test/testutil/tests.c:646: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_dup`.
Showing all 11 steps of the trace


test/testutil/tests.c:638:1: Parameter `a->top`
636.   }
637.   
638. > int test_BN_abs_eq_word(const char *file, int line, const char *bns,
639.                           const char *ws, const BIGNUM *a, BN_ULONG w)
640.   {

test/testutil/tests.c:646:10: Call
644.           return 1;
645.       bw = BN_new();
646.       aa = BN_dup(a);
                ^
647.       BN_set_negative(aa, 0);
648.       BN_set_word(bw, w);

crypto/bn/bn_lib.c:304:1: Parameter `a->top`
  302.   }
  303.   
  304. > BIGNUM *BN_dup(const BIGNUM *a)
  305.   {
  306.       BIGNUM *t;

crypto/bn/bn_lib.c:315:10: Call
  313.       if (t == NULL)
  314.           return NULL;
  315.       if (!BN_copy(t, a)) {
                  ^
  316.           BN_free(t);
  317.           return NULL;

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
    321.   }
    322.   
    323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    324.   {
    325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
    321.   }
    322.   
    323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    324.   {
    325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
    327.       if (a == b)
    328.           return a;
    329.       if (bn_wexpand(a, b->top) == NULL)
                   ^
    330.           return NULL;
    331.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
      946.   }
      947.   
      948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
      949.   {
      950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_dup` 
    331.   
    332.       if (b->top > 0)
    333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                   ^
    334.   
    335.       a->top = b->top;
