crypto/bn/bn_gcd.c:635: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, 8388607] by call to `BN_div`.
Showing all 15 steps of the trace


crypto/bn/bn_gcd.c:568:9: Call
566.   
567.       BN_CTX_start(ctx);
568.       A = BN_CTX_get(ctx);
               ^
569.       B = BN_CTX_get(ctx);
570.       X = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:275:5: Call
  273.       }
  274.       /* OK, make sure the returned bignum is "zero" */
  275.       BN_zero(ret);
             ^
  276.       ctx->used++;
  277.       CTXDBG_RET(ctx, ret);

crypto/bn/bn_lib.c:520:1: Parameter `*a->d`
    518.   }
    519.   
    520. > int BN_set_word(BIGNUM *a, BN_ULONG w)
    521.   {
    522.       bn_check_top(a);

crypto/bn/bn_lib.c:523:9: Call
    521.   {
    522.       bn_check_top(a);
    523.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                   ^
    524.           return (0);
    525.       a->neg = 0;

crypto/bn/bn_lcl.h:777:1: Parameter `*a->d`
      775.   int bn_probable_prime_dh_coprime(BIGNUM *rnd, int bits, BN_CTX *ctx);
      776.   
      777. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
      778.   {
      779.       if (bits > (INT_MAX - BN_BITS2 + 1))

crypto/bn/bn_gcd.c:635:18: Call
633.   
634.               /* (D, M) := (A/B, A%B) ... */
635.               if (!BN_div(D, M, &local_A, B, ctx))
                        ^
636.                   goto err;
637.               /* Ensure local_A goes out of scope before any further use of A */

crypto/bn/bn_div.c:188:1: Parameter `*dv->d`
  186.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
  187.    */
  188. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
  189.              BN_CTX *ctx)
  190.   {

crypto/bn/bn_div.c:306:10: Call
  304.       /* Setup to 'res' */
  305.       res->neg = (num->neg ^ divisor->neg);
  306.       if (!bn_wexpand(res, (loop + 1)))
                  ^
  307.           goto err;
  308.       res->top = loop - no_branch;

crypto/bn/bn_lib.c:1071:1: Parameter `*a->d`
    1069.   }
    1070.   
    1071. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
    1072.   {
    1073.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_div.c:453:9: Call
  451.            */
  452.           int neg = num->neg;
  453.           BN_rshift(rm, snum, norm_shift);
                 ^
  454.           if (!BN_is_zero(rm))
  455.               rm->neg = neg;

crypto/bn/bn_shift.c:168:1: <Length trace>
166.   }
167.   
168. > int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
169.   {
170.       int i, j, nw, lb, rb;

crypto/bn/bn_shift.c:168:1: Parameter `*a->d`
    166.   }
    167.   
    168. > int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
    169.   {
    170.       int i, j, nw, lb, rb;

crypto/bn/bn_shift.c:199:5: Assignment
    197.       }
    198.   
    199.       f = &(a->d[nw]);
               ^
    200.       t = r->d;
    201.       j = a->top - nw;

crypto/bn/bn_shift.c:208:15: Assignment
    206.               *(t++) = *(f++);
    207.       } else {
    208.           l = *(f++);
                         ^
    209.           for (i = j - 1; i != 0; i--) {
    210.               tmp = (l >> rb) & BN_MASK2;

crypto/bn/bn_shift.c:211:17: Array access: Offset: [1, +oo] Size: [0, 8388607] by call to `BN_div` 
    209.           for (i = j - 1; i != 0; i--) {
    210.               tmp = (l >> rb) & BN_MASK2;
    211.               l = *(f++);
                           ^
    212.               *(t++) = (tmp | (l << lb)) & BN_MASK2;
    213.           }
