crypto/bn/bn_lib.c:293: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607].
Showing all 10 steps of the trace


crypto/bn/bn_lib.c:246:1: <Length trace>
244.   /* This is used by bn_expand2() */
245.   /* The caller MUST check that words > b->dmax before calling this */
246. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
247.   {
248.       BN_ULONG *A, *a = NULL;

crypto/bn/bn_lib.c:246:1: Parameter `words`
244.   /* This is used by bn_expand2() */
245.   /* The caller MUST check that words > b->dmax before calling this */
246. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
247.   {
248.       BN_ULONG *A, *a = NULL;

crypto/bn/bn_lib.c:265:17: Call
263.           a = A = OPENSSL_secure_zalloc(words * sizeof(*a));
264.       else
265.           a = A = OPENSSL_zalloc(words * sizeof(*a));
                       ^
266.       if (A == NULL) {
267.           BNerr(BN_F_BN_EXPAND_INTERNAL, ERR_R_MALLOC_FAILURE);

crypto/mem.c:186:1: Parameter `num`
  184.   }
  185.   
  186. > void *CRYPTO_zalloc(size_t num, const char *file, int line)
  187.   {
  188.       void *ret = CRYPTO_malloc(num, file, line);

crypto/mem.c:188:17: Call
  186.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
  187.   {
  188.       void *ret = CRYPTO_malloc(num, file, line);
                         ^
  189.   
  190.       FAILTEST();

crypto/mem.c:166:9: Assignment
    164.   
    165.       if (num == 0)
    166.           return NULL;
                   ^
    167.   
    168.       FAILTEST();

crypto/mem.c:188:5: Assignment
  186.   void *CRYPTO_zalloc(size_t num, const char *file, int line)
  187.   {
  188.       void *ret = CRYPTO_malloc(num, file, line);
             ^
  189.   
  190.       FAILTEST();

crypto/mem.c:193:5: Assignment
  191.       if (ret != NULL)
  192.           memset(ret, 0, num);
  193.       return ret;
             ^
  194.   }
  195.   

crypto/bn/bn_lib.c:265:13: Assignment
263.           a = A = OPENSSL_secure_zalloc(words * sizeof(*a));
264.       else
265.           a = A = OPENSSL_zalloc(words * sizeof(*a));
                   ^
266.       if (A == NULL) {
267.           BNerr(BN_F_BN_EXPAND_INTERNAL, ERR_R_MALLOC_FAILURE);

crypto/bn/bn_lib.c:293:13: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607]
291.               A[1] = a1;
292.               A[2] = a2;
293.               A[3] = a3;
                   ^
294.           }
295.           switch (b->top & 3) {
