crypto/bn/bn_print.c:104: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [0, +oo].
Showing all 11 steps of the trace


crypto/bn/bn_print.c:72:9: <Length trace>
70.        *     <= BN_num_bits(a)/10 + BN_num_bits/1000 + 1 + 1
71.        */
72.       i = BN_num_bits(a) * 3;
              ^
73.       num = (i / 10 + i / 1000 + 1) + 1;
74.       bn_data = OPENSSL_malloc((num / BN_DEC_NUM + 1) * sizeof(BN_ULONG));

crypto/bn/bn_print.c:72:9: Call
70.        *     <= BN_num_bits(a)/10 + BN_num_bits/1000 + 1 + 1
71.        */
72.       i = BN_num_bits(a) * 3;
              ^
73.       num = (i / 10 + i / 1000 + 1) + 1;
74.       bn_data = OPENSSL_malloc((num / BN_DEC_NUM + 1) * sizeof(BN_ULONG));

crypto/bn/bn_lib.c:167:9: Assignment
  165.   
  166.       if (BN_is_zero(a))
  167.           return 0;
                 ^
  168.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));
  169.   }

crypto/bn/bn_print.c:72:5: Assignment
70.        *     <= BN_num_bits(a)/10 + BN_num_bits/1000 + 1 + 1
71.        */
72.       i = BN_num_bits(a) * 3;
          ^
73.       num = (i / 10 + i / 1000 + 1) + 1;
74.       bn_data = OPENSSL_malloc((num / BN_DEC_NUM + 1) * sizeof(BN_ULONG));

crypto/bn/bn_print.c:73:5: Assignment
71.        */
72.       i = BN_num_bits(a) * 3;
73.       num = (i / 10 + i / 1000 + 1) + 1;
          ^
74.       bn_data = OPENSSL_malloc((num / BN_DEC_NUM + 1) * sizeof(BN_ULONG));
75.       buf = OPENSSL_malloc(num + 3);

crypto/bn/bn_print.c:74:15: Call
72.       i = BN_num_bits(a) * 3;
73.       num = (i / 10 + i / 1000 + 1) + 1;
74.       bn_data = OPENSSL_malloc((num / BN_DEC_NUM + 1) * sizeof(BN_ULONG));
                    ^
75.       buf = OPENSSL_malloc(num + 3);
76.       if ((buf == NULL) || (bn_data == NULL)) {

crypto/mem.c:79:9: Assignment
  77.   
  78.       if (num <= 0)
  79.           return NULL;
                ^
  80.   
  81.       allow_customize = 0;

crypto/bn/bn_print.c:74:5: Assignment
72.       i = BN_num_bits(a) * 3;
73.       num = (i / 10 + i / 1000 + 1) + 1;
74.       bn_data = OPENSSL_malloc((num / BN_DEC_NUM + 1) * sizeof(BN_ULONG));
          ^
75.       buf = OPENSSL_malloc(num + 3);
76.       if ((buf == NULL) || (bn_data == NULL)) {

crypto/bn/bn_print.c:85:5: Assignment
83.   #define BUF_REMAIN (num+3 - (size_t)(p - buf))
84.       p = buf;
85.       lp = bn_data;
          ^
86.       if (BN_is_zero(t)) {
87.           *(p++) = '0';

crypto/bn/bn_print.c:98:9: Assignment
96.               lp++;
97.           }
98.           lp--;
               ^
99.           /*
100.            * We now have a series of blocks, BN_DEC_NUM chars in length, where

crypto/bn/bn_print.c:104:50: Array access: Offset: [-1, +oo] Size: [0, +oo]
102.            * order.
103.            */
104.           BIO_snprintf(p, BUF_REMAIN, BN_DEC_FMT1, *lp);
                                                        ^
105.           while (*p)
106.               p++;
