crypto/evp/e_aes.c:1918: error: BUFFER_OVERRUN_S2
  Offset added: [max(4, `arg`), min(16, `arg`)] Size: [0, +oo].
Showing all 5 steps of the trace


crypto/evp/e_aes.c:1862:1: <Offset trace>
1860.       BLOCK_CIPHER_custom(NID_aes, 256, 1, 16, xts, XTS, XTS_FLAGS)
1861.   
1862. > static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
1863.   {
1864.       EVP_AES_CCM_CTX *cctx = c->cipher_data;

crypto/evp/e_aes.c:1862:1: Parameter `arg`
1860.       BLOCK_CIPHER_custom(NID_aes, 256, 1, 16, xts, XTS, XTS_FLAGS)
1861.   
1862. > static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
1863.   {
1864.       EVP_AES_CCM_CTX *cctx = c->cipher_data;

crypto/evp/e_aes.c:1862:1: <Length trace>
1860.       BLOCK_CIPHER_custom(NID_aes, 256, 1, 16, xts, XTS, XTS_FLAGS)
1861.   
1862. > static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
1863.   {
1864.       EVP_AES_CCM_CTX *cctx = c->cipher_data;

crypto/evp/e_aes.c:1862:1: Parameter `c->buf[*]`
1860.       BLOCK_CIPHER_custom(NID_aes, 256, 1, 16, xts, XTS, XTS_FLAGS)
1861.   
1862. > static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
1863.   {
1864.       EVP_AES_CCM_CTX *cctx = c->cipher_data;

crypto/evp/e_aes.c:1918:13: Array access: Offset added: [max(4, arg), min(16, arg)] Size: [0, +oo]
1916.           if (ptr) {
1917.               cctx->tag_set = 1;
1918.               memcpy(c->buf, ptr, arg);
                    ^
1919.           }
1920.           cctx->M = arg;

static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
{
    EVP_AES_CCM_CTX *cctx = c->cipher_data;
    switch (type) {
    case EVP_CTRL_INIT:
        cctx->key_set = 0;
        cctx->iv_set = 0;
        cctx->L = 8;
        cctx->M = 12;
        cctx->tag_set = 0;
        cctx->len_set = 0;
        cctx->tls_aad_len = -1;
        return 1;
    case EVP_CTRL_AEAD_TLS1_AAD:
        if (arg != EVP_AEAD_TLS1_AAD_LEN)
            return 0;
        memcpy(c->buf, ptr, arg);
        cctx->tls_aad_len = arg;
        {
            uint16_t len = c->buf[arg - 2] << 8 | c->buf[arg - 1];
            len -= EVP_CCM_TLS_EXPLICIT_IV_LEN;
            if (!c->encrypt)
                len -= cctx->M;
            c->buf[arg - 2] = len >> 8;
            c->buf[arg - 1] = len & 0xff;
        }
        return cctx->M;
    case EVP_CTRL_CCM_SET_IV_FIXED:
        if (arg != EVP_CCM_TLS_FIXED_IV_LEN)
            return 0;
        memcpy(c->iv, ptr, arg);
        return 1;
    case EVP_CTRL_AEAD_SET_IVLEN:
        arg = 15 - arg;
    case EVP_CTRL_CCM_SET_L:
        if (arg < 2 || arg > 8)
            return 0;
        cctx->L = arg;
        return 1;
    case EVP_CTRL_AEAD_SET_TAG:
        if ((arg & 1) || arg < 4 || arg > 16)
            return 0;
        if (c->encrypt && ptr)
            return 0;
        if (ptr) {
            cctx->tag_set = 1;
            memcpy(c->buf, ptr, arg);
        }
        cctx->M = arg;
        return 1;
    case EVP_CTRL_AEAD_GET_TAG:
        if (!c->encrypt || !cctx->tag_set)
            return 0;
        if (!CRYPTO_ccm128_tag(&cctx->ccm, ptr, (size_t)arg))
            return 0;
        cctx->tag_set = 0;
        cctx->iv_set = 0;
        cctx->len_set = 0;
        return 1;
    case EVP_CTRL_COPY:
        {
            EVP_CIPHER_CTX *out = ptr;
            EVP_AES_CCM_CTX *cctx_out = out->cipher_data;
            if (cctx->ccm.key) {
                if (cctx->ccm.key != &cctx->ks)
                    return 0;
                cctx_out->ccm.key = &cctx_out->ks;
            }
            return 1;
        }
    default:
        return -1;
    }
}
['static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)\n{\n    EVP_AES_CCM_CTX *cctx = c->cipher_data;\n    switch (type) {\n    case EVP_CTRL_INIT:\n        cctx->key_set = 0;\n        cctx->iv_set = 0;\n        cctx->L = 8;\n        cctx->M = 12;\n        cctx->tag_set = 0;\n        cctx->len_set = 0;\n        cctx->tls_aad_len = -1;\n        return 1;\n    case EVP_CTRL_AEAD_TLS1_AAD:\n        if (arg != EVP_AEAD_TLS1_AAD_LEN)\n            return 0;\n        memcpy(c->buf, ptr, arg);\n        cctx->tls_aad_len = arg;\n        {\n            uint16_t len = c->buf[arg - 2] << 8 | c->buf[arg - 1];\n            len -= EVP_CCM_TLS_EXPLICIT_IV_LEN;\n            if (!c->encrypt)\n                len -= cctx->M;\n            c->buf[arg - 2] = len >> 8;\n            c->buf[arg - 1] = len & 0xff;\n        }\n        return cctx->M;\n    case EVP_CTRL_CCM_SET_IV_FIXED:\n        if (arg != EVP_CCM_TLS_FIXED_IV_LEN)\n            return 0;\n        memcpy(c->iv, ptr, arg);\n        return 1;\n    case EVP_CTRL_AEAD_SET_IVLEN:\n        arg = 15 - arg;\n    case EVP_CTRL_CCM_SET_L:\n        if (arg < 2 || arg > 8)\n            return 0;\n        cctx->L = arg;\n        return 1;\n    case EVP_CTRL_AEAD_SET_TAG:\n        if ((arg & 1) || arg < 4 || arg > 16)\n            return 0;\n        if (c->encrypt && ptr)\n            return 0;\n        if (ptr) {\n            cctx->tag_set = 1;\n            memcpy(c->buf, ptr, arg);\n        }\n        cctx->M = arg;\n        return 1;\n    case EVP_CTRL_AEAD_GET_TAG:\n        if (!c->encrypt || !cctx->tag_set)\n            return 0;\n        if (!CRYPTO_ccm128_tag(&cctx->ccm, ptr, (size_t)arg))\n            return 0;\n        cctx->tag_set = 0;\n        cctx->iv_set = 0;\n        cctx->len_set = 0;\n        return 1;\n    case EVP_CTRL_COPY:\n        {\n            EVP_CIPHER_CTX *out = ptr;\n            EVP_AES_CCM_CTX *cctx_out = out->cipher_data;\n            if (cctx->ccm.key) {\n                if (cctx->ccm.key != &cctx->ks)\n                    return 0;\n                cctx_out->ccm.key = &cctx_out->ks;\n            }\n            return 1;\n        }\n    default:\n        return -1;\n    }\n}']