crypto/pem/pvkfmt.c:909: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned64 by call to `EVP_DecryptUpdate`.
Showing all 6 steps of the trace


crypto/pem/pvkfmt.c:909:3: Call
907.   		EVP_EncryptInit_ex(&cctx, EVP_rc4(), NULL, keybuf, NULL);
908.   		OPENSSL_cleanse(keybuf, 20);
909.   		EVP_DecryptUpdate(&cctx, p, &enctmplen, p, pklen - 8);
         ^
910.   		EVP_DecryptFinal_ex(&cctx, p + enctmplen, &enctmplen);
911.   		EVP_CIPHER_CTX_cleanup(&cctx);

crypto/evp/evp_enc.c:386:1: Parameter `ctx->cipher->block_size`
  384.   	}
  385.   
  386. > int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
  387.   		      const unsigned char *in, size_t inl)
  388.   	{

crypto/evp/evp_enc.c:399:10: Call
  397.   
  398.   	if (ctx->flags & EVP_CIPH_NO_PADDING)
  399.   		return EVP_EncryptUpdate(ctx, out, outl, in, inl);
                  ^
  400.   
  401.   	b=ctx->cipher->block_size;

crypto/evp/evp_enc.c:278:1: <LHS trace>
276.   	}
277.   
278. > int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
279.   		      const unsigned char *in, size_t inl)
280.   	{

crypto/evp/evp_enc.c:278:1: Parameter `inl`
    276.   	}
    277.   
    278. > int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
    279.   		      const unsigned char *in, size_t inl)
    280.   	{

crypto/evp/evp_enc.c:329:2: Binary operation: ([0, +oo] - 1):unsigned64 by call to `EVP_DecryptUpdate` 
    327.   	else
    328.   		*outl = 0;
    329.   	i=inl&(bl-1);
            ^
    330.   	inl-=i;
    331.   	if (inl > 0)

