crypto/pem/pvkfmt.c:713: error: INTEGER_OVERFLOW_L2
  (0 - [-oo, 32]):unsigned64 by call to `EVP_DecryptUpdate`.
Showing all 7 steps of the trace


crypto/pem/pvkfmt.c:713:14: Call
711.           if (!EVP_DecryptInit_ex(cctx, EVP_rc4(), NULL, keybuf, NULL))
712.               goto err;
713.           if (!EVP_DecryptUpdate(cctx, q, &enctmplen, p, inlen))
                    ^
714.               goto err;
715.           if (!EVP_DecryptFinal_ex(cctx, q + enctmplen, &enctmplen))

crypto/evp/evp_enc.c:443:1: Parameter `ctx->cipher->block_size`
  441.   }
  442.   
  443. > int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
  444.                         const unsigned char *in, int inl)
  445.   {

crypto/evp/evp_enc.c:455:5: Assignment
  453.       }
  454.   
  455.       b = ctx->cipher->block_size;
             ^
  456.   
  457.       if (EVP_CIPHER_CTX_test_flags(ctx, EVP_CIPH_FLAG_LENGTH_BITS))

crypto/evp/evp_enc.c:488:16: Call
  486.           /* see comment about PTRDIFF_T comparison above */
  487.           if (((PTRDIFF_T)out == (PTRDIFF_T)in)
  488.               || is_partially_overlapping(out, in, b)) {
                        ^
  489.               EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_PARTIALLY_OVERLAPPING);
  490.               return 0;

crypto/evp/evp_enc.c:283:1: <RHS trace>
281.   #endif
282.   
283. > int is_partially_overlapping(const void *ptr1, const void *ptr2, int len)
284.   {
285.       PTRDIFF_T diff = (PTRDIFF_T)ptr1-(PTRDIFF_T)ptr2;

crypto/evp/evp_enc.c:283:1: Parameter `len`
    281.   #endif
    282.   
    283. > int is_partially_overlapping(const void *ptr1, const void *ptr2, int len)
    284.   {
    285.       PTRDIFF_T diff = (PTRDIFF_T)ptr1-(PTRDIFF_T)ptr2;

crypto/evp/evp_enc.c:292:50: Binary operation: (0 - [-oo, 32]):unsigned64 by call to `EVP_DecryptUpdate` 
    290.        */
    291.       int overlapped = (len > 0) & (diff != 0) & ((diff < (PTRDIFF_T)len) |
    292.                                                   (diff > (0 - (PTRDIFF_T)len)));
                                                            ^
    293.   
    294.       return overlapped;

