apps/dhparam.c:273: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `DH_check`.
Showing all 22 steps of the trace


apps/dhparam.c:269:9: Call
267.   
268.       if (text) {
269.           DHparams_print(out, dh);
               ^
270.       }
271.   

crypto/dh/dh_ameth.c:480:1: Parameter `x->q->top`
  478.   }
  479.   
  480. > int DHparams_print(BIO *bp, const DH *x)
  481.   {
  482.       return do_dh_print(bp, x, 4, 0);

crypto/dh/dh_ameth.c:482:12: Call
  480.   int DHparams_print(BIO *bp, const DH *x)
  481.   {
  482.       return do_dh_print(bp, x, 4, 0);
                    ^
  483.   }
  484.   

crypto/dh/dh_ameth.c:267:1: Parameter `x->q->top`
    265.   }
    266.   
    267. > static int do_dh_print(BIO *bp, const DH *x, int indent, int ptype)
    268.   {
    269.       int reason = ERR_R_BUF_LIB;

apps/dhparam.c:273:14: Call
271.   
272.       if (check) {
273.           if (!DH_check(dh, &i)) {
                    ^
274.               ERR_print_errors(bio_err);
275.               goto end;

crypto/dh/dh_check.c:101:1: Parameter `dh->p->top`
  99.   }
  100.   
  101. > int DH_check(const DH *dh, int *ret)
  102.   {
  103.       int ok = 0, r;

crypto/dh/dh_check.c:121:18: Call
  119.           if (BN_cmp(dh->g, BN_value_one()) <= 0)
  120.               *ret |= DH_NOT_SUITABLE_GENERATOR;
  121.           else if (BN_cmp(dh->g, dh->p) >= 0)
                          ^
  122.               *ret |= DH_NOT_SUITABLE_GENERATOR;
  123.           else {

crypto/bn/bn_lib.c:581:1: Parameter `a->top`
    579.   }
    580.   
    581. > int BN_cmp(const BIGNUM *a, const BIGNUM *b)
    582.   {
    583.       int i;

crypto/dh/dh_check.c:125:18: Call
  123.           else {
  124.               /* Check g^q == 1 mod p */
  125.               if (!BN_mod_exp(t1, dh->g, dh->q, dh->p, ctx))
                          ^
  126.                   goto err;
  127.               if (!BN_is_one(t1))

crypto/bn/bn_exp.c:89:1: Parameter `m->top`
    87.   }
    88.   
    89. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
    90.                  BN_CTX *ctx)
    91.   {

crypto/bn/bn_exp.c:134:9: Call
    132.   
    133.   #ifdef MONT_MUL_MOD
    134.       if (BN_is_odd(m)) {
                   ^
    135.   # ifdef MONT_EXP_WORD
    136.           if (a->top == 1 && !a->neg

crypto/bn/bn_lib.c:881:1: Parameter `a->top`
      879.   }
      880.   
      881. > int BN_is_odd(const BIGNUM *a)
      882.   {
      883.       return (a->top > 0) && (a->d[0] & 1);

crypto/bn/bn_exp.c:149:15: Call
    147.   #ifdef RECP_MUL_MOD
    148.       {
    149.           ret = BN_mod_exp_recp(r, a, p, m, ctx);
                         ^
    150.       }
    151.   #else

crypto/bn/bn_exp.c:161:1: Parameter `m->top`
      159.   }
      160.   
      161. > int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
      162.                       const BIGNUM *m, BN_CTX *ctx)
      163.   {

crypto/bn/bn_exp.c:200:14: Call
      198.       if (m->neg) {
      199.           /* ignore sign of 'm' */
      200.           if (!BN_copy(aa, m))
                          ^
      201.               goto err;
      202.           aa->neg = 0;

crypto/bn/bn_lib.c:281:1: <Offset trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `b->top`
        279.   }
        280.   
        281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        282.   {
        283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: <Length trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `*a->d`
        279.   }
        280.   
        281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        282.   {
        283.       bn_check_top(b);

crypto/bn/bn_lib.c:287:9: Call
        285.       if (a == b)
        286.           return a;
        287.       if (bn_wexpand(a, b->top) == NULL)
                       ^
        288.           return NULL;
        289.   

crypto/bn/bn_lib.c:962:1: Parameter `*a->d`
          960.   }
          961.   
          962. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
          963.   {
          964.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:291:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `DH_check` 
        289.   
        290.       if (b->top > 0)
        291.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                       ^
        292.   
        293.       a->neg = b->neg;
