crypto/evp/e_aes.c:2003: error: BUFFER_OVERRUN_L3
  Offset added: 8 Size: [0, +oo].
Showing all 3 steps of the trace


crypto/evp/e_aes.c:1993:1: <Length trace>
1991.   }
1992.   
1993. > static int aes_ccm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
1994.                                 const unsigned char *in, size_t len)
1995.   {

crypto/evp/e_aes.c:1993:1: Parameter `ctx->buf[*]`
1991.   }
1992.   
1993. > static int aes_ccm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
1994.                                 const unsigned char *in, size_t len)
1995.   {

crypto/evp/e_aes.c:2003:9: Array access: Offset added: 8 Size: [0, +oo]
2001.       /* If encrypting set explicit IV from sequence number (start of AAD) */
2002.       if (ctx->encrypt)
2003.           memcpy(out, ctx->buf, EVP_CCM_TLS_EXPLICIT_IV_LEN);
                ^
2004.       /* Get rest of IV from explicit IV */
2005.       memcpy(ctx->iv + EVP_CCM_TLS_FIXED_IV_LEN, in, EVP_CCM_TLS_EXPLICIT_IV_LEN);

static int aes_ccm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
                              const unsigned char *in, size_t len)
{
    EVP_AES_CCM_CTX *cctx = ctx->cipher_data;
    CCM128_CONTEXT *ccm = &cctx->ccm;
    if (out != in || len < (EVP_CCM_TLS_EXPLICIT_IV_LEN + (size_t)cctx->M))
        return -1;
    if (ctx->encrypt)
        memcpy(out, ctx->buf, EVP_CCM_TLS_EXPLICIT_IV_LEN);
    memcpy(ctx->iv + EVP_CCM_TLS_FIXED_IV_LEN, in, EVP_CCM_TLS_EXPLICIT_IV_LEN);
    len -= EVP_CCM_TLS_EXPLICIT_IV_LEN + cctx->M;
    if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L, len))
            return -1;
    CRYPTO_ccm128_aad(ccm, ctx->buf, cctx->tls_aad_len);
    in += EVP_CCM_TLS_EXPLICIT_IV_LEN;
    out += EVP_CCM_TLS_EXPLICIT_IV_LEN;
    if (ctx->encrypt) {
        if (cctx->str ? CRYPTO_ccm128_encrypt_ccm64(ccm, in, out, len,
                                                    cctx->str) :
            CRYPTO_ccm128_encrypt(ccm, in, out, len))
            return -1;
        if (!CRYPTO_ccm128_tag(ccm, out + len, cctx->M))
            return -1;
        return len + EVP_CCM_TLS_EXPLICIT_IV_LEN + cctx->M;
    } else {
        if (cctx->str ? !CRYPTO_ccm128_decrypt_ccm64(ccm, in, out, len,
                                                     cctx->str) :
            !CRYPTO_ccm128_decrypt(ccm, in, out, len)) {
            unsigned char tag[16];
            if (CRYPTO_ccm128_tag(ccm, tag, cctx->M)) {
                if (!CRYPTO_memcmp(tag, in + len, cctx->M))
                    return len;
            }
        }
        OPENSSL_cleanse(out, len);
        return -1;
    }
}
['static int aes_ccm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,\n                              const unsigned char *in, size_t len)\n{\n    EVP_AES_CCM_CTX *cctx = ctx->cipher_data;\n    CCM128_CONTEXT *ccm = &cctx->ccm;\n    if (out != in || len < (EVP_CCM_TLS_EXPLICIT_IV_LEN + (size_t)cctx->M))\n        return -1;\n    if (ctx->encrypt)\n        memcpy(out, ctx->buf, EVP_CCM_TLS_EXPLICIT_IV_LEN);\n    memcpy(ctx->iv + EVP_CCM_TLS_FIXED_IV_LEN, in, EVP_CCM_TLS_EXPLICIT_IV_LEN);\n    len -= EVP_CCM_TLS_EXPLICIT_IV_LEN + cctx->M;\n    if (CRYPTO_ccm128_setiv(ccm, ctx->iv, 15 - cctx->L, len))\n            return -1;\n    CRYPTO_ccm128_aad(ccm, ctx->buf, cctx->tls_aad_len);\n    in += EVP_CCM_TLS_EXPLICIT_IV_LEN;\n    out += EVP_CCM_TLS_EXPLICIT_IV_LEN;\n    if (ctx->encrypt) {\n        if (cctx->str ? CRYPTO_ccm128_encrypt_ccm64(ccm, in, out, len,\n                                                    cctx->str) :\n            CRYPTO_ccm128_encrypt(ccm, in, out, len))\n            return -1;\n        if (!CRYPTO_ccm128_tag(ccm, out + len, cctx->M))\n            return -1;\n        return len + EVP_CCM_TLS_EXPLICIT_IV_LEN + cctx->M;\n    } else {\n        if (cctx->str ? !CRYPTO_ccm128_decrypt_ccm64(ccm, in, out, len,\n                                                     cctx->str) :\n            !CRYPTO_ccm128_decrypt(ccm, in, out, len)) {\n            unsigned char tag[16];\n            if (CRYPTO_ccm128_tag(ccm, tag, cctx->M)) {\n                if (!CRYPTO_memcmp(tag, in + len, cctx->M))\n                    return len;\n            }\n        }\n        OPENSSL_cleanse(out, len);\n        return -1;\n    }\n}']