crypto/cms/cms_smime.c:734: error: BUFFER_OVERRUN_L3
  Offset added: [24, 2147483656] (⇐ 8 + [16, 2147483648]) Size: [8, +oo] by call to `CMS_RecipientInfo_decrypt`.
Showing all 17 steps of the trace


crypto/cms/cms_smime.c:734:17: Call
732.           if (!id || (CMS_RecipientInfo_kekri_id_cmp(ri, id, idlen) == 0)) {
733.               CMS_RecipientInfo_set0_key(ri, key, keylen);
734.               r = CMS_RecipientInfo_decrypt(cms, ri);
                       ^
735.               CMS_RecipientInfo_set0_key(ri, NULL, 0);
736.               if (r > 0)

crypto/cms/cms_env.c:782:1: Parameter `*ri->d.pwri->encryptedKey->data`
  780.   }
  781.   
  782. > int CMS_RecipientInfo_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
  783.   {
  784.       switch (ri->type) {

crypto/cms/cms_smime.c:734:17: Call
732.           if (!id || (CMS_RecipientInfo_kekri_id_cmp(ri, id, idlen) == 0)) {
733.               CMS_RecipientInfo_set0_key(ri, key, keylen);
734.               r = CMS_RecipientInfo_decrypt(cms, ri);
                       ^
735.               CMS_RecipientInfo_set0_key(ri, NULL, 0);
736.               if (r > 0)

crypto/cms/cms_env.c:782:1: Parameter `*ri->d.kekri->encryptedKey->data`
  780.   }
  781.   
  782. > int CMS_RecipientInfo_decrypt(CMS_ContentInfo *cms, CMS_RecipientInfo *ri)
  783.   {
  784.       switch (ri->type) {

crypto/cms/cms_env.c:789:16: Call
  787.   
  788.       case CMS_RECIPINFO_KEK:
  789.           return cms_RecipientInfo_kekri_decrypt(cms, ri);
                        ^
  790.   
  791.       case CMS_RECIPINFO_PASS:

crypto/cms/cms_env.c:711:1: Parameter `*ri->d.kekri->encryptedKey->data`
    709.   /* Decrypt content key in KEK recipient info */
    710.   
    711. > static int cms_RecipientInfo_kekri_decrypt(CMS_ContentInfo *cms,
    712.                                              CMS_RecipientInfo *ri)
    713.   {

crypto/cms/cms_env.c:758:15: Call
    756.       }
    757.   
    758.       ukeylen = AES_unwrap_key(&actx, NULL, ukey,
                         ^
    759.                                kekri->encryptedKey->data,
    760.                                kekri->encryptedKey->length);

crypto/aes/aes_wrap.c:66:1: Parameter `inlen`
      64.   }
      65.   
      66. > int AES_unwrap_key(AES_KEY *key, const unsigned char *iv,
      67.                      unsigned char *out,
      68.                      const unsigned char *in, unsigned int inlen)

crypto/aes/aes_wrap.c:70:12: Call
      68.                      const unsigned char *in, unsigned int inlen)
      69.   {
      70.       return CRYPTO_128_unwrap(key, iv, out, in, inlen,
                       ^
      71.                                (block128_f) AES_decrypt);
      72.   }

crypto/modes/wrap128.c:196:1: Parameter `inlen`
        194.    *                     Output length otherwise.
        195.    */
        196. > size_t CRYPTO_128_unwrap(void *key, const unsigned char *iv,
        197.                            unsigned char *out, const unsigned char *in,
        198.                            size_t inlen, block128_f block)

crypto/modes/wrap128.c:203:11: Call
        201.       unsigned char got_iv[8];
        202.   
        203.       ret = crypto_128_unwrap_raw(key, got_iv, out, in, inlen, block);
                         ^
        204.       if (ret == 0)
        205.           return 0;

crypto/modes/wrap128.c:145:1: <Offset trace>
143.    *                     Output length otherwise.
144.    */
145. > static size_t crypto_128_unwrap_raw(void *key, unsigned char *iv,
146.                                       unsigned char *out,
147.                                       const unsigned char *in, size_t inlen,

crypto/modes/wrap128.c:145:1: Parameter `inlen`
          143.    *                     Output length otherwise.
          144.    */
          145. > static size_t crypto_128_unwrap_raw(void *key, unsigned char *iv,
          146.                                       unsigned char *out,
          147.                                       const unsigned char *in, size_t inlen,

crypto/modes/wrap128.c:152:5: Assignment
          150.       unsigned char *A, B[16], *R;
          151.       size_t i, j, t;
          152.       inlen -= 8;
                     ^
          153.       if ((inlen & 0x7) || (inlen < 16) || (inlen > CRYPTO128_WRAP_MAX))
          154.           return 0;

crypto/modes/wrap128.c:145:1: <Length trace>
143.    *                     Output length otherwise.
144.    */
145. > static size_t crypto_128_unwrap_raw(void *key, unsigned char *iv,
146.                                       unsigned char *out,
147.                                       const unsigned char *in, size_t inlen,

crypto/modes/wrap128.c:145:1: Parameter `*in`
          143.    *                     Output length otherwise.
          144.    */
          145. > static size_t crypto_128_unwrap_raw(void *key, unsigned char *iv,
          146.                                       unsigned char *out,
          147.                                       const unsigned char *in, size_t inlen,

crypto/modes/wrap128.c:158:5: Array access: Offset added: [24, 2147483656] (⇐ 8 + [16, 2147483648]) Size: [8, +oo] by call to `CMS_RecipientInfo_decrypt` 
          156.       t = 6 * (inlen >> 3);
          157.       memcpy(A, in, 8);
          158.       memmove(out, in + 8, inlen);
                     ^
          159.       for (j = 0; j < 6; j++) {
          160.           R = out + inlen - 8;
