crypto/modes/ocb128.c:254: error: BUFFER_OVERRUN_S2
  Offset added: [16⋅`src->l_index` + 16, 16⋅`src->l_index` + 16] Size: [1, 16⋅`src->max_l_index`].
Showing all 8 steps of the trace


crypto/modes/ocb128.c:242:1: <Offset trace>
240.    * Copy an OCB128_CONTEXT object
241.    */
242. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
243.                              void *keyenc, void *keydec)
244.   {

crypto/modes/ocb128.c:242:1: Parameter `src->l_index`
240.    * Copy an OCB128_CONTEXT object
241.    */
242. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
243.                              void *keyenc, void *keydec)
244.   {

crypto/modes/ocb128.c:242:1: <Length trace>
240.    * Copy an OCB128_CONTEXT object
241.    */
242. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
243.                              void *keyenc, void *keydec)
244.   {

crypto/modes/ocb128.c:242:1: Parameter `src->max_l_index`
240.    * Copy an OCB128_CONTEXT object
241.    */
242. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
243.                              void *keyenc, void *keydec)
244.   {

crypto/modes/ocb128.c:251:19: Call
249.           dest->keydec = keydec;
250.       if (src->l) {
251.           dest->l = OPENSSL_malloc(src->max_l_index * 16);
                         ^
252.           if (dest->l == NULL)
253.               return 0;

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/modes/ocb128.c:251:9: Assignment
249.           dest->keydec = keydec;
250.       if (src->l) {
251.           dest->l = OPENSSL_malloc(src->max_l_index * 16);
               ^
252.           if (dest->l == NULL)
253.               return 0;

crypto/modes/ocb128.c:254:9: Array access: Offset added: [16⋅src->l_index + 16, 16⋅src->l_index + 16] Size: [1, 16⋅src->max_l_index]
252.           if (dest->l == NULL)
253.               return 0;
254.           memcpy(dest->l, src->l, (src->l_index + 1) * 16);
               ^
255.       }
256.       return 1;
