crypto/rand/rand_lib.c:648: error: BUFFER_OVERRUN_L3
  Offset added: [0, 15] Size: [0, +oo] by call to `RAND_DRBG_generate`.
Showing all 9 steps of the trace


crypto/rand/rand_lib.c:633:1: Parameter `num`
631.    * sure we're instantiated and use the private DRBG.
632.    */
633. > int RAND_priv_bytes(unsigned char *buf, int num)
634.   {
635.       const RAND_METHOD *meth = RAND_get_rand_method();

crypto/rand/rand_lib.c:648:11: Call
646.       /* We have to lock the DRBG before generating bits from it. */
647.       CRYPTO_THREAD_write_lock(drbg->lock);
648.       ret = RAND_DRBG_generate(drbg, buf, num, 0, NULL, 0);
                 ^
649.       CRYPTO_THREAD_unlock(drbg->lock);
650.       return ret;

crypto/rand/drbg_lib.c:363:1: Parameter `outlen`
  361.    *
  362.    */
  363. > int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,
  364.                          int prediction_resistance,
  365.                          const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_lib.c:409:10: Call
  407.       }
  408.   
  409.       if (!ctr_generate(drbg, out, outlen, adin, adinlen)) {
                  ^
  410.           drbg->state = DRBG_ERROR;
  411.           RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);

crypto/rand/drbg_rand.c:266:1: <Offset trace>
264.   }
265.   
266. > int ctr_generate(RAND_DRBG *drbg,
267.                    unsigned char *out, size_t outlen,
268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: Parameter `outlen`
    264.   }
    265.   
    266. > int ctr_generate(RAND_DRBG *drbg,
    267.                    unsigned char *out, size_t outlen,
    268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: <Length trace>
264.   }
265.   
266. > int ctr_generate(RAND_DRBG *drbg,
267.                    unsigned char *out, size_t outlen,
268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: Parameter `drbg->ctr.K[*]`
    264.   }
    265.   
    266. > int ctr_generate(RAND_DRBG *drbg,
    267.                    unsigned char *out, size_t outlen,
    268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:288:13: Array access: Offset added: [0, 15] Size: [0, +oo] by call to `RAND_DRBG_generate` 
    286.               /* Use K as temp space as it will be updated */
    287.               AES_encrypt(ctr->V, ctr->K, &ctr->ks);
    288.               memcpy(out, ctr->K, outlen);
                       ^
    289.               break;
    290.           }
