crypto/rand/drbg_rand.c:179: error: INTEGER_OVERFLOW_L2
  ([1, `in1len`] - 8):unsigned64 by call to `ctr_BCC_update`.
Showing all 7 steps of the trace


crypto/rand/drbg_rand.c:150:1: Parameter `in1len`
148.   }
149.   
150. > static void ctr_df(RAND_DRBG_CTR *ctr,
151.                      const unsigned char *in1, size_t in1len,
152.                      const unsigned char *in2, size_t in2len,

crypto/rand/drbg_rand.c:179:5: Call
177.       *p = (unsigned char)((ctr->keylen + 16) & 0xff);
178.       ctr->bltmp_pos = 8;
179.       ctr_BCC_update(ctr, in1, in1len);
           ^
180.       ctr_BCC_update(ctr, in2, in2len);
181.       ctr_BCC_update(ctr, in3, in3len);

crypto/rand/drbg_rand.c:110:1: <LHS trace>
108.    * Process several blocks into BCC algorithm, some possibly partial
109.    */
110. > static void ctr_BCC_update(RAND_DRBG_CTR *ctr,
111.                              const unsigned char *in, size_t inlen)
112.   {

crypto/rand/drbg_rand.c:110:1: Parameter `inlen`
  108.    * Process several blocks into BCC algorithm, some possibly partial
  109.    */
  110. > static void ctr_BCC_update(RAND_DRBG_CTR *ctr,
  111.                              const unsigned char *in, size_t inlen)
  112.   {

crypto/rand/drbg_rand.c:110:1: <RHS trace>
108.    * Process several blocks into BCC algorithm, some possibly partial
109.    */
110. > static void ctr_BCC_update(RAND_DRBG_CTR *ctr,
111.                              const unsigned char *in, size_t inlen)
112.   {

crypto/rand/drbg_rand.c:110:1: Parameter `inlen`
  108.    * Process several blocks into BCC algorithm, some possibly partial
  109.    */
  110. > static void ctr_BCC_update(RAND_DRBG_CTR *ctr,
  111.                              const unsigned char *in, size_t inlen)
  112.   {

crypto/rand/drbg_rand.c:125:13: Binary operation: ([1, in1len] - 8):unsigned64 by call to `ctr_BCC_update` 
  123.               ctr_BCC_blocks(ctr, ctr->bltmp);
  124.               ctr->bltmp_pos = 0;
  125.               inlen -= left;
                     ^
  126.               in += left;
  127.           }

static void ctr_BCC_update(RAND_DRBG_CTR *ctr,
                           const unsigned char *in, size_t inlen)
{
    if (in == NULL || inlen == 0)
        return;
    if (ctr->bltmp_pos) {
        size_t left = 16 - ctr->bltmp_pos;
        if (inlen >= left) {
            memcpy(ctr->bltmp + ctr->bltmp_pos, in, left);
            ctr_BCC_blocks(ctr, ctr->bltmp);
            ctr->bltmp_pos = 0;
            inlen -= left;
            in += left;
        }
    }
    for (; inlen >= 16; in += 16, inlen -= 16) {
        ctr_BCC_blocks(ctr, in);
    }
    if (inlen > 0) {
        memcpy(ctr->bltmp + ctr->bltmp_pos, in, inlen);
        ctr->bltmp_pos += inlen;
    }
}
['static void ctr_df(RAND_DRBG_CTR *ctr,\n                   const unsigned char *in1, size_t in1len,\n                   const unsigned char *in2, size_t in2len,\n                   const unsigned char *in3, size_t in3len)\n{\n    static unsigned char c80 = 0x80;\n    size_t inlen;\n    unsigned char *p = ctr->bltmp;\n    ctr_BCC_init(ctr);\n    if (in1 == NULL)\n        in1len = 0;\n    if (in2 == NULL)\n        in2len = 0;\n    if (in3 == NULL)\n        in3len = 0;\n    inlen = in1len + in2len + in3len;\n    *p++ = (inlen >> 24) & 0xff;\n    *p++ = (inlen >> 16) & 0xff;\n    *p++ = (inlen >> 8) & 0xff;\n    *p++ = inlen & 0xff;\n    *p++ = 0;\n    *p++ = 0;\n    *p++ = 0;\n    *p = (unsigned char)((ctr->keylen + 16) & 0xff);\n    ctr->bltmp_pos = 8;\n    ctr_BCC_update(ctr, in1, in1len);\n    ctr_BCC_update(ctr, in2, in2len);\n    ctr_BCC_update(ctr, in3, in3len);\n    ctr_BCC_update(ctr, &c80, 1);\n    ctr_BCC_final(ctr);\n    AES_set_encrypt_key(ctr->KX, ctr->keylen * 8, &ctr->df_kxks);\n    AES_encrypt(ctr->KX + ctr->keylen, ctr->KX, &ctr->df_kxks);\n    AES_encrypt(ctr->KX, ctr->KX + 16, &ctr->df_kxks);\n    if (ctr->keylen != 16)\n        AES_encrypt(ctr->KX + 16, ctr->KX + 32, &ctr->df_kxks);\n}', 'static void ctr_BCC_update(RAND_DRBG_CTR *ctr,\n                           const unsigned char *in, size_t inlen)\n{\n    if (in == NULL || inlen == 0)\n        return;\n    if (ctr->bltmp_pos) {\n        size_t left = 16 - ctr->bltmp_pos;\n        if (inlen >= left) {\n            memcpy(ctr->bltmp + ctr->bltmp_pos, in, left);\n            ctr_BCC_blocks(ctr, ctr->bltmp);\n            ctr->bltmp_pos = 0;\n            inlen -= left;\n            in += left;\n        }\n    }\n    for (; inlen >= 16; in += 16, inlen -= 16) {\n        ctr_BCC_blocks(ctr, in);\n    }\n    if (inlen > 0) {\n        memcpy(ctr->bltmp + ctr->bltmp_pos, in, inlen);\n        ctr->bltmp_pos += inlen;\n    }\n}']