crypto/evp/e_aes.c:2427: error: BUFFER_OVERRUN_L3
  Offset added: [16, +oo] Size: [1, +oo] by call to `CRYPTO_ocb128_copy_ctx`.
Showing all 9 steps of the trace


crypto/evp/e_aes.c:2427:16: Call
2425.           newc = (EVP_CIPHER_CTX *)ptr;
2426.           new_octx = EVP_C_DATA(EVP_AES_OCB_CTX,newc);
2427.           return CRYPTO_ocb128_copy_ctx(&new_octx->ocb, &octx->ocb,
                       ^
2428.                                         &new_octx->ksenc.ks,
2429.                                         &new_octx->ksdec.ks);

crypto/modes/ocb128.c:242:1: <Offset trace>
240.    * Copy an OCB128_CONTEXT object
241.    */
242. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
243.                              void *keyenc, void *keydec)
244.   {

crypto/modes/ocb128.c:242:1: Parameter `src->l_index`
  240.    * Copy an OCB128_CONTEXT object
  241.    */
  242. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
  243.                              void *keyenc, void *keydec)
  244.   {

crypto/modes/ocb128.c:242:1: <Length trace>
240.    * Copy an OCB128_CONTEXT object
241.    */
242. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
243.                              void *keyenc, void *keydec)
244.   {

crypto/modes/ocb128.c:242:1: Parameter `src->max_l_index`
  240.    * Copy an OCB128_CONTEXT object
  241.    */
  242. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
  243.                              void *keyenc, void *keydec)
  244.   {

crypto/modes/ocb128.c:251:19: Call
  249.           dest->keydec = keydec;
  250.       if (src->l) {
  251.           dest->l = OPENSSL_malloc(src->max_l_index * 16);
                           ^
  252.           if (dest->l == NULL)
  253.               return 0;

crypto/mem.c:125:9: Assignment
    123.   
    124.       if (num <= 0)
    125.           return NULL;
                   ^
    126.   
    127.       allow_customize = 0;

crypto/modes/ocb128.c:251:9: Assignment
  249.           dest->keydec = keydec;
  250.       if (src->l) {
  251.           dest->l = OPENSSL_malloc(src->max_l_index * 16);
                 ^
  252.           if (dest->l == NULL)
  253.               return 0;

crypto/modes/ocb128.c:254:9: Array access: Offset added: [16, +oo] Size: [1, +oo] by call to `CRYPTO_ocb128_copy_ctx` 
  252.           if (dest->l == NULL)
  253.               return 0;
  254.           memcpy(dest->l, src->l, (src->l_index + 1) * 16);
                 ^
  255.       }
  256.       return 1;
