crypto/modes/ocb128.c:216: error: BUFFER_OVERRUN_S2
  Offset added: [16⋅`src->l_index` + 16, 16⋅`src->l_index` + 16] Size: [1, 16⋅`src->max_l_index`].
Showing all 8 steps of the trace


crypto/modes/ocb128.c:204:1: <Offset trace>
202.    * Copy an OCB128_CONTEXT object
203.    */
204. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
205.                              void *keyenc, void *keydec)
206.   {

crypto/modes/ocb128.c:204:1: Parameter `src->l_index`
202.    * Copy an OCB128_CONTEXT object
203.    */
204. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
205.                              void *keyenc, void *keydec)
206.   {

crypto/modes/ocb128.c:204:1: <Length trace>
202.    * Copy an OCB128_CONTEXT object
203.    */
204. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
205.                              void *keyenc, void *keydec)
206.   {

crypto/modes/ocb128.c:204:1: Parameter `src->max_l_index`
202.    * Copy an OCB128_CONTEXT object
203.    */
204. > int CRYPTO_ocb128_copy_ctx(OCB128_CONTEXT *dest, OCB128_CONTEXT *src,
205.                              void *keyenc, void *keydec)
206.   {

crypto/modes/ocb128.c:213:19: Call
211.           dest->keydec = keydec;
212.       if (src->l) {
213.           dest->l = OPENSSL_malloc(src->max_l_index * 16);
                         ^
214.           if (dest->l == NULL)
215.               return 0;

crypto/mem.c:166:9: Assignment
  164.   
  165.       if (num == 0)
  166.           return NULL;
                 ^
  167.   
  168.       FAILTEST();

crypto/modes/ocb128.c:213:9: Assignment
211.           dest->keydec = keydec;
212.       if (src->l) {
213.           dest->l = OPENSSL_malloc(src->max_l_index * 16);
               ^
214.           if (dest->l == NULL)
215.               return 0;

crypto/modes/ocb128.c:216:9: Array access: Offset added: [16⋅src->l_index + 16, 16⋅src->l_index + 16] Size: [1, 16⋅src->max_l_index]
214.           if (dest->l == NULL)
215.               return 0;
216.           memcpy(dest->l, src->l, (src->l_index + 1) * 16);
               ^
217.       }
218.       return 1;
