.   
  65. > void BF_set_key(BF_KEY *key, int len, unsigned char *data)
  66.   	{
  67.   	int i;

crypto/bf/bf_skey.c:77:2: Assignment
  75.   	if (len > ((BF_ROUNDS+2)*4)) len=(BF_ROUNDS+2)*4;
  76.   
  77.   	d=data;
         ^
  78.   	end= &(data[len]);
  79.   	for (i=0; i<(BF_ROUNDS+2); i++)

crypto/bf/bf_skey.c:81:7: Array access: Offset: [0, 71] Size: 16 by call to `BF_set_key` 
  79.   	for (i=0; i<(BF_ROUNDS+2); i++)
  80.   		{
  81.   		ri= *(d++);
              ^
  82.   		if (d >= end) d=data;
  83.   

void BF_set_key(BF_KEY *key, int len, unsigned char *data)
	{
	int i;
	BF_LONG *p,ri,in[2];
	unsigned char *d,*end;
	memcpy((char *)key,(char *)&bf_init,sizeof(BF_KEY));
	p=key->P;
	if (len > ((BF_ROUNDS+2)*4)) len=(BF_ROUNDS+2)*4;
	d=data;
	end= &(data[len]);
	for (i=0; i<(BF_ROUNDS+2); i++)
		{
		ri= *(d++);
		if (d >= end) d=data;
		ri<<=8;
		ri|= *(d++);
		if (d >= end) d=data;
		ri<<=8;
		ri|= *(d++);
		if (d >= end) d=data;
		ri<<=8;
		ri|= *(d++);
		if (d >= end) d=data;
		p[i]^=ri;
		}
	in[0]=0L;
	in[1]=0L;
	for (i=0; i<(BF_ROUNDS+2); i+=2)
		{
		BF_encrypt(in,key);
		p[i  ]=in[0];
		p[i+1]=in[1];
		}
	p=key->S;
	for (i=0; i<4*256; i+=2)
		{
		BF_encrypt(in,key);
		p[i  ]=in[0];
		p[i+1]=in[1];
		}
	}
['static int test(void)\n\t{\n\tunsigned char cbc_in[40],cbc_out[40],iv[8];\n\tint i,n,err=0;\n\tBF_KEY key;\n\tBF_LONG data[2];\n\tunsigned char out[8];\n\tBF_LONG len;\n\tprintf("testing blowfish in raw ecb mode\\n");\n\tfor (n=0; n<2; n++)\n\t\t{\n\t\tBF_set_key(&key,strlen(bf_key[n]),(unsigned char *)bf_key[n]);\n\t\tdata[0]=bf_plain[n][0];\n\t\tdata[1]=bf_plain[n][1];\n\t\tBF_encrypt(data,&key);\n\t\tif (memcmp(&(bf_cipher[n][0]),&(data[0]),8) != 0)\n\t\t\t{\n\t\t\tprintf("BF_encrypt error encrypting\\n");\n\t\t\tprintf("got     :");\n\t\t\tfor (i=0; i<2; i++)\n\t\t\t\tprintf("%08lX ",(unsigned long)data[i]);\n\t\t\tprintf("\\n");\n\t\t\tprintf("expected:");\n\t\t\tfor (i=0; i<2; i++)\n\t\t\t\tprintf("%08lX ",(unsigned long)bf_cipher[n][i]);\n\t\t\terr=1;\n\t\t\tprintf("\\n");\n\t\t\t}\n\t\tBF_decrypt(&(data[0]),&key);\n\t\tif (memcmp(&(bf_plain[n][0]),&(data[0]),8) != 0)\n\t\t\t{\n\t\t\tprintf("BF_encrypt error decrypting\\n");\n\t\t\tprintf("got     :");\n\t\t\tfor (i=0; i<2; i++)\n\t\t\t\tprintf("%08lX ",(unsigned