crypto/rc2/rc2_skey.c:136: error: BUFFER_OVERRUN_L3
  Offset: [-1, 126] Size: 256.
Showing all 6 steps of the trace


crypto/rc2/rc2_skey.c:135:7: <Offset trace>
133.   	/* copy from bytes into RC2_INT's */
134.   	ki= &(key->data[63]);
135.   	for (i=127; i>=0; i-=2)
             ^
136.   		*(ki--)=((k[i]<<8)|k[i-1])&0xffff;
137.   	}

crypto/rc2/rc2_skey.c:135:7: Assignment
133.   	/* copy from bytes into RC2_INT's */
134.   	ki= &(key->data[63]);
135.   	for (i=127; i>=0; i-=2)
             ^
136.   		*(ki--)=((k[i]<<8)|k[i-1])&0xffff;
137.   	}

crypto/rc2/rc2_skey.c:93:1: <Length trace>
91.    * the same as specifying 1024 for the 'bits' parameter.  Bsafe uses
92.    * a version where the bits parameter is the same as len*8 */
93. > void RC2_set_key(RC2_KEY *key, int len, unsigned char *data, int bits)
94.   	{
95.   	int i,j;

crypto/rc2/rc2_skey.c:93:1: Parameter `key->data[*]`
91.    * the same as specifying 1024 for the 'bits' parameter.  Bsafe uses
92.    * a version where the bits parameter is the same as len*8 */
93. > void RC2_set_key(RC2_KEY *key, int len, unsigned char *data, int bits)
94.   	{
95.   	int i,j;

crypto/rc2/rc2_skey.c:100:2: Assignment
98.   	unsigned int c,d;
99.   
100.   	k= (unsigned char *)&(key->data[0]);
        ^
101.   	*k=0; /* for if there is a zero length key */
102.   

crypto/rc2/rc2_skey.c:136:22: Array access: Offset: [-1, 126] Size: 256
134.   	ki= &(key->data[63]);
135.   	for (i=127; i>=0; i-=2)
136.   		*(ki--)=((k[i]<<8)|k[i-1])&0xffff;
                            ^
137.   	}
138.   

void RC2_set_key(RC2_KEY *key, int len, unsigned char *data, int bits)
	{
	int i,j;
	unsigned char *k;
	RC2_INT *ki;
	unsigned int c,d;
	k= (unsigned char *)&(key->data[0]);
	*k=0;
	if (len > 128) len=128;
	if (bits <= 0) bits=1024;
	if (bits > 1024) bits=1024;
	for (i=0; i<len; i++)
		k[i]=data[i];
	d=k[len-1];
	j=0;
	for (i=len; i < 128; i++,j++)
		{
		d=key_table[(k[j]+d)&0xff];
		k[i]=d;
		}
	j=(bits+7)>>3;
	i=128-j;
	c= (0xff>>(-bits & 0x07));
	d=key_table[k[i]&c];
	k[i]=d;
	while (i--)
		{
		d=key_table[k[i+j]^d];
		k[i]=d;
		}
	ki= &(key->data[63]);
	for (i=127; i>=0; i-=2)
		*(ki--)=((k[i]<<8)|k[i-1])&0xffff;
	}
['void RC2_set_key(RC2_KEY *key, int len, unsigned char *data, int bits)\n\t{\n\tint i,j;\n\tunsigned char *k;\n\tRC2_INT *ki;\n\tunsigned int c,d;\n\tk= (unsigned char *)&(key->data[0]);\n\t*k=0;\n\tif (len > 128) len=128;\n\tif (bits <= 0) bits=1024;\n\tif (bits > 1024) bits=1024;\n\tfor (i=0; i<len; i++)\n\t\tk[i]=data[i];\n\td=k[len-1];\n\tj=0;\n\tfor (i=len; i < 128; i++,j++)\n\t\t{\n\t\td=key_table[(k[j]+d)&0xff];\n\t\tk[i]=d;\n\t\t}\n\tj=(bits+7)>>3;\n\ti=128-j;\n\tc= (0xff>>(-bits & 0x07));\n\td=key_table[k[i]&c];\n\tk[i]=d;\n\twhile (i--)\n\t\t{\n\t\td=key_table[k[i+j]^d];\n\t\tk[i]=d;\n\t\t}\n\tki= &(key->data[63]);\n\tfor (i=127; i>=0; i-=2)\n\t\t*(ki--)=((k[i]<<8)|k[i-1])&0xffff;\n\t}']