More details:

Affected file: https://github.com/libtom/libtomcrypt/blob/develop/src/misc/pkcs5/pkcs_5_2.c

Line: 89

Description: This call to memcpy() contains a potential buffer overflow. The specified size of 128 bytes is larger than the space allocated to the destination buffer (16 bytes). If an attacker can control the data written into the buffer, the overflow may result in execution of arbitrary code.

In reality x == 32 after the previous call to hmac_done() in line 84 instead of 128 (== MAXBLOCKSIZE in line 83). And it is guaranteed that x <= MAXBLOCKSIZE after the call to hmac_done().

And buf is declared as unsigned char *buf[2], so on x86-64 sizeof(buf) == 2*sizeof(void*) == 16 which is most likely why Veracode reports the target size as 16 bytes. In reality a memory block of size 2*MAXBLOCKSIZE is allocated in line 48 and assigned to x[0], then x[1] = x[0] + MAXBLOCKSIZE in line 60. So the target of the memcpy() call actually offers 128 bytes of space.