test/dhtest.c:60: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `DH_check`.
Showing all 20 steps of the trace


test/dhtest.c:56:17: Call
54.       BN_GENCB_set(_cb, &cb, NULL);
55.       if (!TEST_ptr(a = DH_new())
56.               || !TEST_true(DH_generate_parameters_ex(a, 64,
                      ^
57.                                                       DH_GENERATOR_5, _cb)))
58.           goto err;

crypto/dh/dh_gen.c:23:1: Parameter `ret->p->top`
  21.                                   BN_GENCB *cb);
  22.   
  23. > int DH_generate_parameters_ex(DH *ret, int prime_len, int generator,
  24.                                 BN_GENCB *cb)
  25.   {

test/dhtest.c:60:10: Call
58.           goto err;
59.   
60.       if (!DH_check(a, &i))
               ^
61.           goto err;
62.       if (!TEST_false(i & DH_CHECK_P_NOT_PRIME)

crypto/dh/dh_check.c:65:1: Parameter `dh->p->top`
  63.    */
  64.   
  65. > int DH_check(const DH *dh, int *ret)
  66.   {
  67.       int ok = 0, r;

crypto/dh/dh_check.c:87:18: Call
  85.           if (BN_cmp(dh->g, BN_value_one()) <= 0)
  86.               *ret |= DH_NOT_SUITABLE_GENERATOR;
  87.           else if (BN_cmp(dh->g, dh->p) >= 0)
                         ^
  88.               *ret |= DH_NOT_SUITABLE_GENERATOR;
  89.           else {

crypto/bn/bn_lib.c:577:1: Parameter `a->top`
    575.   }
    576.   
    577. > int BN_cmp(const BIGNUM *a, const BIGNUM *b)
    578.   {
    579.       int i;

crypto/dh/dh_check.c:91:18: Call
  89.           else {
  90.               /* Check g^q == 1 mod p */
  91.               if (!BN_mod_exp(t1, dh->g, dh->q, dh->p, ctx))
                         ^
  92.                   goto err;
  93.               if (!BN_is_one(t1))

crypto/bn/bn_exp.c:91:1: Parameter `m->top`
    89.   }
    90.   
    91. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
    92.                  BN_CTX *ctx)
    93.   {

crypto/bn/bn_exp.c:136:9: Call
    134.   
    135.   #ifdef MONT_MUL_MOD
    136.       if (BN_is_odd(m)) {
                   ^
    137.   # ifdef MONT_EXP_WORD
    138.           if (a->top == 1 && !a->neg

crypto/bn/bn_lib.c:867:1: Parameter `a->top`
      865.   }
      866.   
      867. > int BN_is_odd(const BIGNUM *a)
      868.   {
      869.       return (a->top > 0) && (a->d[0] & 1);

crypto/bn/bn_exp.c:149:15: Call
    147.   #ifdef RECP_MUL_MOD
    148.       {
    149.           ret = BN_mod_exp_recp(r, a, p, m, ctx);
                         ^
    150.       }
    151.   #else

crypto/bn/bn_exp.c:161:1: Parameter `m->top`
      159.   }
      160.   
      161. > int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
      162.                       const BIGNUM *m, BN_CTX *ctx)
      163.   {

crypto/bn/bn_exp.c:198:14: Call
      196.       if (m->neg) {
      197.           /* ignore sign of 'm' */
      198.           if (!BN_copy(aa, m))
                          ^
      199.               goto err;
      200.           aa->neg = 0;

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
        321.   }
        322.   
        323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        324.   {
        325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
        321.   }
        322.   
        323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        324.   {
        325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
        327.       if (a == b)
        328.           return a;
        329.       if (bn_wexpand(a, b->top) == NULL)
                       ^
        330.           return NULL;
        331.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
          946.   }
          947.   
          948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
          949.   {
          950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `DH_check` 
        331.   
        332.       if (b->top > 0)
        333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                       ^
        334.   
        335.       a->top = b->top;