int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
		      const unsigned char *in, size_t inl)
	{
	size_t i;
	size_t bl;
	size_t j;
	if (inl <= 0)
		{
		*outl = 0;
		return inl == 0;
		}
	if(ctx->buf_len == 0 && (inl&(ctx->block_mask)) == 0)
		{
		if(ctx->cipher->do_cipher(ctx,out,in,inl))
			{
			*outl=inl;
			return 1;
			}
		else
			{
			*outl=0;
			return 0;
			}
		}
	i=ctx->buf_len;
	bl=ctx->cipher->block_size;
	OPENSSL_assert(bl <= (int)sizeof(ctx->buf));
	if (i != 0)
		{
		if (i+inl < bl)
			{
			memcpy(&(ctx->buf[i]),in,inl);
			ctx->buf_len+=inl;
			*outl=0;
			return 1;
			}
		else
			{
			j=bl-i;
			memcpy(&(ctx->buf[i]),in,j);
			if(!ctx->cipher->do_cipher(ctx,out,ctx->buf,bl)) return 0;
			inl-=j;
			in+=j;
			out+=bl;
			*outl=bl;
			}
		}
	else
		*outl = 0;
	i=inl&(bl-1);
	inl-=i;
	if (inl > 0)
		{
		if(!ctx->cipher->do_cipher(ctx,out,in,inl)) return 0;
		*outl+=inl;
		}
	if (i != 0)
		memcpy(ctx->buf,&(in[inl]),i);
	ctx->buf_len=i;
	return 1;
	}
['static int i2b_PVK(unsigned char **out, EVP_PKEY*pk, int enclevel,\n\t\tpem_password_cb *cb, void *u)\n\t{\n\tint outlen = 24, noinc, pklen;\n\tunsigned char *p, *salt = NULL;\n\tif (enclevel)\n\t\toutlen += PVK_SALTLEN;\n\tpklen = do_i2b(NULL, pk, 0);\n\tif (pklen < 0)\n\t\treturn -1;\n\toutlen += pklen;\n\tif (!out)\n\t\treturn outlen;\n\tif (*out)\n\t\t{\n\t\tp = *out;\n\t\tnoinc = 0;\n\t\t}\n\telse\n\t\t{\n\t\tp = OPENSSL_malloc(outlen);\n\t\tif (!p)\n\t\t\t{\n\t\t\tPEMerr(PEM_F_I2B_PVK,ERR_R_MALLOC_FAILURE);\n\t\t\treturn -1;\n\t\t\t}\n\t\t*out = p;\n\t\tnoinc = 1;\n\t\t}\n\twrite_ledword(&p, MS_PVKMAGIC);\n\twrite_ledword(&p, 0);\n\tif (pk->type == EVP_PKEY_DSA)\n\t\twrite_ledword(&p, MS_KEYTYPE_SIGN);\n\telse\n\t\twrite_ledword(&p, MS_KEYTYPE_KEYX);\n\twrite_ledword(&p, enclevel ? 1 : 0);\n\twrite_ledword(&p, enclevel ? PVK_SALTLEN: 0);\n\twrite_ledword(&p, pklen);\n\tif (enclevel)\n\t\t{\n\t\tif (RAND_bytes(p, PVK_SALTLEN) <= 0)\n\t\t\tgoto error;\n\t\tsalt = p;\n\t\tp += PVK_SALTLEN;\n\t\t}\n\tdo_i2b(&p, pk, 0);\n\tif (enclevel == 0)\n\t\treturn outlen;\n\telse\n\t\t{\n\t\tchar psbuf[PEM_BUFSIZE];\n\t\tunsigned char keybuf[20];\n\t\tEVP_CIPHER_CTX cctx;\n\t\tint enctmplen, inlen;\n\t\tif (cb)\n\t\t\tinlen=cb(psbuf,PEM_BUFSIZE,1,u);\n\t\telse\n\t\t\tinlen=PEM_def_callback(psbuf,PEM_BUFSIZE,1,u);\n\t\tif (inlen <= 0)\n\t\t\t{\n\t\t\tPEMerr(PEM_F_I2B_PVK,PEM_R_BAD_PASSWORD_READ);\n\t\t\tgoto error;\n\t\t\t}\n\t\tif (!derive_pvk_key(keybuf, salt, PVK_SALTLEN,\n\t\t\t    (unsigned char *)psbuf, inlen))\n\t\t\tgoto error;\n\t\tif (enclevel == 1)\n\t\t\tmemset(keybuf + 5, 0, 11);\n\t\tp = salt + PVK_SALTLEN + 8;\n\t\tEVP_CIPHER_CTX_init(&cctx);\n\t\tEVP_EncryptInit_ex(&cctx, EVP_rc4(), NULL, keybuf, NULL);\n\t\tOPENSSL_cleanse(keybuf, 20);\n\t\tEVP_DecryptUpdate(&cctx, p, &enctmplen, p, pklen - 8);\n\t\tEVP_DecryptFinal_ex(&cctx, p + enctmplen, &enctmplen);\n\t\tEVP_CIPHER_CTX_cleanup(&cctx);\n\t\t}\n\treturn outlen;\n\terror:\n\treturn -1;\n\t}', 'int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,\n\t\t      const unsigned char *in, size_t inl)\n\t{\n\tint fix_len;\n\tunsigned int b;\n\tif (inl <= 0)\n\t\t{\n\t\t*outl = 0;\n\t\treturn inl == 0;\n\t\t}\n\tif (ctx->flags & EVP_CIPH_NO_PADDING)\n\t\treturn EVP_EncryptUpdate(ctx, out, outl, in, inl);\n\tb=ctx->cipher->block_size;\n\tOPENSSL_assert(b <= sizeof ctx->final);\n\tif(ctx->final_used)\n\t\t{\n\t\tmemcpy(out,ctx->final,b);\n\t\tout+=b;\n\t\tfix_len = 1;\n\t\t}\n\telse\n\t\tfix_len = 0;\n\tif(!EVP_EncryptUpdate(ctx,out,outl,in,inl))\n\t\treturn 0;\n\tif (b > 1 && !ctx->buf_len)\n\t\t{\n\t\t*outl-=b;\n\t\tctx->final_used=1;\n\t\tmemcpy(ctx->final,&out[*outl],b);\n\t\t}\n\telse\n\t\tctx->final_used = 0;\n\tif (fix_len)\n\t\t*outl += b;\n\treturn 1;\n\t}', 'int EVP_EncryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,\n\t\t      const unsigned char *in, size_t inl)\n\t{\n\tsize_t i;\n\tsize_t bl;\n\tsize_t j;\n\tif (inl <= 0)\n\t\t{\n\t\t*outl = 0;\n\t\treturn inl == 0;\n\t\t}\n\tif(ctx->buf_len == 0 && (inl&(ctx->block_mask)) == 0)\n\t\t{\n\t\tif(ctx->cipher->do_cipher(ctx,out,in,inl))\n\t\t\t{\n\t\t\t*outl=inl;\n\t\t\treturn 1;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\t*outl=0;\n\t\t\treturn 0;\n\t\t\t}\n\t\t}\n\ti=ctx->buf_len;\n\tbl=ctx->cipher->block_size;\n\tOPENSSL_assert(bl <= (int)sizeof(ctx->buf));\n\tif (i != 0)\n\t\t{\n\t\tif (i+inl < bl)\n\t\t\t{\n\t\t\tmemcpy(&(ctx->buf[i]),in,inl);\n\t\t\tctx->buf_len+=inl;\n\t\t\t*outl=0;\n\t\t\treturn 1;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tj=bl-i;\n\t\t\tmemcpy(&(ctx->buf[i]),in,j);\n\t\t\tif(!ctx->cipher->do_cipher(ctx,out,ctx->buf,bl)) return 0;\n\t\t\tinl-=j;\n\t\t\tin+=j;\n\t\t\tout+=bl;\n\t\t\t*outl=bl;\n\t\t\t}\n\t\t}\n\telse\n\t\t*outl = 0;\n\ti=inl&(bl-1);\n\tinl-=i;\n\tif (inl > 0)\n\t\t{\n\t\tif(!ctx->cipher->do_cipher(ctx,out,in,inl)) return 0;\n\t\t*outl+=inl;\n\t\t}\n\tif (i != 0)\n\t\tmemcpy(ctx->buf,&(in[inl]),i);\n\tctx->buf_len=i;\n\treturn 1;\n\t}']