crypto/bn/bn_print.c:104: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [0, +oo].
Showing all 12 steps of the trace


crypto/bn/bn_print.c:68:9: <Length trace>
66.        *     <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
67.        */
68.       i = BN_num_bits(a) * 3;
              ^
69.       num = (i / 10 + i / 1000 + 1) + 1;
70.       bn_data_num = num / BN_DEC_NUM + 1;

crypto/bn/bn_print.c:68:9: Call
66.        *     <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
67.        */
68.       i = BN_num_bits(a) * 3;
              ^
69.       num = (i / 10 + i / 1000 + 1) + 1;
70.       bn_data_num = num / BN_DEC_NUM + 1;

crypto/bn/bn_lib.c:167:9: Assignment
  165.   
  166.       if (BN_is_zero(a))
  167.           return 0;
                 ^
  168.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));
  169.   }

crypto/bn/bn_print.c:68:5: Assignment
66.        *     <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
67.        */
68.       i = BN_num_bits(a) * 3;
          ^
69.       num = (i / 10 + i / 1000 + 1) + 1;
70.       bn_data_num = num / BN_DEC_NUM + 1;

crypto/bn/bn_print.c:69:5: Assignment
67.        */
68.       i = BN_num_bits(a) * 3;
69.       num = (i / 10 + i / 1000 + 1) + 1;
          ^
70.       bn_data_num = num / BN_DEC_NUM + 1;
71.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));

crypto/bn/bn_print.c:70:5: Assignment
68.       i = BN_num_bits(a) * 3;
69.       num = (i / 10 + i / 1000 + 1) + 1;
70.       bn_data_num = num / BN_DEC_NUM + 1;
          ^
71.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
72.       buf = OPENSSL_malloc(num + 3);

crypto/bn/bn_print.c:71:15: Call
69.       num = (i / 10 + i / 1000 + 1) + 1;
70.       bn_data_num = num / BN_DEC_NUM + 1;
71.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
                    ^
72.       buf = OPENSSL_malloc(num + 3);
73.       if ((buf == NULL) || (bn_data == NULL)) {

crypto/mem.c:166:9: Assignment
  164.   
  165.       if (num == 0)
  166.           return NULL;
                 ^
  167.   
  168.       FAILTEST();

crypto/bn/bn_print.c:71:5: Assignment
69.       num = (i / 10 + i / 1000 + 1) + 1;
70.       bn_data_num = num / BN_DEC_NUM + 1;
71.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
          ^
72.       buf = OPENSSL_malloc(num + 3);
73.       if ((buf == NULL) || (bn_data == NULL)) {

crypto/bn/bn_print.c:82:5: Assignment
80.   #define BUF_REMAIN (num+3 - (size_t)(p - buf))
81.       p = buf;
82.       lp = bn_data;
          ^
83.       if (BN_is_zero(t)) {
84.           *(p++) = '0';

crypto/bn/bn_print.c:98:9: Assignment
96.               lp++;
97.           }
98.           lp--;
               ^
99.           /*
100.            * We now have a series of blocks, BN_DEC_NUM chars in length, where

crypto/bn/bn_print.c:104:50: Array access: Offset: [-1, +oo] Size: [0, +oo]
102.            * order.
103.            */
104.           BIO_snprintf(p, BUF_REMAIN, BN_DEC_FMT1, *lp);
                                                        ^
105.           while (*p)
106.               p++;
