test/bntest.c:486: error: BUFFER_OVERRUN_L3
  Offset: [54, 64] Size: [55, 65] by call to `parse_bigBN`.
Showing all 9 steps of the trace


test/bntest.c:455:37: Array declaration
453.       /* Regression test for carry bug in bn_sqrx8x_internal */
454.       {
455.           static const char *ahex[] = {
                                           ^
456.                         "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
457.               "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",

test/bntest.c:486:15: Call
484.           };
485.   
486.           if (!(TEST_true(parse_bigBN(&a, ahex))
                     ^
487.                   && TEST_true(parse_bigBN(&n, nhex))))
488.               goto err;

test/bntest.c:73:1: Parameter `**bn_strings`
  71.    * Parse BIGNUM from sparse hex-strings, return |BN_hex2bn| result.
  72.    */
  73. > static int parse_bigBN(BIGNUM **out, const char *bn_strings[])
  74.   {
  75.       char *bigstring = glue_strings(bn_strings, NULL);

test/bntest.c:75:23: Call
  73.   static int parse_bigBN(BIGNUM **out, const char *bn_strings[])
  74.   {
  75.       char *bigstring = glue_strings(bn_strings, NULL);
                              ^
  76.       int ret = BN_hex2bn(out, bigstring);
  77.   

test/testutil/driver.c:421:1: <Offset trace>
419.    * Optionally return the whole length of this string in |out_len|
420.    */
421. > char *glue_strings(const char *list[], size_t *out_len)
422.   {
423.       size_t len = 0;

test/testutil/driver.c:421:1: Parameter `(*list)->strlen`
    419.    * Optionally return the whole length of this string in |out_len|
    420.    */
    421. > char *glue_strings(const char *list[], size_t *out_len)
    422.   {
    423.       size_t len = 0;

test/testutil/driver.c:421:1: <Length trace>
419.    * Optionally return the whole length of this string in |out_len|
420.    */
421. > char *glue_strings(const char *list[], size_t *out_len)
422.   {
423.       size_t len = 0;

test/testutil/driver.c:421:1: Parameter `**list`
    419.    * Optionally return the whole length of this string in |out_len|
    420.    */
    421. > char *glue_strings(const char *list[], size_t *out_len)
    422.   {
    423.       size_t len = 0;

test/testutil/driver.c:437:21: Array access: Offset: [54, 64] Size: [55, 65] by call to `parse_bigBN` 
    435.   
    436.       for (i = 0; list[i] != NULL; i++)
    437.           p += strlen(strcpy(p, list[i]));
                               ^
    438.   
    439.       return ret;
