crypto/idea/i_skey.c:118: error: BUFFER_OVERRUN_L1
  Offset: [-oo, -2] (⇐ [-oo, -6] + 4) Size: 6.
Showing all 5 steps of the trace


crypto/idea/i_skey.c:103:1: <Length trace>
101.   }
102.   
103. > void idea_set_decrypt_key(IDEA_KEY_SCHEDULE *ek, IDEA_KEY_SCHEDULE *dk)
104.   {
105.       int r;

crypto/idea/i_skey.c:103:1: Parameter `ek->data[*][*]`
101.   }
102.   
103. > void idea_set_decrypt_key(IDEA_KEY_SCHEDULE *ek, IDEA_KEY_SCHEDULE *dk)
104.   {
105.       int r;

crypto/idea/i_skey.c:109:5: Assignment
107.   
108.       tp = &(dk->data[0][0]);
109.       fp = &(ek->data[8][0]);
           ^
110.       for (r = 0; r < 9; r++) {
111.           *(tp++) = inverse(fp[0]);

crypto/idea/i_skey.c:117:9: Assignment
115.           if (r == 8)
116.               break;
117.           fp -= 6;
               ^
118.           *(tp++) = fp[4];
119.           *(tp++) = fp[5];

crypto/idea/i_skey.c:118:19: Array access: Offset: [-oo, -2] (⇐ [-oo, -6] + 4) Size: 6
116.               break;
117.           fp -= 6;
118.           *(tp++) = fp[4];
                         ^
119.           *(tp++) = fp[5];
120.       }

void idea_set_decrypt_key(IDEA_KEY_SCHEDULE *ek, IDEA_KEY_SCHEDULE *dk)
{
    int r;
    register IDEA_INT *fp, *tp, t;
    tp = &(dk->data[0][0]);
    fp = &(ek->data[8][0]);
    for (r = 0; r < 9; r++) {
        *(tp++) = inverse(fp[0]);
        *(tp++) = ((int)(0x10000L - fp[2]) & 0xffff);
        *(tp++) = ((int)(0x10000L - fp[1]) & 0xffff);
        *(tp++) = inverse(fp[3]);
        if (r == 8)
            break;
        fp -= 6;
        *(tp++) = fp[4];
        *(tp++) = fp[5];
    }
    tp = &(dk->data[0][0]);
    t = tp[1];
    tp[1] = tp[2];
    tp[2] = t;
    t = tp[49];
    tp[49] = tp[50];
    tp[50] = t;
}
['void idea_set_decrypt_key(IDEA_KEY_SCHEDULE *ek, IDEA_KEY_SCHEDULE *dk)\n{\n    int r;\n    register IDEA_INT *fp, *tp, t;\n    tp = &(dk->data[0][0]);\n    fp = &(ek->data[8][0]);\n    for (r = 0; r < 9; r++) {\n        *(tp++) = inverse(fp[0]);\n        *(tp++) = ((int)(0x10000L - fp[2]) & 0xffff);\n        *(tp++) = ((int)(0x10000L - fp[1]) & 0xffff);\n        *(tp++) = inverse(fp[3]);\n        if (r == 8)\n            break;\n        fp -= 6;\n        *(tp++) = fp[4];\n        *(tp++) = fp[5];\n    }\n    tp = &(dk->data[0][0]);\n    t = tp[1];\n    tp[1] = tp[2];\n    tp[2] = t;\n    t = tp[49];\n    tp[49] = tp[50];\n    tp[50] = t;\n}']