crypto/modes/ocb128.c:219: error: BUFFER_OVERRUN_S2
  Offset added: [16⋅`src->l_index` + 16, 16⋅`src->l_index` + 16] Size: [1, 16⋅`src->max_l_index`].
Showing all 8 steps of the trace


crypto/modes/ocb128.c:206:1: <Offset trace>
204.    * Copy an OCB128_CONTEXT object
205.    */
206. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
207.                              void *keyenc, void *keydec)
208.   {

crypto/modes/ocb128.c:206:1: Parameter `src->l_index`
204.    * Copy an OCB128_CONTEXT object
205.    */
206. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
207.                              void *keyenc, void *keydec)
208.   {

crypto/modes/ocb128.c:206:1: <Length trace>
204.    * Copy an OCB128_CONTEXT object
205.    */
206. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
207.                              void *keyenc, void *keydec)
208.   {

crypto/modes/ocb128.c:206:1: Parameter `src->max_l_index`
204.    * Copy an OCB128_CONTEXT object
205.    */
206. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
207.                              void *keyenc, void *keydec)
208.   {

crypto/modes/ocb128.c:215:24: Call
213.           dest->keydec = keydec;
214.       if (src->l) {
215.           if ((dest->l = OPENSSL_malloc(src->max_l_index * 16)) == NULL) {
                              ^
216.               CRYPTOerr(CRYPTO_F_CRYPTO_OCB128_COPY_CTX, ERR_R_MALLOC_FAILURE);
217.               return 0;

crypto/mem.c:201:9: Assignment
  199.   
  200.       if (num == 0)
  201.           return NULL;
                 ^
  202.   
  203.       FAILTEST();

crypto/modes/ocb128.c:215:14: Assignment
213.           dest->keydec = keydec;
214.       if (src->l) {
215.           if ((dest->l = OPENSSL_malloc(src->max_l_index * 16)) == NULL) {
                    ^
216.               CRYPTOerr(CRYPTO_F_CRYPTO_OCB128_COPY_CTX, ERR_R_MALLOC_FAILURE);
217.               return 0;

crypto/modes/ocb128.c:219:9: Array access: Offset added: [16⋅src->l_index + 16, 16⋅src->l_index + 16] Size: [1, 16⋅src->max_l_index]
217.               return 0;
218.           }
219.           memcpy(dest->l, src->l, (src->l_index + 1) * 16);
               ^
220.       }
221.       return 1;
