test/bntest.c:1963: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_is_prime_fasttest_ex`.
Showing all 12 steps of the trace


test/bntest.c:1962:17: Call
1960.        */
1961.       if (!TEST_ptr(r = BN_new())
1962.               || !TEST_true(BN_set_word(r, 3))
                        ^
1963.               || !TEST_int_eq(BN_is_prime_fasttest_ex(r, 3 /* nchecks */, ctx,
1964.                                   0 /* do_trial_division */, NULL), 1)

crypto/bn/bn_lib.c:387:1: Parameter `*a->d`
  385.   }
  386.   
  387. > int BN_set_word(BIGNUM *a, BN_ULONG w)
  388.   {
  389.       bn_check_top(a);

crypto/bn/bn_lib.c:390:9: Call
  388.   {
  389.       bn_check_top(a);
  390.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                 ^
  391.           return 0;
  392.       a->neg = 0;

crypto/bn/bn_lcl.h:651:1: Parameter `*a->d`
    649.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
    650.   
    651. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
    652.   {
    653.       if (bits > (INT_MAX - BN_BITS2 + 1))

test/bntest.c:1963:17: Call
1961.       if (!TEST_ptr(r = BN_new())
1962.               || !TEST_true(BN_set_word(r, 3))
1963.               || !TEST_int_eq(BN_is_prime_fasttest_ex(r, 3 /* nchecks */, ctx,
                        ^
1964.                                   0 /* do_trial_division */, NULL), 1)
1965.               || !TEST_int_eq(BN_is_prime_fasttest_ex(r, 3 /* nchecks */, ctx,

crypto/bn/bn_prime.c:151:1: Parameter `*a->d`
  149.   }
  150.   
  151. > int BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed,
  152.                               int do_trial_division, BN_GENCB *cb)
  153.   {

crypto/bn/bn_prime.c:195:10: Call
  193.   
  194.       /* compute A1 := a - 1 */
  195.       if (!BN_copy(A1, a))
                  ^
  196.           goto err;
  197.       if (!BN_sub_word(A1, 1))

crypto/bn/bn_lib.c:312:1: <Offset trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `b->top`
    310.   }
    311.   
    312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    313.   {
    314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: <Length trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `*b->d`
    310.   }
    311.   
    312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    313.   {
    314.       bn_check_top(b);

crypto/bn/bn_lib.c:322:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_is_prime_fasttest_ex` 
    320.   
    321.       if (b->top > 0)
    322.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                   ^
    323.   
    324.       if (BN_get_flags(b, BN_FLG_CONSTTIME) != 0)
