crypto/rand/rand_lib.c:161: error: BUFFER_OVERRUN_L3
  Offset added: [0, 15] Size: [0, +oo] by call to `RAND_DRBG_generate`.
Showing all 9 steps of the trace


crypto/rand/rand_lib.c:149:1: Parameter `min_len`
147.   }
148.   
149. > size_t drbg_entropy_from_parent(RAND_DRBG *drbg,
150.                                   unsigned char **pout,
151.                                   int entropy, size_t min_len, size_t max_len)

crypto/rand/rand_lib.c:161:10: Call
159.   
160.       /* Get random from parent, include our state as additional input. */
161.       st = RAND_DRBG_generate(drbg->parent, drbg->randomness, min_len, 0,
                ^
162.                               (unsigned char *)drbg, sizeof(*drbg));
163.       if (st == 0)

crypto/rand/drbg_lib.c:248:1: Parameter `outlen`
  246.    * sent in |adin| and |adinlen|.
  247.    */
  248. > int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,
  249.                          int prediction_resistance,
  250.                          const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_lib.c:281:10: Call
  279.       }
  280.   
  281.       if (!ctr_generate(drbg, out, outlen, adin, adinlen)) {
                  ^
  282.           drbg->state = DRBG_ERROR;
  283.           RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);

crypto/rand/drbg_rand.c:261:1: <Offset trace>
259.   }
260.   
261. > int ctr_generate(RAND_DRBG *drbg,
262.                    unsigned char *out, size_t outlen,
263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:261:1: Parameter `outlen`
    259.   }
    260.   
    261. > int ctr_generate(RAND_DRBG *drbg,
    262.                    unsigned char *out, size_t outlen,
    263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:261:1: <Length trace>
259.   }
260.   
261. > int ctr_generate(RAND_DRBG *drbg,
262.                    unsigned char *out, size_t outlen,
263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:261:1: Parameter `drbg->ctr.K[*]`
    259.   }
    260.   
    261. > int ctr_generate(RAND_DRBG *drbg,
    262.                    unsigned char *out, size_t outlen,
    263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:283:13: Array access: Offset added: [0, 15] Size: [0, +oo] by call to `RAND_DRBG_generate` 
    281.               /* Use K as temp space as it will be updated */
    282.               AES_encrypt(ctr->V, ctr->K, &ctr->ks);
    283.               memcpy(out, ctr->K, outlen);
                       ^
    284.               break;
    285.           }
