test/bntest.c:239: error: BUFFER_OVERRUN_L3
  Offset: [0, 49] Size: [0, 8388607] by call to `BN_set_bit`.
Showing all 7 steps of the trace


test/bntest.c:44:1: Assignment
42.   } MPITEST;
43.   
44. > static const int NUM0 = 100;           /* number of tests */
45.   static const int NUM1 = 50;            /* additional tests for some functions */
46.   static BN_CTX *ctx;

test/bntest.c:239:24: Call
237.               if (!(TEST_true(BN_bntest_rand(a, 512, 0, 0)))
238.                       && TEST_ptr(BN_copy(b, a))
239.                       && TEST_int_ne(BN_set_bit(a, i), 0)
                              ^
240.                       && TEST_true(BN_add_word(b, i)))
241.                   goto err;

crypto/bn/bn_lib.c:626:1: <Offset trace>
624.   }
625.   
626. > int BN_set_bit(BIGNUM *a, int n)
627.   {
628.       int i, j, k;

crypto/bn/bn_lib.c:626:1: Parameter `a->top`
  624.   }
  625.   
  626. > int BN_set_bit(BIGNUM *a, int n)
  627.   {
  628.       int i, j, k;

crypto/bn/bn_lib.c:626:1: <Length trace>
624.   }
625.   
626. > int BN_set_bit(BIGNUM *a, int n)
627.   {
628.       int i, j, k;

crypto/bn/bn_lib.c:626:1: Parameter `*a->d`
  624.   }
  625.   
  626. > int BN_set_bit(BIGNUM *a, int n)
  627.   {
  628.       int i, j, k;

crypto/bn/bn_lib.c:644:5: Array access: Offset: [0, 49] Size: [0, 8388607] by call to `BN_set_bit` 
  642.       }
  643.   
  644.       a->d[i] |= (((BN_ULONG)1) << j);
             ^
  645.       bn_check_top(a);
  646.       return 1;

int BN_set_bit(BIGNUM *a, int n)
{
    int i, j, k;
    if (n < 0)
        return 0;
    i = n / BN_BITS2;
    j = n % BN_BITS2;
    if (a->top <= i) {
        if (bn_wexpand(a, i + 1) == NULL)
            return 0;
        for (k = a->top; k < i + 1; k++)
            a->d[k] = 0;
        a->top = i + 1;
        a->flags &= ~BN_FLG_FIXED_TOP;
    }
    a->d[i] |= (((BN_ULONG)1) << j);
    bn_check_top(a);
    return 1;
}
['static int test_sub(void)\n{\n    BIGNUM *a = NULL, *b = NULL, *c = NULL;\n    int i, st = 0;\n    if (!TEST_ptr(a = BN_new())\n            || !TEST_ptr(b = BN_new())\n            || !TEST_ptr(c = BN_new()))\n        goto err;\n    for (i = 0; i < NUM0 + NUM1; i++) {\n        if (i < NUM1) {\n            if (!(TEST_true(BN_bntest_rand(a, 512, 0, 0)))\n                    && TEST_ptr(BN_copy(b, a))\n                    && TEST_int_ne(BN_set_bit(a, i), 0)\n                    && TEST_true(BN_add_word(b, i)))\n                goto err;\n        } else {\n            if (!TEST_true(BN_bntest_rand(b, 400 + i - NUM1, 0, 0)))\n                goto err;\n            BN_set_negative(a, rand_neg());\n            BN_set_negative(b, rand_neg());\n        }\n        if (!(TEST_true(BN_sub(c, a, b))\n                && TEST_true(BN_add(c, c, b))\n                && TEST_true(BN_sub(c, c, a))\n                && TEST_BN_eq_zero(c)))\n            goto err;\n    }\n    st = 1;\n err:\n    BN_free(a);\n    BN_free(b);\n    BN_free(c);\n    return st;\n}', 'int BN_set_bit(BIGNUM *a, int n)\n{\n    int i, j, k;\n    if (n < 0)\n        return 0;\n    i = n / BN_BITS2;\n    j = n % BN_BITS2;\n    if (a->top <= i) {\n        if (bn_wexpand(a, i + 1) == NULL)\n            return 0;\n        for (k = a->top; k < i + 1; k++)\n            a->d[k] = 0;\n        a->top = i + 1;\n        a->flags &= ~BN_FLG_FIXED_TOP;\n    }\n    a->d[i] |= (((BN_ULONG)1) << j);\n    bn_check_top(a);\n    return 1;\n}']