long)data[i]);\n\t\t\tprintf("\\n");\n\t\t\tprintf("expected:");\n\t\t\tfor (i=0; i<2; i++)\n\t\t\t\tprintf("%08lX ",(unsigned long)bf_plain[n][i]);\n\t\t\tprintf("\\n");\n\t\t\terr=1;\n\t\t\t}\n\t\t}\n\tprintf("testing blowfish in ecb mode\\n");\n\tfor (n=0; n<NUM_TESTS; n++)\n\t\t{\n\t\tBF_set_key(&key,8,ecb_data[n]);\n\t\tBF_ecb_encrypt(&(plain_data[n][0]),out,&key,BF_ENCRYPT);\n\t\tif (memcmp(&(cipher_data[n][0]),out,8) != 0)\n\t\t\t{\n\t\t\tprintf("BF_ecb_encrypt blowfish error encrypting\\n");\n\t\t\tprintf("got     :");\n\t\t\tfor (i=0; i<8; i++)\n\t\t\t\tprintf("%02X ",out[i]);\n\t\t\tprintf("\\n");\n\t\t\tprintf("expected:");\n\t\t\tfor (i=0; i<8; i++)\n\t\t\t\tprintf("%02X ",cipher_data[n][i]);\n\t\t\terr=1;\n\t\t\tprintf("\\n");\n\t\t\t}\n\t\tBF_ecb_encrypt(out,out,&key,BF_DECRYPT);\n\t\tif (memcmp(&(plain_data[n][0]),out,8) != 0)\n\t\t\t{\n\t\t\tprintf("BF_ecb_encrypt error decrypting\\n");\n\t\t\tprintf("got     :");\n\t\t\tfor (i=0; i<8; i++)\n\t\t\t\tprintf("%02X ",out[i]);\n\t\t\tprintf("\\n");\n\t\t\tprintf("expected:");\n\t\t\tfor (i=0; i<8; i++)\n\t\t\t\tprintf("%02X ",plain_data[n][i]);\n\t\t\tprintf("\\n");\n\t\t\terr=1;\n\t\t\t}\n\t\t}\n\tprintf("testing blowfish set_key\\n");\n\tfor (n=1; n<KEY_TEST_NUM; n++)\n\t\t{\n\t\tBF_set_key(&key,n,key_test);\n\t\tBF_ecb_encrypt(key_data,out,&key,BF_ENCRYPT);\n\t\tif (memcmp(out,&(key_out[n-1][0]),8) != 0)\n\t\t\t{\n\t\t\tprintf("blowfish setkey error\\n");\n\t\t\terr=1;\n\t\t\t}\n\t\t}\n\tprintf("testing blowfish in cbc mode\\n");\n\tlen=strlen(cbc_data)+1;\n\tBF_set_key(&key,16,cbc_key);\n\tmemset(cbc_in,0,40);\n\tmemset(cbc_out,0,40);\n\tmemcpy(iv,cbc_iv,8);\n\tBF_cbc_encrypt((unsigned char *)cbc_data,cbc_out,len,\n\t\t&key,iv,BF_ENCRYPT);\n\tif (memcmp(cbc_out,cbc_ok,32) != 0)\n\t\t{\n\t\terr=1;\n\t\tprintf("BF_cbc_encrypt encrypt error\\n");\n\t\tfor (i=0; i<32; i++) printf("0x%02X,",cbc_out[i]);\n\t\t}\n\tmemcpy(iv,cbc_iv,8);\n\tBF_cbc_encrypt(cbc_out,cbc_in,len,\n\t\t&key,iv,BF_DECRYPT);\n\tif (memcmp(cbc_in,cbc_data,strlen(cbc_data)+1) != 0)\n\t\t{\n\t\tprintf("BF_cbc_encrypt decrypt error\\n");\n\t\terr=1;\n\t\t}\n\tprintf("testing blowfish in cfb64 mode\\n");\n\tBF_set_key(&key,16,cbc_key);\n\tmemset(cbc_in,0,40);\n\tmemset(cbc_out,0,40);\n\tmemcpy(iv,cbc_iv,8);\n\tn=0;\n\tBF_cfb64_encrypt((unsigned