crypto/idea/i_skey.c:117: error: BUFFER_OVERRUN_L1
  Offset: [-oo, -2] (⇐ [-oo, -6] + 4) Size: 6.
Showing all 5 steps of the trace


crypto/idea/i_skey.c:102:1: <Length trace>
100.   	}
101.   
102. > void idea_set_decrypt_key(IDEA_KEY_SCHEDULE *ek, IDEA_KEY_SCHEDULE *dk)
103.   	{
104.   	int r;

crypto/idea/i_skey.c:102:1: Parameter `ek->data[*][*]`
100.   	}
101.   
102. > void idea_set_decrypt_key(IDEA_KEY_SCHEDULE *ek, IDEA_KEY_SCHEDULE *dk)
103.   	{
104.   	int r;

crypto/idea/i_skey.c:108:2: Assignment
106.   
107.   	tp= &(dk->data[0][0]);
108.   	fp= &(ek->data[8][0]);
        ^
109.   	for (r=0; r<9; r++)
110.   		{

crypto/idea/i_skey.c:116:3: Assignment
114.   		*(tp++)=inverse(fp[3]);
115.   		if (r == 8) break;
116.   		fp-=6;
         ^
117.   		*(tp++)=fp[4];
118.   		*(tp++)=fp[5];

crypto/idea/i_skey.c:117:11: Array access: Offset: [-oo, -2] (⇐ [-oo, -6] + 4) Size: 6
115.   		if (r == 8) break;
116.   		fp-=6;
117.   		*(tp++)=fp[4];
                 ^
118.   		*(tp++)=fp[5];
119.   		}

void idea_set_decrypt_key(IDEA_KEY_SCHEDULE *ek, IDEA_KEY_SCHEDULE *dk)
	{
	int r;
	register IDEA_INT *fp,*tp,t;
	tp= &(dk->data[0][0]);
	fp= &(ek->data[8][0]);
	for (r=0; r<9; r++)
		{
		*(tp++)=inverse(fp[0]);
		*(tp++)=((int)(0x10000L-fp[2])&0xffff);
		*(tp++)=((int)(0x10000L-fp[1])&0xffff);
		*(tp++)=inverse(fp[3]);
		if (r == 8) break;
		fp-=6;
		*(tp++)=fp[4];
		*(tp++)=fp[5];
		}
	tp= &(dk->data[0][0]);
	t=tp[1];
	tp[1]=tp[2];
	tp[2]=t;
	t=tp[49];
	tp[49]=tp[50];
	tp[50]=t;
	}
['void idea_set_decrypt_key(IDEA_KEY_SCHEDULE *ek, IDEA_KEY_SCHEDULE *dk)\n\t{\n\tint r;\n\tregister IDEA_INT *fp,*tp,t;\n\ttp= &(dk->data[0][0]);\n\tfp= &(ek->data[8][0]);\n\tfor (r=0; r<9; r++)\n\t\t{\n\t\t*(tp++)=inverse(fp[0]);\n\t\t*(tp++)=((int)(0x10000L-fp[2])&0xffff);\n\t\t*(tp++)=((int)(0x10000L-fp[1])&0xffff);\n\t\t*(tp++)=inverse(fp[3]);\n\t\tif (r == 8) break;\n\t\tfp-=6;\n\t\t*(tp++)=fp[4];\n\t\t*(tp++)=fp[5];\n\t\t}\n\ttp= &(dk->data[0][0]);\n\tt=tp[1];\n\ttp[1]=tp[2];\n\ttp[2]=t;\n\tt=tp[49];\n\ttp[49]=tp[50];\n\ttp[50]=t;\n\t}']