crypto/bn/bn_prime.c:208: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_rshift`.
Showing all 14 steps of the trace


crypto/bn/bn_prime.c:198:10: Call
196.   
197.       /* compute A1 := a - 1 */
198.       if (!BN_copy(A1, a) || !BN_sub_word(A1, 1))
                ^
199.           goto err;
200.       /* compute A3 := a - 3 */

crypto/bn/bn_lib.c:285:1: Parameter `a->top`
  283.   }
  284.   
  285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  286.   {
  287.       bn_check_top(b);

crypto/bn/bn_prime.c:208:10: Call
206.       while (!BN_is_bit_set(A1, k))
207.           k++;
208.       if (!BN_rshift(A1_odd, A1, k))
                ^
209.           goto err;
210.   

crypto/bn/bn_shift.c:122:1: Parameter `*r->d`
  120.   }
  121.   
  122. > int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
  123.   {
  124.       int i, j, nw, lb, rb;

crypto/bn/bn_shift.c:145:13: Call
  143.       i = (BN_num_bits(a) - n + (BN_BITS2 - 1)) / BN_BITS2;
  144.       if (r != a) {
  145.           if (bn_wexpand(r, i) == NULL)
                     ^
  146.               return 0;
  147.           r->neg = a->neg;

crypto/bn/bn_lib.c:941:1: Parameter `*a->d`
    939.   }
    940.   
    941. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
    942.   {
    943.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:943:37: Call
    941.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
    942.   {
    943.       return (words <= a->dmax) ? a : bn_expand2(a, words);
                                               ^
    944.   }
    945.   

crypto/bn/bn_lib.c:246:1: Parameter `*b->d`
      244.    */
      245.   
      246. > BIGNUM *bn_expand2(BIGNUM *b, int words)
      247.   {
      248.       bn_check_top(b);

crypto/bn/bn_lib.c:251:23: Call
      249.   
      250.       if (words > b->dmax) {
      251.           BN_ULONG *a = bn_expand_internal(b, words);
                                   ^
      252.           if (!a)
      253.               return NULL;

crypto/bn/bn_lib.c:208:1: <Offset trace>
206.   /* This is used by bn_expand2() */
207.   /* The caller MUST check that words > b->dmax before calling this */
208. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
209.   {
210.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:208:1: Parameter `b->top`
        206.   /* This is used by bn_expand2() */
        207.   /* The caller MUST check that words > b->dmax before calling this */
        208. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
        209.   {
        210.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:208:1: <Length trace>
206.   /* This is used by bn_expand2() */
207.   /* The caller MUST check that words > b->dmax before calling this */
208. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
209.   {
210.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:208:1: Parameter `*b->d`
        206.   /* This is used by bn_expand2() */
        207.   /* The caller MUST check that words > b->dmax before calling this */
        208. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
        209.   {
        210.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:233:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_rshift` 
        231.       assert(b->top <= words);
        232.       if (b->top > 0)
        233.           memcpy(a, b->d, sizeof(*a) * b->top);
                       ^
        234.   
        235.       return a;
