crypto/bn/bn_print.c:78: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_dup`.
Showing all 14 steps of the trace


crypto/bn/bn_print.c:53:1: Parameter `a->top`
51.   
52.   /* Must 'OPENSSL_free' the returned data */
53. > char *BN_bn2dec(const BIGNUM *a)
54.   {
55.       int i = 0, num, ok = 0, n, tbytes;

crypto/bn/bn_print.c:68:9: Call
66.        *     <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
67.        */
68.       i = BN_num_bits(a) * 3;
              ^
69.       num = (i / 10 + i / 1000 + 1) + 1;
70.       tbytes = num + 3;   /* negative and terminator and one spare? */

crypto/bn/bn_lib.c:166:9: Call
  164.       bn_check_top(a);
  165.   
  166.       if (BN_is_zero(a))
                 ^
  167.           return 0;
  168.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));

crypto/bn/bn_lib.c:852:1: Parameter `a->top`
    850.   }
    851.   
    852. > int BN_is_zero(const BIGNUM *a)
    853.   {
    854.       return a->top == 0;

crypto/bn/bn_print.c:78:14: Call
76.           goto err;
77.       }
78.       if ((t = BN_dup(a)) == NULL)
                   ^
79.           goto err;
80.   

crypto/bn/bn_lib.c:304:1: Parameter `a->top`
  302.   }
  303.   
  304. > BIGNUM *BN_dup(const BIGNUM *a)
  305.   {
  306.       BIGNUM *t;

crypto/bn/bn_lib.c:315:10: Call
  313.       if (t == NULL)
  314.           return NULL;
  315.       if (!BN_copy(t, a)) {
                  ^
  316.           BN_free(t);
  317.           return NULL;

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
    321.   }
    322.   
    323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    324.   {
    325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
    321.   }
    322.   
    323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    324.   {
    325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
    327.       if (a == b)
    328.           return a;
    329.       if (bn_wexpand(a, b->top) == NULL)
                   ^
    330.           return NULL;
    331.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
      946.   }
      947.   
      948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
      949.   {
      950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_dup` 
    331.   
    332.       if (b->top > 0)
    333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                   ^
    334.   
    335.       a->top = b->top;
