crypto/camellia/cmll_cfb.c:217: error: BUFFER_OVERRUN_L2
  Offset: [0, 15] Size: 1 by call to `Camellia_cfbr_encrypt_block`.
Showing all 7 steps of the trace


crypto/camellia/cmll_cfb.c:203:1: Array declaration
201.   
202.   /* N.B. This expects the input to be packed, MS bit first */
203. > void Camellia_cfb1_encrypt(const unsigned char *in, unsigned char *out,
204.   	size_t length, const CAMELLIA_KEY *key,
205.   	unsigned char *ivec, int *num, const int enc)

crypto/camellia/cmll_cfb.c:217:3: Call
215.   		{
216.   		c[0]=(in[n/8]&(1 << (7-n%8))) ? 0x80 : 0;
217.   		Camellia_cfbr_encrypt_block(c,d,1,key,ivec,enc);
         ^
218.   		out[n/8]=(out[n/8]&~(1 << (7-n%8)))|((d[0]&0x80) >> (n%8));
219.   		}

crypto/camellia/cmll_cfb.c:185:7: <Offset trace>
183.   	num = (nbits+7)/8;
184.   	if (enc)	/* encrypt the input */
185.   		for(n=0 ; n < num ; ++n)
             ^
186.   			out[n] = (ovec[CAMELLIA_BLOCK_SIZE+n] = in[n] ^ ivec[n]);
187.   	else		/* decrypt the input */

crypto/camellia/cmll_cfb.c:185:7: Assignment
  183.   	num = (nbits+7)/8;
  184.   	if (enc)	/* encrypt the input */
  185.   		for(n=0 ; n < num ; ++n)
               ^
  186.   			out[n] = (ovec[CAMELLIA_BLOCK_SIZE+n] = in[n] ^ ivec[n]);
  187.   	else		/* decrypt the input */

crypto/camellia/cmll_cfb.c:170:1: <Length trace>
168.   /* This expects a single block of size nbits for both in and out. Note that
169.      it corrupts any extra bits in the last byte of out */
170. > void Camellia_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,
171.   	const int nbits,const CAMELLIA_KEY *key,
172.   	unsigned char *ivec,const int enc)

crypto/camellia/cmll_cfb.c:170:1: Parameter `*out`
  168.   /* This expects a single block of size nbits for both in and out. Note that
  169.      it corrupts any extra bits in the last byte of out */
  170. > void Camellia_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,
  171.   	const int nbits,const CAMELLIA_KEY *key,
  172.   	unsigned char *ivec,const int enc)

crypto/camellia/cmll_cfb.c:186:4: Array access: Offset: [0, 15] Size: 1 by call to `Camellia_cfbr_encrypt_block` 
  184.   	if (enc)	/* encrypt the input */
  185.   		for(n=0 ; n < num ; ++n)
  186.   			out[n] = (ovec[CAMELLIA_BLOCK_SIZE+n] = in[n] ^ ivec[n]);
            ^
  187.   	else		/* decrypt the input */
  188.   		for(n=0 ; n < num ; ++n)

void Camellia_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,
	const int nbits,const CAMELLIA_KEY *key,
	unsigned char *ivec,const int enc)
	{
	int n,rem,num;
	unsigned char ovec[CAMELLIA_BLOCK_SIZE*2];
	if (nbits<=0 || nbits>128) return;
	memcpy(ovec,ivec,CAMELLIA_BLOCK_SIZE);
	Camellia_encrypt(ivec,ivec,key);
	num = (nbits+7)/8;
	if (enc)
		for(n=0 ; n < num ; ++n)
			out[n] = (ovec[CAMELLIA_BLOCK_SIZE+n] = in[n] ^ ivec[n]);
	else
		for(n=0 ; n < num ; ++n)
			out[n] = (ovec[CAMELLIA_BLOCK_SIZE+n] = in[n]) ^ ivec[n];
	rem = nbits%8;
	num = nbits/8;
	if(rem==0)
		memcpy(ivec,ovec+num,CAMELLIA_BLOCK_SIZE);
	else
		for(n=0 ; n < CAMELLIA_BLOCK_SIZE ; ++n)
			ivec[n] = ovec[n+num]<<rem | ovec[n+num+1]>>(8-rem);
	}
['void Camellia_cfb1_encrypt(const unsigned char *in, unsigned char *out,\n\tsize_t length, const CAMELLIA_KEY *key,\n\tunsigned char *ivec, int *num, const int enc)\n\t{\n\tsize_t n;\n\tunsigned char c[1],d[1];\n\tassert(in && out && key && ivec && num);\n\tassert(*num == 0);\n\tmemset(out,0,(length+7)/8);\n\tfor(n=0 ; n < length ; ++n)\n\t\t{\n\t\tc[0]=(in[n/8]&(1 << (7-n%8))) ? 0x80 : 0;\n\t\tCamellia_cfbr_encrypt_block(c,d,1,key,ivec,enc);\n\t\tout[n/8]=(out[n/8]&~(1 << (7-n%8)))|((d[0]&0x80) >> (n%8));\n\t\t}\n\t}', 'void Camellia_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,\n\tconst int nbits,const CAMELLIA_KEY *key,\n\tunsigned char *ivec,const int enc)\n\t{\n\tint n,rem,num;\n\tunsigned char ovec[CAMELLIA_BLOCK_SIZE*2];\n\tif (nbits<=0 || nbits>128) return;\n\tmemcpy(ovec,ivec,CAMELLIA_BLOCK_SIZE);\n\tCamellia_encrypt(ivec,ivec,key);\n\tnum = (nbits+7)/8;\n\tif (enc)\n\t\tfor(n=0 ; n < num ; ++n)\n\t\t\tout[n] = (ovec[CAMELLIA_BLOCK_SIZE+n] = in[n] ^ ivec[n]);\n\telse\n\t\tfor(n=0 ; n < num ; ++n)\n\t\t\tout[n] = (ovec[CAMELLIA_BLOCK_SIZE+n] = in[n]) ^ ivec[n];\n\trem = nbits%8;\n\tnum = nbits/8;\n\tif(rem==0)\n\t\tmemcpy(ivec,ovec+num,CAMELLIA_BLOCK_SIZE);\n\telse\n\t\tfor(n=0 ; n < CAMELLIA_BLOCK_SIZE ; ++n)\n\t\t\tivec[n] = ovec[n+num]<<rem | ovec[n+num+1]>>(8-rem);\n\t}']