crypto/evp/e_aes.c:2030: error: BUFFER_OVERRUN_L3
  Offset added: [2, 16] Size: [0, +oo] by call to `CRYPTO_ccm128_tag`.
Showing all 7 steps of the trace


crypto/evp/e_aes.c:1992:1: Parameter `arg`
1990.   BLOCK_CIPHER_custom(NID_aes,256,1,16,xts,XTS,XTS_FLAGS)
1991.   
1992. > static int aes_ccm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
1993.   	{
1994.   	EVP_AES_CCM_CTX *cctx = c->cipher_data;

crypto/evp/e_aes.c:2030:7: Call
2028.   		if (!c->encrypt || !cctx->tag_set)
2029.   			return 0;
2030.   		if(!CRYPTO_ccm128_tag(&cctx->ccm, ptr, (size_t)arg))
              ^
2031.   			return 0;
2032.   		cctx->tag_set = 0;

crypto/modes/ccm128.c:434:1: <Offset trace>
432.   }
433.   
434. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx,unsigned char *tag,size_t len)
435.   {	unsigned int M = (ctx->nonce.c[0]>>3)&7;	/* the M parameter */
436.   

crypto/modes/ccm128.c:434:1: Parameter `len`
  432.   }
  433.   
  434. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx,unsigned char *tag,size_t len)
  435.   {	unsigned int M = (ctx->nonce.c[0]>>3)&7;	/* the M parameter */
  436.   

crypto/modes/ccm128.c:434:1: <Length trace>
432.   }
433.   
434. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx,unsigned char *tag,size_t len)
435.   {	unsigned int M = (ctx->nonce.c[0]>>3)&7;	/* the M parameter */
436.   

crypto/modes/ccm128.c:434:1: Parameter `ctx->cmac.c[*]`
  432.   }
  433.   
  434. > size_t CRYPTO_ccm128_tag(CCM128_CONTEXT *ctx,unsigned char *tag,size_t len)
  435.   {	unsigned int M = (ctx->nonce.c[0]>>3)&7;	/* the M parameter */
  436.   

crypto/modes/ccm128.c:439:2: Array access: Offset added: [2, 16] Size: [0, +oo] by call to `CRYPTO_ccm128_tag` 
  437.   	M *= 2; M += 2;
  438.   	if (len<M)	return 0;
  439.   	memcpy(tag,ctx->cmac.c,M);
          ^
  440.   	return M;
  441.   }
