test/rsa_mp_test.c:205: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `RSA_check_key_ex`.
Showing all 15 steps of the trace


test/rsa_mp_test.c:201:12: Call
199.       if (!TEST_ptr(key))
200.           goto err;
201.       clen = key2048p3(key);
                  ^
202.       if (!TEST_int_eq(clen, 256))
203.           goto err;

test/rsa_mp_test.c:136:10: Call
  134.       int rv = 256; /* public key length */
  135.   
  136.       if (!TEST_int_eq(RSA_set0_key(key,
                  ^
  137.                                     BN_bin2bn(n, sizeof(n) - 1, NULL),
  138.                                     BN_bin2bn(e, sizeof(e) - 1, NULL),

crypto/bn/bn_lib.c:399:1: Parameter `ret->top`
    397.   }
    398.   
    399. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
    400.   {
    401.       unsigned int i, m;

test/rsa_mp_test.c:205:10: Call
203.           goto err;
204.   
205.       if (!TEST_true(RSA_check_key_ex(key, NULL)))
                ^
206.           goto err;
207.   

crypto/rsa/rsa_chk.c:19:1: Parameter `key->d->top`
  17.   }
  18.   
  19. > int RSA_check_key_ex(const RSA *key, BN_GENCB *cb)
  20.   {
  21.       BIGNUM *i, *j, *k, *l, *m;

crypto/rsa/rsa_chk.c:160:14: Call
  158.               goto err;
  159.           }
  160.           if (!BN_mod(j, key->d, i, ctx)) {
                      ^
  161.               ret = -1;
  162.               goto err;

crypto/bn/bn_div.c:137:1: Parameter `num->top`
    135.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
    136.    */
    137. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
    138.              BN_CTX *ctx)
    139.   {

crypto/bn/bn_div.c:182:17: Call
    180.       if (!no_branch && BN_ucmp(num, divisor) < 0) {
    181.           if (rm != NULL) {
    182.               if (BN_copy(rm, num) == NULL)
                           ^
    183.                   return 0;
    184.           }

crypto/bn/bn_lib.c:312:1: <Offset trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `b->top`
      310.   }
      311.   
      312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      313.   {
      314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: <Length trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `*a->d`
      310.   }
      311.   
      312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      313.   {
      314.       bn_check_top(b);

crypto/bn/bn_lib.c:318:9: Call
      316.       if (a == b)
      317.           return a;
      318.       if (bn_wexpand(a, b->top) == NULL)
                     ^
      319.           return NULL;
      320.   

crypto/bn/bn_lib.c:940:1: Parameter `*a->d`
        938.   }
        939.   
        940. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
        941.   {
        942.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:322:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `RSA_check_key_ex` 
      320.   
      321.       if (b->top > 0)
      322.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      323.   
      324.       if (BN_get_flags(b, BN_FLG_CONSTTIME) != 0)
