crypto/aes/aes_cfb.c:235: error: BUFFER_OVERRUN_L2
  Offset: [0, 15] Size: 1 by call to `AES_cfbr_encrypt_block`.
Showing all 7 steps of the trace


crypto/aes/aes_cfb.c:221:1: Array declaration
219.   
220.   /* N.B. This expects the input to be packed, MS bit first */
221. > void AES_cfb1_encrypt(const unsigned char *in, unsigned char *out,
222.   		      size_t length, const AES_KEY *key,
223.   		      unsigned char *ivec, int *num, const int enc)

crypto/aes/aes_cfb.c:235:2: Call
233.   	{
234.   	c[0]=(in[n/8]&(1 << (7-n%8))) ? 0x80 : 0;
235.   	AES_cfbr_encrypt_block(c,d,1,key,ivec,enc);
        ^
236.   	out[n/8]=(out[n/8]&~(1 << (7-n%8)))|((d[0]&0x80) >> (n%8));
237.   	}

crypto/aes/aes_cfb.c:203:10: <Offset trace>
201.   	num = (nbits+7)/8;
202.   	if (enc)	/* encrypt the input */
203.   	    for(n=0 ; n < num ; ++n)
                ^
204.   		out[n] = (ovec[AES_BLOCK_SIZE+n] = in[n] ^ ivec[n]);
205.   	else		/* decrypt the input */

crypto/aes/aes_cfb.c:203:10: Assignment
  201.   	num = (nbits+7)/8;
  202.   	if (enc)	/* encrypt the input */
  203.   	    for(n=0 ; n < num ; ++n)
                  ^
  204.   		out[n] = (ovec[AES_BLOCK_SIZE+n] = in[n] ^ ivec[n]);
  205.   	else		/* decrypt the input */

crypto/aes/aes_cfb.c:188:1: <Length trace>
186.   /* This expects a single block of size nbits for both in and out. Note that
187.      it corrupts any extra bits in the last byte of out */
188. > void AES_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,
189.   			    const int nbits,const AES_KEY *key,
190.   			    unsigned char *ivec,const int enc)

crypto/aes/aes_cfb.c:188:1: Parameter `*out`
  186.   /* This expects a single block of size nbits for both in and out. Note that
  187.      it corrupts any extra bits in the last byte of out */
  188. > void AES_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,
  189.   			    const int nbits,const AES_KEY *key,
  190.   			    unsigned char *ivec,const int enc)

crypto/aes/aes_cfb.c:204:3: Array access: Offset: [0, 15] Size: 1 by call to `AES_cfbr_encrypt_block` 
  202.   	if (enc)	/* encrypt the input */
  203.   	    for(n=0 ; n < num ; ++n)
  204.   		out[n] = (ovec[AES_BLOCK_SIZE+n] = in[n] ^ ivec[n]);
           ^
  205.   	else		/* decrypt the input */
  206.   	    for(n=0 ; n < num ; ++n)

void AES_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,
			    const int nbits,const AES_KEY *key,
			    unsigned char *ivec,const int enc)
    {
    int n,rem,num;
    unsigned char ovec[AES_BLOCK_SIZE*2 + 1];
    if (nbits<=0 || nbits>128) return;
	memcpy(ovec,ivec,AES_BLOCK_SIZE);
	AES_encrypt(ivec,ivec,key);
	num = (nbits+7)/8;
	if (enc)
	    for(n=0 ; n < num ; ++n)
		out[n] = (ovec[AES_BLOCK_SIZE+n] = in[n] ^ ivec[n]);
	else
	    for(n=0 ; n < num ; ++n)
		out[n] = (ovec[AES_BLOCK_SIZE+n] = in[n]) ^ ivec[n];
	rem = nbits%8;
	num = nbits/8;
	if(rem==0)
	    memcpy(ivec,ovec+num,AES_BLOCK_SIZE);
	else
	    for(n=0 ; n < AES_BLOCK_SIZE ; ++n)
		ivec[n] = ovec[n+num]<<rem | ovec[n+num+1]>>(8-rem);
    }
['void AES_cfb1_encrypt(const unsigned char *in, unsigned char *out,\n\t\t      size_t length, const AES_KEY *key,\n\t\t      unsigned char *ivec, int *num, const int enc)\n    {\n    size_t n;\n    unsigned char c[1],d[1];\n    assert(in && out && key && ivec && num);\n    assert(*num == 0);\n    memset(out,0,(length+7)/8);\n    for(n=0 ; n < length ; ++n)\n\t{\n\tc[0]=(in[n/8]&(1 << (7-n%8))) ? 0x80 : 0;\n\tAES_cfbr_encrypt_block(c,d,1,key,ivec,enc);\n\tout[n/8]=(out[n/8]&~(1 << (7-n%8)))|((d[0]&0x80) >> (n%8));\n\t}\n    }', 'void AES_cfbr_encrypt_block(const unsigned char *in,unsigned char *out,\n\t\t\t    const int nbits,const AES_KEY *key,\n\t\t\t    unsigned char *ivec,const int enc)\n    {\n    int n,rem,num;\n    unsigned char ovec[AES_BLOCK_SIZE*2 + 1];\n    if (nbits<=0 || nbits>128) return;\n\tmemcpy(ovec,ivec,AES_BLOCK_SIZE);\n\tAES_encrypt(ivec,ivec,key);\n\tnum = (nbits+7)/8;\n\tif (enc)\n\t    for(n=0 ; n < num ; ++n)\n\t\tout[n] = (ovec[AES_BLOCK_SIZE+n] = in[n] ^ ivec[n]);\n\telse\n\t    for(n=0 ; n < num ; ++n)\n\t\tout[n] = (ovec[AES_BLOCK_SIZE+n] = in[n]) ^ ivec[n];\n\trem = nbits%8;\n\tnum = nbits/8;\n\tif(rem==0)\n\t    memcpy(ivec,ovec+num,AES_BLOCK_SIZE);\n\telse\n\t    for(n=0 ; n < AES_BLOCK_SIZE ; ++n)\n\t\tivec[n] = ovec[n+num]<<rem | ovec[n+num+1]>>(8-rem);\n    }']