test/sslapitest.c:3815: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `SSL_set_srp_server_param`.
Showing all 15 steps of the trace


test/sslapitest.c:3809:12: Call
3807.       }
3808.   
3809.       user = SRP_VBASE_get1_by_user(vbase, username);
                   ^
3810.       if (user == NULL) {
3811.           *ad = SSL_AD_INTERNAL_ERROR;

crypto/srp/srp_vfy.c:534:16: Call
  532.   
  533.       if ((user = find_user(vb, username)) != NULL)
  534.           return srp_user_pwd_dup(user);
                        ^
  535.   
  536.       if ((vb->seed_key == NULL) ||

crypto/srp/srp_vfy.c:247:1: Parameter `src->v->top`
    245.   }
    246.   
    247. > static SRP_user_pwd *srp_user_pwd_dup(SRP_user_pwd *src)
    248.   {
    249.       SRP_user_pwd *ret;

test/sslapitest.c:3815:9: Call
3813.       }
3814.   
3815.       if (SSL_set_srp_server_param(s, user->N, user->g, user->s, user->v,
                ^
3816.                                    user->info) <= 0) {
3817.           *ad = SSL_AD_INTERNAL_ERROR;

ssl/tls_srp.c:196:1: Parameter `N->top`
  194.   }
  195.   
  196. > int SSL_set_srp_server_param(SSL *s, const BIGNUM *N, const BIGNUM *g,
  197.                                BIGNUM *sa, BIGNUM *v, char *info)
  198.   {

ssl/tls_srp.c:206:28: Call
  204.               }
  205.           } else
  206.               s->srp_ctx.N = BN_dup(N);
                                    ^
  207.       }
  208.       if (g != NULL) {

crypto/bn/bn_lib.c:266:1: Parameter `a->top`
    264.   }
    265.   
    266. > BIGNUM *BN_dup(const BIGNUM *a)
    267.   {
    268.       BIGNUM *t;

crypto/bn/bn_lib.c:277:10: Call
    275.       if (t == NULL)
    276.           return NULL;
    277.       if (!BN_copy(t, a)) {
                    ^
    278.           BN_free(t);
    279.           return NULL;

crypto/bn/bn_lib.c:285:1: <Offset trace>
283.   }
284.   
285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
286.   {
287.       bn_check_top(b);

crypto/bn/bn_lib.c:285:1: Parameter `b->top`
      283.   }
      284.   
      285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      286.   {
      287.       bn_check_top(b);

crypto/bn/bn_lib.c:285:1: <Length trace>
283.   }
284.   
285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
286.   {
287.       bn_check_top(b);

crypto/bn/bn_lib.c:285:1: Parameter `*a->d`
      283.   }
      284.   
      285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      286.   {
      287.       bn_check_top(b);

crypto/bn/bn_lib.c:291:9: Call
      289.       if (a == b)
      290.           return a;
      291.       if (bn_wexpand(a, b->top) == NULL)
                     ^
      292.           return NULL;
      293.   

crypto/bn/bn_lib.c:910:1: Parameter `*a->d`
        908.   }
        909.   
        910. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
        911.   {
        912.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:295:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `SSL_set_srp_server_param` 
      293.   
      294.       if (b->top > 0)
      295.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      296.   
      297.       a->top = b->top;
