crypto/modes/ocb128.c:254: error: BUFFER_OVERRUN_S2
  Offset added: [16⋅`src->l_index` + 16, 16⋅`src->l_index` + 16] Size: [1, 16⋅`src->max_l_index`].
Showing all 8 steps of the trace


crypto/modes/ocb128.c:242:1: <Offset trace>
240.    * Copy an OCB128_CONTEXT object
241.    */
242. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
243.                              void *keyenc, void *keydec)
244.   {

crypto/modes/ocb128.c:242:1: Parameter `src->l_index`
240.    * Copy an OCB128_CONTEXT object
241.    */
242. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
243.                              void *keyenc, void *keydec)
244.   {

crypto/modes/ocb128.c:242:1: <Length trace>
240.    * Copy an OCB128_CONTEXT object
241.    */
242. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
243.                              void *keyenc, void *keydec)
244.   {

crypto/modes/ocb128.c:242:1: Parameter `src->max_l_index`
240.    * Copy an OCB128_CONTEXT object
241.    */
242. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
243.                              void *keyenc, void *keydec)
244.   {

crypto/modes/ocb128.c:251:19: Call
249.           dest->keydec = keydec;
250.       if (src->l) {
251.           dest->l = OPENSSL_malloc(src->max_l_index * 16);
                         ^
252.           if (dest->l == NULL)
253.               return 0;

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/modes/ocb128.c:251:9: Assignment
249.           dest->keydec = keydec;
250.       if (src->l) {
251.           dest->l = OPENSSL_malloc(src->max_l_index * 16);
               ^
252.           if (dest->l == NULL)
253.               return 0;

crypto/modes/ocb128.c:254:9: Array access: Offset added: [16⋅src->l_index + 16, 16⋅src->l_index + 16] Size: [1, 16⋅src->max_l_index]
252.           if (dest->l == NULL)
253.               return 0;
254.           memcpy(dest->l, src->l, (src->l_index + 1) * 16);
               ^
255.       }
256.       return 1;

int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
                           void *keyenc, void *keydec)
{
    memcpy(dest, src, sizeof(OCB128_CONTEXT));
    if (keyenc)
        dest->keyenc = keyenc;
    if (keydec)
        dest->keydec = keydec;
    if (src->l) {
        dest->l = OPENSSL_malloc(src->max_l_index * 16);
        if (dest->l == NULL)
            return 0;
        memcpy(dest->l, src->l, (src->l_index + 1) * 16);
    }
    return 1;
}
['int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,\n                           void *keyenc, void *keydec)\n{\n    memcpy(dest, src, sizeof(OCB128_CONTEXT));\n    if (keyenc)\n        dest->keyenc = keyenc;\n    if (keydec)\n        dest->keydec = keydec;\n    if (src->l) {\n        dest->l = OPENSSL_malloc(src->max_l_index * 16);\n        if (dest->l == NULL)\n            return 0;\n        memcpy(dest->l, src->l, (src->l_index + 1) * 16);\n    }\n    return 1;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifdef CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}']