crypto/cms/cms_env.c:910: error: BUFFER_OVERRUN_L3
  Offset added: [24, 2147483656] (⇐ 8 + [16, 2147483648]) Size: [64, +oo] by call to `CMS_RecipientInfo_encrypt`.
Showing all 14 steps of the trace


crypto/cms/cms_env.c:897:11: Call
895.   
896.       ec = cms->d.envelopedData->encryptedContentInfo;
897.       ret = cms_EncryptedContent_init_bio(ec);
                 ^
898.   
899.       /* If error or no cipher end of processing */

crypto/cms/cms_enc.c:68:1: Parameter `ec->keylen`
  66.   /* Return BIO based on EncryptedContentInfo and key */
  67.   
  68. > BIO *cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec)
  69.   {
  70.       BIO *b;

crypto/cms/cms_env.c:910:13: Call
908.       for (i = 0; i < sk_CMS_RecipientInfo_num(rinfos); i++) {
909.           ri = sk_CMS_RecipientInfo_value(rinfos, i);
910.           if (CMS_RecipientInfo_encrypt(cms, ri) <= 0) {
                   ^
911.               CMSerr(CMS_F_CMS_ENVELOPEDDATA_INIT_BIO,
912.                      CMS_R_ERROR_SETTING_RECIPIENTINFO);

crypto/cms/cms_env.c:801:1: Parameter `cms->d.envelopedData->encryptedContentInfo->keylen`
  799.   }
  800.   
  801. > int CMS_RecipientInfo_encrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
  802.   {
  803.       switch (ri->type) {

crypto/cms/cms_env.c:811:16: Call
  809.   
  810.       case CMS_RECIPINFO_KEK:
  811.           return cms_RecipientInfo_kekri_encrypt(cms, ri);
                        ^
  812.   
  813.       case CMS_RECIPINFO_PASS:

crypto/cms/cms_env.c:656:1: Parameter `cms->d.envelopedData->encryptedContentInfo->keylen`
    654.   /* Encrypt content key in KEK recipient info */
    655.   
    656. > static int cms_RecipientInfo_kekri_encrypt(CMS_ContentInfo *cms,
    657.                                              CMS_RecipientInfo *ri)
    658.   {

crypto/cms/cms_env.c:688:15: Call
    686.       }
    687.   
    688.       wkeylen = AES_wrap_key(&actx, NULL, wkey, ec->key, ec->keylen);
                         ^
    689.   
    690.       if (wkeylen <= 0) {

crypto/aes/aes_wrap.c:59:1: Parameter `inlen`
      57.   #include <openssl/modes.h>
      58.   
      59. > int AES_wrap_key(AES_KEY *key, const unsigned char *iv,
      60.                    unsigned char *out,
      61.                    const unsigned char *in, unsigned int inlen)

crypto/aes/aes_wrap.c:63:12: Call
      61.                    const unsigned char *in, unsigned int inlen)
      62.   {
      63.       return CRYPTO_128_wrap(key, iv, out, in, inlen, (block128_f) AES_encrypt);
                       ^
      64.   }
      65.   

crypto/modes/wrap128.c:94:1: <Offset trace>
92.    *                     Output length if wrapping succeeded.
93.    */
94. > size_t CRYPTO_128_wrap(void *key, const unsigned char *iv,
95.                          unsigned char *out,
96.                          const unsigned char *in, size_t inlen,

crypto/modes/wrap128.c:94:1: Parameter `inlen`
        92.    *                     Output length if wrapping succeeded.
        93.    */
        94. > size_t CRYPTO_128_wrap(void *key, const unsigned char *iv,
        95.                          unsigned char *out,
        96.                          const unsigned char *in, size_t inlen,

crypto/modes/wrap128.c:94:1: <Length trace>
92.    *                     Output length if wrapping succeeded.
93.    */
94. > size_t CRYPTO_128_wrap(void *key, const unsigned char *iv,
95.                          unsigned char *out,
96.                          const unsigned char *in, size_t inlen,

crypto/modes/wrap128.c:94:1: Parameter `*out`
        92.    *                     Output length if wrapping succeeded.
        93.    */
        94. > size_t CRYPTO_128_wrap(void *key, const unsigned char *iv,
        95.                          unsigned char *out,
        96.                          const unsigned char *in, size_t inlen,

crypto/modes/wrap128.c:105:5: Array access: Offset added: [24, 2147483656] (⇐ 8 + [16, 2147483648]) Size: [64, +oo] by call to `CMS_RecipientInfo_encrypt` 
        103.       A = B;
        104.       t = 1;
        105.       memmove(out + 8, in, inlen);
                   ^
        106.       if (!iv)
        107.           iv = default_iv;
