crypto/bn/bn_blind.c:151: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_copy`.
Showing all 9 steps of the trace


crypto/bn/bn_blind.c:134:1: Parameter `b->Ai->top`
132.   }
133.   
134. > int BN_BLINDING_convert_ex(BIGNUM *n, BIGNUM *r, BN_BLINDING *b, BN_CTX *ctx)
135.   {
136.       int ret = 1;

crypto/bn/bn_blind.c:151:23: Call
149.           return 0;
150.   
151.       if (r != NULL && (BN_copy(r, b->Ai) == NULL))
                             ^
152.           return 0;
153.   

crypto/bn/bn_lib.c:281:1: <Offset trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `b->top`
  279.   }
  280.   
  281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  282.   {
  283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: <Length trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `*a->d`
  279.   }
  280.   
  281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  282.   {
  283.       bn_check_top(b);

crypto/bn/bn_lib.c:287:9: Call
  285.       if (a == b)
  286.           return a;
  287.       if (bn_wexpand(a, b->top) == NULL)
                 ^
  288.           return NULL;
  289.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
    946.   }
    947.   
    948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
    949.   {
    950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:291:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_copy` 
  289.   
  290.       if (b->top > 0)
  291.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                 ^
  292.   
  293.       a->neg = b->neg;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->neg = b->neg;
    a->top = b->top;
    a->flags |= b->flags & BN_FLG_FIXED_TOP;
    bn_check_top(a);
    return a;
}
['int BN_BLINDING_convert_ex(BIGNUM *n, BIGNUM *r, BN_BLINDING *b, BN_CTX *ctx)\n{\n    int ret = 1;\n    bn_check_top(n);\n    if ((b->A == NULL) || (b->Ai == NULL)) {\n        BNerr(BN_F_BN_BLINDING_CONVERT_EX, BN_R_NOT_INITIALIZED);\n        return 0;\n    }\n    if (b->counter == -1)\n        b->counter = 0;\n    else if (!BN_BLINDING_update(b, ctx))\n        return 0;\n    if (r != NULL && (BN_copy(r, b->Ai) == NULL))\n        return 0;\n    if (b->m_ctx != NULL)\n        ret = BN_mod_mul_montgomery(n, n, b->A, b->m_ctx, ctx);\n    else\n        ret = BN_mod_mul(n, n, b->A, b->mod, ctx);\n    return ret;\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->neg = b->neg;\n    a->top = b->top;\n    a->flags |= b->flags & BN_FLG_FIXED_TOP;\n    bn_check_top(a);\n    return a;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']