crypto/dh/dh_check.c:154: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_set_word`.
Showing all 7 steps of the trace


crypto/dh/dh_check.c:153:11: Call
151.           goto err;
152.       BN_CTX_start(ctx);
153.       tmp = BN_CTX_get(ctx);
                 ^
154.       if (tmp == NULL || !BN_set_word(tmp, 1))
155.           goto err;

crypto/bn/bn_ctx.c:283:5: Call
  281.       }
  282.       /* OK, make sure the returned bignum is "zero" */
  283.       BN_zero(ret);
             ^
  284.       ctx->used++;
  285.       CTXDBG_RET(ctx, ret);

crypto/bn/bn_lib.c:520:1: Parameter `*a->d`
    518.   }
    519.   
    520. > int BN_set_word(BIGNUM *a, BN_ULONG w)
    521.   {
    522.       bn_check_top(a);

crypto/dh/dh_check.c:154:25: Call
152.       BN_CTX_start(ctx);
153.       tmp = BN_CTX_get(ctx);
154.       if (tmp == NULL || !BN_set_word(tmp, 1))
                               ^
155.           goto err;
156.       if (BN_cmp(pub_key, tmp) <= 0)

crypto/bn/bn_lib.c:520:1: <Length trace>
518.   }
519.   
520. > int BN_set_word(BIGNUM *a, BN_ULONG w)
521.   {
522.       bn_check_top(a);

crypto/bn/bn_lib.c:520:1: Parameter `*a->d`
  518.   }
  519.   
  520. > int BN_set_word(BIGNUM *a, BN_ULONG w)
  521.   {
  522.       bn_check_top(a);

crypto/bn/bn_lib.c:526:5: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_set_word` 
  524.           return (0);
  525.       a->neg = 0;
  526.       a->d[0] = w;
             ^
  527.       a->top = (w ? 1 : 0);
  528.       bn_check_top(a);
