test/bntest.c:238: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `BN_div_recp`.
Showing all 19 steps of the trace


test/bntest.c:238:9: Call
236.           b->neg = rand_neg();
237.           BN_RECP_CTX_set(recp, b, ctx);
238.           BN_div_recp(d, c, a, recp, ctx);
               ^
239.           BN_mul(e, d, b, ctx);
240.           BN_add(d, e, c);

crypto/bn/bn_recp.c:83:1: Parameter `ctx->stack.depth`
  81.   }
  82.   
  83. > int BN_div_recp(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m,
  84.                   BN_RECP_CTX *recp, BN_CTX *ctx)
  85.   {

crypto/bn/bn_recp.c:89:5: Call
  87.       BIGNUM *a, *b, *d, *r;
  88.   
  89.       BN_CTX_start(ctx);
            ^
  90.       a = BN_CTX_get(ctx);
  91.       b = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:181:1: Parameter `ctx->stack.depth`
    179.   }
    180.   
    181. > void BN_CTX_start(BN_CTX *ctx)
    182.   {
    183.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_recp.c:106:13: Call
  104.           BN_zero(d);
  105.           if (!BN_copy(r, m)) {
  106.               BN_CTX_end(ctx);
                     ^
  107.               return 0;
  108.           }

crypto/bn/bn_ctx.c:195:1: Parameter `ctx->stack.depth`
    193.   }
    194.   
    195. > void BN_CTX_end(BN_CTX *ctx)
    196.   {
    197.       CTXDBG_ENTRY("BN_CTX_end", ctx);

test/bntest.c:239:9: Call
237.           BN_RECP_CTX_set(recp, b, ctx);
238.           BN_div_recp(d, c, a, recp, ctx);
239.           BN_mul(e, d, b, ctx);
               ^
240.           BN_add(d, e, c);
241.           BN_sub(d, d, a);

crypto/bn/bn_mul.c:828:1: Parameter `ctx->stack.depth`
  826.   #endif                          /* BN_RECURSION */
  827.   
  828. > int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
  829.   {
  830.       int ret = 0;

test/bntest.c:238:9: Call
236.           b->neg = rand_neg();
237.           BN_RECP_CTX_set(recp, b, ctx);
238.           BN_div_recp(d, c, a, recp, ctx);
               ^
239.           BN_mul(e, d, b, ctx);
240.           BN_add(d, e, c);

crypto/bn/bn_recp.c:89:5: Call
  87.       BIGNUM *a, *b, *d, *r;
  88.   
  89.       BN_CTX_start(ctx);
            ^
  90.       a = BN_CTX_get(ctx);
  91.       b = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:181:1: Parameter `*ctx->stack.indexes`
    179.   }
    180.   
    181. > void BN_CTX_start(BN_CTX *ctx)
    182.   {
    183.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_recp.c:106:13: Call
  104.           BN_zero(d);
  105.           if (!BN_copy(r, m)) {
  106.               BN_CTX_end(ctx);
                     ^
  107.               return 0;
  108.           }

crypto/bn/bn_ctx.c:195:1: Parameter `*ctx->stack.indexes`
    193.   }
    194.   
    195. > void BN_CTX_end(BN_CTX *ctx)
    196.   {
    197.       CTXDBG_ENTRY("BN_CTX_end", ctx);

crypto/bn/bn_ctx.c:201:27: Call
    199.           ctx->err_stack--;
    200.       else {
    201.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                     ^
    202.           /* Does this stack frame have anything to release? */
    203.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:271:1: <Offset trace>
269.   }
270.   
271. > static unsigned int BN_STACK_pop(BN_STACK *st)
272.   {
273.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:271:1: Parameter `st->depth`
      269.   }
      270.   
      271. > static unsigned int BN_STACK_pop(BN_STACK *st)
      272.   {
      273.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:271:1: <Length trace>
269.   }
270.   
271. > static unsigned int BN_STACK_pop(BN_STACK *st)
272.   {
273.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:271:1: Parameter `*st->indexes`
      269.   }
      270.   
      271. > static unsigned int BN_STACK_pop(BN_STACK *st)
      272.   {
      273.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:273:12: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `BN_div_recp` 
      271.   static unsigned int BN_STACK_pop(BN_STACK *st)
      272.   {
      273.       return st->indexes[--(st->depth)];
                        ^
      274.   }
      275.   
