crypto/bn/bn_word.c:128: error: BUFFER_OVERRUN_S2
  Offset: [max(0, `a->top`), `a->top`] Size: [0, 8388607].
Showing all 7 steps of the trace


crypto/bn/bn_word.c:120:10: <Offset trace>
118.           return i;
119.       }
120.       for (i = 0; w != 0 && i < a->top; i++) {
                ^
121.           a->d[i] = l = (a->d[i] + w) & BN_MASK2;
122.           w = (w > l) ? 1 : 0;

crypto/bn/bn_word.c:120:10: Assignment
118.           return i;
119.       }
120.       for (i = 0; w != 0 && i < a->top; i++) {
                ^
121.           a->d[i] = l = (a->d[i] + w) & BN_MASK2;
122.           w = (w > l) ? 1 : 0;

crypto/bn/bn_word.c:98:1: <Length trace>
96.   }
97.   
98. > int BN_add_word(BIGNUM *a, BN_ULONG w)
99.   {
100.       BN_ULONG l;

crypto/bn/bn_word.c:98:1: Parameter `*a->d`
96.   }
97.   
98. > int BN_add_word(BIGNUM *a, BN_ULONG w)
99.   {
100.       BN_ULONG l;

crypto/bn/bn_word.c:125:13: Call
123.       }
124.       if (w && i == a->top) {
125.           if (bn_wexpand(a, a->top + 1) == NULL)
                   ^
126.               return 0;
127.           a->top++;

crypto/bn/bn_lib.c:940:1: Parameter `*a->d`
  938.   }
  939.   
  940. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
  941.   {
  942.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_word.c:128:9: Array access: Offset: [max(0, a->top), a->top] Size: [0, 8388607]
126.               return 0;
127.           a->top++;
128.           a->d[i] = w;
               ^
129.       }
130.       bn_check_top(a);

int BN_add_word(BIGNUM *a, BN_ULONG w)
{
    BN_ULONG l;
    int i;
    bn_check_top(a);
    w &= BN_MASK2;
    if (!w)
        return 1;
    if (BN_is_zero(a))
        return BN_set_word(a, w);
    if (a->neg) {
        a->neg = 0;
        i = BN_sub_word(a, w);
        if (!BN_is_zero(a))
            a->neg = !(a->neg);
        return i;
    }
    for (i = 0; w != 0 && i < a->top; i++) {
        a->d[i] = l = (a->d[i] + w) & BN_MASK2;
        w = (w > l) ? 1 : 0;
    }
    if (w && i == a->top) {
        if (bn_wexpand(a, a->top + 1) == NULL)
            return 0;
        a->top++;
        a->d[i] = w;
    }
    bn_check_top(a);
    return 1;
}
['int BN_add_word(BIGNUM *a, BN_ULONG w)\n{\n    BN_ULONG l;\n    int i;\n    bn_check_top(a);\n    w &= BN_MASK2;\n    if (!w)\n        return 1;\n    if (BN_is_zero(a))\n        return BN_set_word(a, w);\n    if (a->neg) {\n        a->neg = 0;\n        i = BN_sub_word(a, w);\n        if (!BN_is_zero(a))\n            a->neg = !(a->neg);\n        return i;\n    }\n    for (i = 0; w != 0 && i < a->top; i++) {\n        a->d[i] = l = (a->d[i] + w) & BN_MASK2;\n        w = (w > l) ? 1 : 0;\n    }\n    if (w && i == a->top) {\n        if (bn_wexpand(a, a->top + 1) == NULL)\n            return 0;\n        a->top++;\n        a->d[i] = w;\n    }\n    bn_check_top(a);\n    return 1;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']