char *)cbc_data,cbc_out,(long)13,\n\t\t&key,iv,&n,BF_ENCRYPT);\n\tBF_cfb64_encrypt((unsigned char *)&(cbc_data[13]),&(cbc_out[13]),len-13,\n\t\t&key,iv,&n,BF_ENCRYPT);\n\tif (memcmp(cbc_out,cfb64_ok,(int)len) != 0)\n\t\t{\n\t\terr=1;\n\t\tprintf("BF_cfb64_encrypt encrypt error\\n");\n\t\tfor (i=0; i<(int)len; i++) printf("0x%02X,",cbc_out[i]);\n\t\t}\n\tn=0;\n\tmemcpy(iv,cbc_iv,8);\n\tBF_cfb64_encrypt(cbc_out,cbc_in,17,\n\t\t&key,iv,&n,BF_DECRYPT);\n\tBF_cfb64_encrypt(&(cbc_out[17]),&(cbc_in[17]),len-17,\n\t\t&key,iv,&n,BF_DECRYPT);\n\tif (memcmp(cbc_in,cbc_data,(int)len) != 0)\n\t\t{\n\t\tprintf("BF_cfb64_encrypt decrypt error\\n");\n\t\terr=1;\n\t\t}\n\tprintf("testing blowfish in ofb64\\n");\n\tBF_set_key(&key,16,cbc_key);\n\tmemset(cbc_in,0,40);\n\tmemset(cbc_out,0,40);\n\tmemcpy(iv,cbc_iv,8);\n\tn=0;\n\tBF_ofb64_encrypt((unsigned char *)cbc_data,cbc_out,(long)13,&key,iv,&n);\n\tBF_ofb64_encrypt((unsigned char *)&(cbc_data[13]),\n\t\t&(cbc_out[13]),len-13,&key,iv,&n);\n\tif (memcmp(cbc_out,ofb64_ok,(int)len) != 0)\n\t\t{\n\t\terr=1;\n\t\tprintf("BF_ofb64_encrypt encrypt error\\n");\n\t\tfor (i=0; i<(int)len; i++) printf("0x%02X,",cbc_out[i]);\n\t\t}\n\tn=0;\n\tmemcpy(iv,cbc_iv,8);\n\tBF_ofb64_encrypt(cbc_out,cbc_in,17,&key,iv,&n);\n\tBF_ofb64_encrypt(&(cbc_out[17]),&(cbc_in[17]),len-17,&key,iv,&n);\n\tif (memcmp(cbc_in,cbc_data,(int)len) != 0)\n\t\t{\n\t\tprintf("BF_ofb64_encrypt decrypt error\\n");\n\t\terr=1;\n\t\t}\n\treturn(err);\n\t}', 'void BF_set_key(BF_KEY *key, int len, unsigned char *data)\n\t{\n\tint i;\n\tBF_LONG *p,ri,in[2];\n\tunsigned char *d,*end;\n\tmemcpy((char *)key,(char *)&bf_init,sizeof(BF_KEY));\n\tp=key->P;\n\tif (len > ((BF_ROUNDS+2)*4)) len=(BF_ROUNDS+2)*4;\n\td=data;\n\tend= &(data[len]);\n\tfor (i=0; i<(BF_ROUNDS+2); i++)\n\t\t{\n\t\tri= *(d++);\n\t\tif (d >= end) d=data;\n\t\tri<<=8;\n\t\tri|= *(d++);\n\t\tif (d >= end) d=data;\n\t\tri<<=8;\n\t\tri|= *(d++);\n\t\tif (d >= end) d=data;\n\t\tri<<=8;\n\t\tri|= *(d++);\n\t\tif (d >= end) d=data;\n\t\tp[i]^=ri;\n\t\t}\n\tin[0]=0L;\n\tin[1]=0L;\n\tfor (i=0; i<(BF_ROUNDS+2); i+=2)\n\t\t{\n\t\tBF_encrypt(in,key);\n\t\tp[i  ]=in[0];\n\t\tp[i+1]=in[1];\n\t\t}\n\tp=key->S;\n\tfor (i=0; i<4*256; i+=2)\n\t\t{\n\t\tBF_encrypt(in,key);\n\t\tp[i  ]=in[0];\n\t\tp[i+1]=in[1];\n\t\t}\n\t}']