crypto/evp/e_aes.c:1764: error: BUFFER_OVERRUN_S2
  Offset added: [max(4, `arg`), min(16, `arg`)] Size: [0, +oo].
Showing all 5 steps of the trace


crypto/evp/e_aes.c:1734:1: <Offset trace>
1732.   BLOCK_CIPHER_custom(NID_aes,256,1,16,xts,XTS,EVP_CIPH_FLAG_FIPS|XTS_FLAGS)
1733.   
1734. > static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
1735.   	{
1736.   	EVP_AES_CCM_CTX *cctx = c->cipher_data;

crypto/evp/e_aes.c:1734:1: Parameter `arg`
1732.   BLOCK_CIPHER_custom(NID_aes,256,1,16,xts,XTS,EVP_CIPH_FLAG_FIPS|XTS_FLAGS)
1733.   
1734. > static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
1735.   	{
1736.   	EVP_AES_CCM_CTX *cctx = c->cipher_data;

crypto/evp/e_aes.c:1734:1: <Length trace>
1732.   BLOCK_CIPHER_custom(NID_aes,256,1,16,xts,XTS,EVP_CIPH_FLAG_FIPS|XTS_FLAGS)
1733.   
1734. > static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
1735.   	{
1736.   	EVP_AES_CCM_CTX *cctx = c->cipher_data;

crypto/evp/e_aes.c:1734:1: Parameter `c->buf[*]`
1732.   BLOCK_CIPHER_custom(NID_aes,256,1,16,xts,XTS,EVP_CIPH_FLAG_FIPS|XTS_FLAGS)
1733.   
1734. > static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
1735.   	{
1736.   	EVP_AES_CCM_CTX *cctx = c->cipher_data;

crypto/evp/e_aes.c:1764:4: Array access: Offset added: [max(4, arg), min(16, arg)] Size: [0, +oo]
1762.   			{
1763.   			cctx->tag_set = 1;
1764.   			memcpy(c->buf, ptr, arg);
           ^
1765.   			}
1766.   		cctx->M = arg;

static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
	{
	EVP_AES_CCM_CTX *cctx = c->cipher_data;
	switch (type)
		{
	case EVP_CTRL_INIT:
		cctx->key_set = 0;
		cctx->iv_set = 0;
		cctx->L = 8;
		cctx->M = 12;
		cctx->tag_set = 0;
		cctx->len_set = 0;
		return 1;
	case EVP_CTRL_CCM_SET_IVLEN:
		arg = 15 - arg;
	case EVP_CTRL_CCM_SET_L:
		if (arg < 2 || arg > 8)
			return 0;
		cctx->L = arg;
		return 1;
	case EVP_CTRL_CCM_SET_TAG:
		if ((arg & 1) || arg < 4 || arg > 16)
			return 0;
		if ((c->encrypt && ptr) || (!c->encrypt && !ptr))
			return 0;
		if (ptr)
			{
			cctx->tag_set = 1;
			memcpy(c->buf, ptr, arg);
			}
		cctx->M = arg;
		return 1;
	case EVP_CTRL_CCM_GET_TAG:
		if (!c->encrypt || !cctx->tag_set)
			return 0;
		if(!CRYPTO_ccm128_tag(&cctx->ccm, ptr, (size_t)arg))
			return 0;
		cctx->tag_set = 0;
		cctx->iv_set = 0;
		cctx->len_set = 0;
		return 1;
	default:
		return -1;
		}
	}
['static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)\n\t{\n\tEVP_AES_CCM_CTX *cctx = c->cipher_data;\n\tswitch (type)\n\t\t{\n\tcase EVP_CTRL_INIT:\n\t\tcctx->key_set = 0;\n\t\tcctx->iv_set = 0;\n\t\tcctx->L = 8;\n\t\tcctx->M = 12;\n\t\tcctx->tag_set = 0;\n\t\tcctx->len_set = 0;\n\t\treturn 1;\n\tcase EVP_CTRL_CCM_SET_IVLEN:\n\t\targ = 15 - arg;\n\tcase EVP_CTRL_CCM_SET_L:\n\t\tif (arg < 2 || arg > 8)\n\t\t\treturn 0;\n\t\tcctx->L = arg;\n\t\treturn 1;\n\tcase EVP_CTRL_CCM_SET_TAG:\n\t\tif ((arg & 1) || arg < 4 || arg > 16)\n\t\t\treturn 0;\n\t\tif ((c->encrypt && ptr) || (!c->encrypt && !ptr))\n\t\t\treturn 0;\n\t\tif (ptr)\n\t\t\t{\n\t\t\tcctx->tag_set = 1;\n\t\t\tmemcpy(c->buf, ptr, arg);\n\t\t\t}\n\t\tcctx->M = arg;\n\t\treturn 1;\n\tcase EVP_CTRL_CCM_GET_TAG:\n\t\tif (!c->encrypt || !cctx->tag_set)\n\t\t\treturn 0;\n\t\tif(!CRYPTO_ccm128_tag(&cctx->ccm, ptr, (size_t)arg))\n\t\t\treturn 0;\n\t\tcctx->tag_set = 0;\n\t\tcctx->iv_set = 0;\n\t\tcctx->len_set = 0;\n\t\treturn 1;\n\tdefault:\n\t\treturn -1;\n\t\t}\n\t}']