int is_partially_overlapping(const void *ptr1, const void *ptr2, int len)
{
    PTRDIFF_T diff = (PTRDIFF_T)ptr1-(PTRDIFF_T)ptr2;
    int overlapped = (len > 0) & (diff != 0) & ((diff < (PTRDIFF_T)len) |
                                                (diff > (0 - (PTRDIFF_T)len)));
    return overlapped;
}
['static EVP_PKEY *do_PVK_body(const unsigned char **in,\n                             unsigned int saltlen, unsigned int keylen,\n                             pem_password_cb *cb, void *u)\n{\n    EVP_PKEY *ret = NULL;\n    const unsigned char *p = *in;\n    unsigned int magic;\n    unsigned char *enctmp = NULL, *q;\n    unsigned char keybuf[20];\n    EVP_CIPHER_CTX *cctx = EVP_CIPHER_CTX_new();\n    if (saltlen) {\n        char psbuf[PEM_BUFSIZE];\n        int enctmplen, inlen;\n        if (cb)\n            inlen = cb(psbuf, PEM_BUFSIZE, 0, u);\n        else\n            inlen = PEM_def_callback(psbuf, PEM_BUFSIZE, 0, u);\n        if (inlen < 0) {\n            PEMerr(PEM_F_DO_PVK_BODY, PEM_R_BAD_PASSWORD_READ);\n            goto err;\n        }\n        enctmp = OPENSSL_malloc(keylen + 8);\n        if (enctmp == NULL) {\n            PEMerr(PEM_F_DO_PVK_BODY, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        if (!derive_pvk_key(keybuf, p, saltlen,\n                            (unsigned char *)psbuf, inlen))\n            goto err;\n        p += saltlen;\n        memcpy(enctmp, p, 8);\n        p += 8;\n        if (keylen < 8) {\n            PEMerr(PEM_F_DO_PVK_BODY, PEM_R_PVK_TOO_SHORT);\n            goto err;\n        }\n        inlen = keylen - 8;\n        q = enctmp + 8;\n        if (!EVP_DecryptInit_ex(cctx, EVP_rc4(), NULL, keybuf, NULL))\n            goto err;\n        if (!EVP_DecryptUpdate(cctx, q, &enctmplen, p, inlen))\n            goto err;\n        if (!EVP_DecryptFinal_ex(cctx, q + enctmplen, &enctmplen))\n            goto err;\n        magic = read_ledword((const unsigned char **)&q);\n        if (magic != MS_RSA2MAGIC && magic != MS_DSS2MAGIC) {\n            q = enctmp + 8;\n            memset(keybuf + 5, 0, 11);\n            if (!EVP_DecryptInit_ex(cctx, EVP_rc4(), NULL, keybuf, NULL))\n                goto err;\n            if (!EVP_DecryptUpdate(cctx, q, &enctmplen, p, inlen))\n                goto err;\n            if (!EVP_DecryptFinal_ex(cctx, q + enctmplen, &enctmplen))\n                goto err;\n            magic = read_ledword((const unsigned char **)&q);\n            if (magic != MS_RSA2MAGIC && magic != MS_DSS2MAGIC) {\n                PEMerr(PEM_F_DO_PVK_BODY, PEM_R_BAD_DECRYPT);\n                goto err;\n            }\n        }\n        p = enctmp;\n    }\n    ret = b2i_PrivateKey(&p, keylen);\n err:\n    EVP_CIPHER_CTX_free(cctx);\n    if (enctmp != NULL) {\n        OPENSSL_cleanse(keybuf, sizeof(keybuf));\n        OPENSSL_free(enctmp);\n    }\n    return ret;\n}', 'int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,\n                      const unsigned char *in, int inl)\n{\n    int fix_len, cmpl = inl;\n    unsigned int b;\n    if (ctx->encrypt) {\n        EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_INVALID_OPERATION);\n        return 0;\n    }\n    b = ctx->cipher->block_size;\n    if (EVP_CIPHER_CTX_test_flags(ctx, EVP_CIPH_FLAG_LENGTH_BITS))\n        cmpl = (cmpl + 7) / 8;\n    if (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER) {\n        if (b == 1 && is_partially_overlapping(out, in, cmpl)) {\n            EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_PARTIALLY_OVERLAPPING);\n            return 0;\n        }\n        fix_len = ctx->cipher->do_cipher(ctx, out, in, inl);\n        if (fix_len < 0) {\n            *outl = 0;\n            return 0;\n        } else\n            *outl = fix_len;\n        return 1;\n    }\n    if (inl <= 0) {\n        *outl = 0;\n        return inl == 0;\n    }\n    if (ctx->flags & EVP_CIPH_NO_PADDING)\n        return evp_EncryptDecryptUpdate(ctx, out, outl, in, inl);\n    OPENSSL_assert(b <= sizeof(ctx->final));\n    if (ctx->final_used) {\n        if (((PTRDIFF_T)out == (PTRDIFF_T)in)\n            || is_partially_overlapping(out, in, b)) {\n            EVPerr(EVP_F_EVP_DECRYPTUPDATE, EVP_R_PARTIALLY_OVERLAPPING);\n            return 0;\n        }\n        memcpy(out, ctx->final, b);\n        out += b;\n        fix_len = 1;\n    } else\n        fix_len = 0;\n    if (!evp_EncryptDecryptUpdate(ctx, out, outl, in, inl))\n        return 0;\n    if (b > 1 && !ctx->buf_len) {\n        *outl -= b;\n        ctx->final_used = 1;\n        memcpy(ctx->final, &out[*outl], b);\n    } else\n        ctx->final_used = 0;\n    if (fix_len)\n        *outl += b;\n    return 1;\n}', 'int is_partially_overlapping(const void *ptr1, const void *ptr2, int len)\n{\n    PTRDIFF_T diff = (PTRDIFF_T)ptr1-(PTRDIFF_T)ptr2;\n    int overlapped = (len > 0) & (diff != 0) & ((diff < (PTRDIFF_T)len) |\n                                                (diff > (0 - (PTRDIFF_T)len)));\n    return overlapped;\n}']