crypto/sm2/sm2_sign.c:135: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, 8388607] by call to `BN_add`.
Showing all 10 steps of the trace


crypto/sm2/sm2_sign.c:135:28: Call
133.               continue;
134.   
135.           if (!BN_add(s, dA, BN_value_one())
                                  ^
136.                   || !BN_mod_inverse(s, s, order, ctx)
137.                   || !BN_mod_mul(tmp, dA, r, order, ctx)

crypto/bn/bn_lib.c:84:9: Assignment
  82.       static const BN_ULONG data_one = 1L;
  83.       static const BIGNUM const_one =
  84.           { (BN_ULONG *)&data_one, 1, 1, 0, BN_FLG_STATIC_DATA };
                ^
  85.   
  86.       return &const_one;

crypto/sm2/sm2_sign.c:135:14: Call
133.               continue;
134.   
135.           if (!BN_add(s, dA, BN_value_one())
                    ^
136.                   || !BN_mod_inverse(s, s, order, ctx)
137.                   || !BN_mod_mul(tmp, dA, r, order, ctx)

crypto/bn/bn_add.c:14:1: Parameter `b->top`
  12.   
  13.   /* signed add of b to a. */
  14. > int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
  15.   {
  16.       int ret, r_neg, cmp_res;

crypto/bn/bn_add.c:28:19: Call
  26.           if (cmp_res > 0) {
  27.               r_neg = a->neg;
  28.               ret = BN_usub(r, a, b);
                          ^
  29.           } else if (cmp_res < 0) {
  30.               r_neg = b->neg;

crypto/bn/bn_add.c:125:1: <Length trace>
123.   
124.   /* unsigned subtraction of b from a, a must be larger than b. */
125. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
126.   {
127.       int max, min, dif;

crypto/bn/bn_add.c:125:1: Parameter `b->top`
    123.   
    124.   /* unsigned subtraction of b from a, a must be larger than b. */
    125. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
    126.   {
    127.       int max, min, dif;

crypto/bn/bn_add.c:135:5: Assignment
    133.   
    134.       max = a->top;
    135.       min = b->top;
               ^
    136.       dif = max - min;
    137.   

crypto/bn/bn_add.c:152:5: Assignment
    150.       borrow = bn_sub_words(rp, ap, bp, min);
    151.       ap += min;
    152.       rp += min;
               ^
    153.   
    154.       while (dif) {

crypto/bn/bn_add.c:158:9: Array access: Offset: [1, +oo] Size: [0, 8388607] by call to `BN_add` 
    156.           t1 = *(ap++);
    157.           t2 = (t1 - borrow) & BN_MASK2;
    158.           *(rp++) = t2;
                   ^
    159.           borrow &= (t1 == 0);
    160.       }
