test/bntest.c:1160: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_set_bit`.
Showing all 6 steps of the trace


test/bntest.c:1160:10: Call
1158.   
1159.       /* Set the LSB to 1 and test rshift1 again. */
1160.       if (!TEST_true(BN_set_bit(lshift1, 0))
                 ^
1161.               || !TEST_true(BN_div(ret, NULL /* rem */ , lshift1, two, ctx))
1162.               || !equalBN("(LShift1 | 1) / 2", a, ret)

crypto/bn/bn_lib.c:608:1: <Offset trace>
606.   }
607.   
608. > int BN_set_bit(BIGNUM *a, int n)
609.   {
610.       int i, j, k;

crypto/bn/bn_lib.c:608:1: Parameter `a->top`
  606.   }
  607.   
  608. > int BN_set_bit(BIGNUM *a, int n)
  609.   {
  610.       int i, j, k;

crypto/bn/bn_lib.c:608:1: <Length trace>
606.   }
607.   
608. > int BN_set_bit(BIGNUM *a, int n)
609.   {
610.       int i, j, k;

crypto/bn/bn_lib.c:608:1: Parameter `*a->d`
  606.   }
  607.   
  608. > int BN_set_bit(BIGNUM *a, int n)
  609.   {
  610.       int i, j, k;

crypto/bn/bn_lib.c:626:5: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_set_bit` 
  624.       }
  625.   
  626.       a->d[i] |= (((BN_ULONG)1) << j);
             ^
  627.       bn_check_top(a);
  628.       return 1;

int BN_set_bit(BIGNUM *a, int n)
{
    int i, j, k;
    if (n < 0)
        return 0;
    i = n / BN_BITS2;
    j = n % BN_BITS2;
    if (a->top <= i) {
        if (bn_wexpand(a, i + 1) == NULL)
            return 0;
        for (k = a->top; k < i + 1; k++)
            a->d[k] = 0;
        a->top = i + 1;
        a->flags &= ~BN_FLG_FIXED_TOP;
    }
    a->d[i] |= (((BN_ULONG)1) << j);
    bn_check_top(a);
    return 1;
}
['static int file_lshift1(STANZA *s)\n{\n    BIGNUM *a = NULL, *lshift1 = NULL, *zero = NULL, *ret = NULL;\n    BIGNUM *two = NULL, *remainder = NULL;\n    int st = 0;\n    if (!TEST_ptr(a = getBN(s, "A"))\n            || !TEST_ptr(lshift1 = getBN(s, "LShift1"))\n            || !TEST_ptr(zero = BN_new())\n            || !TEST_ptr(ret = BN_new())\n            || !TEST_ptr(two = BN_new())\n            || !TEST_ptr(remainder = BN_new()))\n        goto err;\n    BN_zero(zero);\n    if (!TEST_true(BN_set_word(two, 2))\n            || !TEST_true(BN_add(ret, a, a))\n            || !equalBN("A + A", lshift1, ret)\n            || !TEST_true(BN_mul(ret, a, two, ctx))\n            || !equalBN("A * 2", lshift1, ret)\n            || !TEST_true(BN_div(ret, remainder, lshift1, two, ctx))\n            || !equalBN("LShift1 / 2", a, ret)\n            || !equalBN("LShift1 % 2", zero, remainder)\n            || !TEST_true(BN_lshift1(ret, a))\n            || !equalBN("A << 1", lshift1, ret)\n            || !TEST_true(BN_rshift1(ret, lshift1))\n            || !equalBN("LShift >> 1", a, ret)\n            || !TEST_true(BN_rshift1(ret, lshift1))\n            || !equalBN("LShift >> 1", a, ret))\n        goto err;\n    if (!TEST_true(BN_set_bit(lshift1, 0))\n            || !TEST_true(BN_div(ret, NULL   , lshift1, two, ctx))\n            || !equalBN("(LShift1 | 1) / 2", a, ret)\n            || !TEST_true(BN_rshift1(ret, lshift1))\n            || !equalBN("(LShift | 1) >> 1", a, ret))\n        goto err;\n    st = 1;\nerr:\n    BN_free(a);\n    BN_free(lshift1);\n    BN_free(zero);\n    BN_free(ret);\n    BN_free(two);\n    BN_free(remainder);\n    return st;\n}', 'int BN_set_bit(BIGNUM *a, int n)\n{\n    int i, j, k;\n    if (n < 0)\n        return 0;\n    i = n / BN_BITS2;\n    j = n % BN_BITS2;\n    if (a->top <= i) {\n        if (bn_wexpand(a, i + 1) == NULL)\n            return 0;\n        for (k = a->top; k < i + 1; k++)\n            a->d[k] = 0;\n        a->top = i + 1;\n        a->flags &= ~BN_FLG_FIXED_TOP;\n    }\n    a->d[i] |= (((BN_ULONG)1) << j);\n    bn_check_top(a);\n    return 1;\n}']