test/bn_internal_test.c:76: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_mul_word`.
Showing all 12 steps of the trace


test/bn_internal_test.c:71:37: Call
69.       BIGNUM *b = NULL;
70.   
71.       if (!(TEST_ptr(b = BN_new()) && TEST_true(BN_set_word(b, 3))))
                                          ^
72.           goto err;
73.   

crypto/bn/bn_lib.c:361:1: Parameter `*a->d`
  359.   }
  360.   
  361. > int BN_set_word(BIGNUM *a, BN_ULONG w)
  362.   {
  363.       bn_check_top(a);

crypto/bn/bn_lib.c:364:9: Call
  362.   {
  363.       bn_check_top(a);
  364.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                 ^
  365.           return 0;
  366.       a->neg = 0;

crypto/bn/bn_lcl.h:660:1: Parameter `*a->d`
    658.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
    659.   
    660. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
    661.   {
    662.       if (bits > (INT_MAX - BN_BITS2 + 1))

test/bn_internal_test.c:76:35: Call
74.       for (i = 1; i < NUMPRIMES; i++) {
75.           prime_t p = primes[i];
76.           if (p > 3 && p <= 751 && !BN_mul_word(b, p))
                                        ^
77.               goto err;
78.           if (p > 751)

crypto/bn/bn_word.c:181:1: Parameter `*a->d`
  179.   }
  180.   
  181. > int BN_mul_word(BIGNUM *a, BN_ULONG w)
  182.   {
  183.       BN_ULONG ll;

crypto/bn/bn_word.c:189:13: Call
  187.       if (a->top) {
  188.           if (w == 0)
  189.               BN_zero(a);
                     ^
  190.           else {
  191.               ll = bn_mul_words(a->d, a->d, a->top, w);

crypto/bn/bn_lib.c:361:1: <Length trace>
359.   }
360.   
361. > int BN_set_word(BIGNUM *a, BN_ULONG w)
362.   {
363.       bn_check_top(a);

crypto/bn/bn_lib.c:361:1: Parameter `*a->d`
    359.   }
    360.   
    361. > int BN_set_word(BIGNUM *a, BN_ULONG w)
    362.   {
    363.       bn_check_top(a);

crypto/bn/bn_lib.c:364:9: Call
    362.   {
    363.       bn_check_top(a);
    364.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                   ^
    365.           return 0;
    366.       a->neg = 0;

crypto/bn/bn_lcl.h:660:1: Parameter `*a->d`
      658.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
      659.   
      660. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
      661.   {
      662.       if (bits > (INT_MAX - BN_BITS2 + 1))

crypto/bn/bn_lib.c:367:5: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_mul_word` 
    365.           return 0;
    366.       a->neg = 0;
    367.       a->d[0] = w;
               ^
    368.       a->top = (w ? 1 : 0);
    369.       a->flags &= ~BN_FLG_FIXED_TOP;

int BN_set_word(BIGNUM *a, BN_ULONG w)
{
    bn_check_top(a);
    if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
        return 0;
    a->neg = 0;
    a->d[0] = w;
    a->top = (w ? 1 : 0);
    a->flags &= ~BN_FLG_FIXED_TOP;
    bn_check_top(a);
    return 1;
}
['static int test_bn_small_factors(void)\n{\n    int ret = 0, i;\n    BIGNUM *b = NULL;\n    if (!(TEST_ptr(b = BN_new()) && TEST_true(BN_set_word(b, 3))))\n        goto err;\n    for (i = 1; i < NUMPRIMES; i++) {\n        prime_t p = primes[i];\n        if (p > 3 && p <= 751 && !BN_mul_word(b, p))\n            goto err;\n        if (p > 751)\n            break;\n    }\n    ret = TEST_BN_eq(bn_get0_small_factors(), b);\nerr:\n    BN_free(b);\n    return ret;\n}', 'int BN_set_word(BIGNUM *a, BN_ULONG w)\n{\n    bn_check_top(a);\n    if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)\n        return 0;\n    a->neg = 0;\n    a->d[0] = w;\n    a->top = (w ? 1 : 0);\n    a->flags &= ~BN_FLG_FIXED_TOP;\n    bn_check_top(a);\n    return 1;\n}', 'static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)\n{\n    if (bits > (INT_MAX - BN_BITS2 + 1))\n        return NULL;\n    if (((bits+BN_BITS2-1)/BN_BITS2) <= (a)->dmax)\n        return a;\n    return bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2);\n}', 'int BN_mul_word(BIGNUM *a, BN_ULONG w)\n{\n    BN_ULONG ll;\n    bn_check_top(a);\n    w &= BN_MASK2;\n    if (a->top) {\n        if (w == 0)\n            BN_zero(a);\n        else {\n            ll = bn_mul_words(a->d, a->d, a->top, w);\n            if (ll) {\n                if (bn_wexpand(a, a->top + 1) == NULL)\n                    return 0;\n                a->d[a->top++] = ll;\n            }\n        }\n    }\n    bn_check_top(a);\n    return 1;\n}']