crypto/bn/bn_gf2m.c:516: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, 8388607] by call to `bn_correct_top`.
Showing all 9 steps of the trace


crypto/bn/bn_gf2m.c:497:1: Parameter `a->top`
495.   
496.   /* Square a, reduce the result mod p, and store it in a.  r could be a. */
497. > int BN_GF2m_mod_sqr_arr(BIGNUM *r, const BIGNUM *a, const int p[],
498.                           BN_CTX *ctx)
499.   {

crypto/bn/bn_gf2m.c:515:5: Assignment
513.       }
514.   
515.       s->top = 2 * a->top;
           ^
516.       bn_correct_top(s);
517.       if (!BN_GF2m_mod_arr(r, s, p))

crypto/bn/bn_gf2m.c:516:5: Call
514.   
515.       s->top = 2 * a->top;
516.       bn_correct_top(s);
           ^
517.       if (!BN_GF2m_mod_arr(r, s, p))
518.           goto err;

crypto/bn/bn_lib.c:1019:1: <Offset trace>
1017.   }
1018.   
1019. > void bn_correct_top(BIGNUM *a)
1020.   {
1021.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:1019:1: Parameter `a->top`
  1017.   }
  1018.   
  1019. > void bn_correct_top(BIGNUM *a)
  1020.   {
  1021.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:1022:5: Assignment
  1020.   {
  1021.       BN_ULONG *ftl;
  1022.       int tmp_top = a->top;
              ^
  1023.   
  1024.       if (tmp_top > 0) {

crypto/bn/bn_lib.c:1019:1: <Length trace>
1017.   }
1018.   
1019. > void bn_correct_top(BIGNUM *a)
1020.   {
1021.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:1019:1: Parameter `*a->d`
  1017.   }
  1018.   
  1019. > void bn_correct_top(BIGNUM *a)
  1020.   {
  1021.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:1025:14: Array access: Offset: [1, +oo] Size: [0, 8388607] by call to `bn_correct_top` 
  1023.   
  1024.       if (tmp_top > 0) {
  1025.           for (ftl = &(a->d[tmp_top]); tmp_top > 0; tmp_top--) {
                       ^
  1026.               ftl--;
  1027.               if (*ftl != 0)

void bn_correct_top(BIGNUM *a)
{
    BN_ULONG *ftl;
    int tmp_top = a->top;
    if (tmp_top > 0) {
        for (ftl = &(a->d[tmp_top]); tmp_top > 0; tmp_top--) {
            ftl--;
            if (*ftl != 0)
                break;
        }
        a->top = tmp_top;
    }
    bn_pollute(a);
}
['int BN_GF2m_mod_sqr_arr(BIGNUM *r, const BIGNUM *a, const int p[],\n                        BN_CTX *ctx)\n{\n    int i, ret = 0;\n    BIGNUM *s;\n    bn_check_top(a);\n    BN_CTX_start(ctx);\n    if ((s = BN_CTX_get(ctx)) == NULL)\n        goto err;\n    if (!bn_wexpand(s, 2 * a->top))\n        goto err;\n    for (i = a->top - 1; i >= 0; i--) {\n        s->d[2 * i + 1] = SQR1(a->d[i]);\n        s->d[2 * i] = SQR0(a->d[i]);\n    }\n    s->top = 2 * a->top;\n    bn_correct_top(s);\n    if (!BN_GF2m_mod_arr(r, s, p))\n        goto err;\n    bn_check_top(r);\n    ret = 1;\n err:\n    BN_CTX_end(ctx);\n    return ret;\n}', 'void bn_correct_top(BIGNUM *a)\n{\n    BN_ULONG *ftl;\n    int tmp_top = a->top;\n    if (tmp_top > 0) {\n        for (ftl = &(a->d[tmp_top]); tmp_top > 0; tmp_top--) {\n            ftl--;\n            if (*ftl != 0)\n                break;\n        }\n        a->top = tmp_top;\n    }\n    bn_pollute(a);\n}']