crypto/evp/e_aes.c:2410: error: BUFFER_OVERRUN_L3
  Offset added: [16, +oo] Size: [1, +oo] by call to `CRYPTO_ocb128_copy_ctx`.
Showing all 9 steps of the trace


crypto/evp/e_aes.c:2410:16: Call
2408.           newc = (EVP_CIPHER_CTX *)ptr;
2409.           new_octx = EVP_C_DATA(EVP_AES_OCB_CTX,newc);
2410.           return CRYPTO_ocb128_copy_ctx(&new_octx->ocb, &octx->ocb,
                       ^
2411.                                         &new_octx->ksenc.ks,
2412.                                         &new_octx->ksdec.ks);

crypto/modes/ocb128.c:204:1: <Offset trace>
202.    * Copy an OCB128_CONTEXT object
203.    */
204. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
205.                              void *keyenc, void *keydec)
206.   {

crypto/modes/ocb128.c:204:1: Parameter `src->l_index`
  202.    * Copy an OCB128_CONTEXT object
  203.    */
  204. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
  205.                              void *keyenc, void *keydec)
  206.   {

crypto/modes/ocb128.c:204:1: <Length trace>
202.    * Copy an OCB128_CONTEXT object
203.    */
204. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
205.                              void *keyenc, void *keydec)
206.   {

crypto/modes/ocb128.c:204:1: Parameter `src->max_l_index`
  202.    * Copy an OCB128_CONTEXT object
  203.    */
  204. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
  205.                              void *keyenc, void *keydec)
  206.   {

crypto/modes/ocb128.c:213:19: Call
  211.           dest->keydec = keydec;
  212.       if (src->l) {
  213.           dest->l = OPENSSL_malloc(src->max_l_index * 16);
                           ^
  214.           if (dest->l == NULL)
  215.               return 0;

crypto/mem.c:165:9: Assignment
    163.   
    164.       if (num <= 0)
    165.           return NULL;
                   ^
    166.   
    167.       FAILTEST();

crypto/modes/ocb128.c:213:9: Assignment
  211.           dest->keydec = keydec;
  212.       if (src->l) {
  213.           dest->l = OPENSSL_malloc(src->max_l_index * 16);
                 ^
  214.           if (dest->l == NULL)
  215.               return 0;

crypto/modes/ocb128.c:216:9: Array access: Offset added: [16, +oo] Size: [1, +oo] by call to `CRYPTO_ocb128_copy_ctx` 
  214.           if (dest->l == NULL)
  215.               return 0;
  216.           memcpy(dest->l, src->l, (src->l_index + 1) * 16);
                 ^
  217.       }
  218.       return 1;
