crypto/ec/ecdsa_ossl.c:254: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_rshift`.
Showing all 14 steps of the trace


crypto/ec/ecdsa_ossl.c:249:10: Call
247.       if (8 * dgst_len > i)
248.           dgst_len = (i + 7) / 8;
249.       if (!BN_bin2bn(dgst, dgst_len, m)) {
                ^
250.           ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
251.           goto err;

crypto/bn/bn_lib.c:399:1: Parameter `*ret->d`
  397.   }
  398.   
  399. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
  400.   {
  401.       unsigned int i, m;

crypto/ec/ecdsa_ossl.c:254:32: Call
252.       }
253.       /* If still too long truncate remaining bits with a shift */
254.       if ((8 * dgst_len > i) && !BN_rshift(m, m, 8 - (i & 0x7))) {
                                      ^
255.           ECerr(EC_F_OSSL_ECDSA_SIGN_SIG, ERR_R_BN_LIB);
256.           goto err;

crypto/bn/bn_shift.c:122:1: Parameter `*r->d`
  120.   }
  121.   
  122. > int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
  123.   {
  124.       int i, j, nw, lb, rb;

crypto/bn/bn_shift.c:145:13: Call
  143.       i = (BN_num_bits(a) - n + (BN_BITS2 - 1)) / BN_BITS2;
  144.       if (r != a) {
  145.           if (bn_wexpand(r, i) == NULL)
                     ^
  146.               return (0);
  147.           r->neg = a->neg;

crypto/bn/bn_lib.c:940:1: Parameter `*a->d`
    938.   }
    939.   
    940. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
    941.   {
    942.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:942:37: Call
    940.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
    941.   {
    942.       return (words <= a->dmax) ? a : bn_expand2(a, words);
                                               ^
    943.   }
    944.   

crypto/bn/bn_lib.c:273:1: Parameter `*b->d`
      271.    */
      272.   
      273. > BIGNUM *bn_expand2(BIGNUM *b, int words)
      274.   {
      275.       bn_check_top(b);

crypto/bn/bn_lib.c:278:23: Call
      276.   
      277.       if (words > b->dmax) {
      278.           BN_ULONG *a = bn_expand_internal(b, words);
                                   ^
      279.           if (!a)
      280.               return NULL;

crypto/bn/bn_lib.c:235:1: <Offset trace>
233.   /* This is used by bn_expand2() */
234.   /* The caller MUST check that words > b->dmax before calling this */
235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
236.   {
237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:235:1: Parameter `b->top`
        233.   /* This is used by bn_expand2() */
        234.   /* The caller MUST check that words > b->dmax before calling this */
        235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
        236.   {
        237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:235:1: <Length trace>
233.   /* This is used by bn_expand2() */
234.   /* The caller MUST check that words > b->dmax before calling this */
235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
236.   {
237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:235:1: Parameter `*b->d`
        233.   /* This is used by bn_expand2() */
        234.   /* The caller MUST check that words > b->dmax before calling this */
        235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
        236.   {
        237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:260:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_rshift` 
        258.       assert(b->top <= words);
        259.       if (b->top > 0)
        260.           memcpy(a, b->d, sizeof(*a) * b->top);
                       ^
        261.   
        262.       return a;
