test/bntest.c:2096: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_is_prime_fasttest_ex`.
Showing all 12 steps of the trace


test/bntest.c:2095:10: Call
2093.        * do_trial_division was set. */
2094.       if (r == NULL ||
2095.           !BN_set_word(r, 3) ||
                 ^
2096.           BN_is_prime_fasttest_ex(r, 3 /* nchecks */, ctx,
2097.                                   0 /* do_trial_division */, NULL) != 1 ||

crypto/bn/bn_lib.c:395:1: Parameter `*a->d`
  393.   }
  394.   
  395. > int BN_set_word(BIGNUM *a, BN_ULONG w)
  396.   {
  397.       bn_check_top(a);

crypto/bn/bn_lib.c:398:9: Call
  396.   {
  397.       bn_check_top(a);
  398.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                 ^
  399.           return (0);
  400.       a->neg = 0;

crypto/bn/bn_lcl.h:660:1: Parameter `*a->d`
    658.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
    659.   
    660. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
    661.   {
    662.       if (bits > (INT_MAX - BN_BITS2 + 1))

test/bntest.c:2096:9: Call
2094.       if (r == NULL ||
2095.           !BN_set_word(r, 3) ||
2096.           BN_is_prime_fasttest_ex(r, 3 /* nchecks */, ctx,
                ^
2097.                                   0 /* do_trial_division */, NULL) != 1 ||
2098.           BN_is_prime_fasttest_ex(r, 3 /* nchecks */, ctx,

crypto/bn/bn_prime.c:153:1: Parameter `*a->d`
  151.   }
  152.   
  153. > int BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed,
  154.                               int do_trial_division, BN_GENCB *cb)
  155.   {

crypto/bn/bn_prime.c:197:10: Call
  195.   
  196.       /* compute A1 := a - 1 */
  197.       if (!BN_copy(A1, a))
                  ^
  198.           goto err;
  199.       if (!BN_sub_word(A1, 1))

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
    321.   }
    322.   
    323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    324.   {
    325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*b->d`
    321.   }
    322.   
    323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    324.   {
    325.       bn_check_top(b);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_is_prime_fasttest_ex` 
    331.   
    332.       if (b->top > 0)
    333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                   ^
    334.   
    335.       a->top = b->top;
