crypto/ec/ecdsa_ossl.c:254: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, 8388607] by call to `BN_rshift`.
Showing all 8 steps of the trace


crypto/ec/ecdsa_ossl.c:249:10: Call
247.       if (8 * dgst_len > i)
248.           dgst_len = (i + 7) / 8;
249.       if (!BN_bin2bn(dgst, dgst_len, m)) {
                ^
250.           ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
251.           goto err;

crypto/bn/bn_lib.c:399:1: Parameter `*ret->d`
  397.   }
  398.   
  399. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
  400.   {
  401.       unsigned int i, m;

crypto/ec/ecdsa_ossl.c:254:32: Call
252.       }
253.       /* If still too long truncate remaining bits with a shift */
254.       if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) {
                                      ^
255.           ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
256.           goto err;

crypto/bn/bn_shift.c:122:1: <Length trace>
120.   }
121.   
122. > int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
123.   {
124.       int i, j, nw, lb, rb;

crypto/bn/bn_shift.c:122:1: Parameter `*a->d`
  120.   }
  121.   
  122. > int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
  123.   {
  124.       int i, j, nw, lb, rb;

crypto/bn/bn_shift.c:153:5: Assignment
  151.       }
  152.   
  153.       f = &(a->d[nw]);
             ^
  154.       t = r->d;
  155.       j = a->top - nw;

crypto/bn/bn_shift.c:162:15: Assignment
  160.               *(t++) = *(f++);
  161.       } else {
  162.           l = *(f++);
                       ^
  163.           for (i = j - 1; i != 0; i--) {
  164.               tmp = (l >> rb) & BN_MASK2;

crypto/bn/bn_shift.c:165:17: Array access: Offset: [1, +oo] Size: [0, 8388607] by call to `BN_rshift` 
  163.           for (i = j - 1; i != 0; i--) {
  164.               tmp = (l >> rb) & BN_MASK2;
  165.               l = *(f++);
                         ^
  166.               *(t++) = (tmp | (l << lb)) & BN_MASK2;
  167.           }
