crypto/bn/bn_div.c:259: error: BUFFER_OVERRUN_S2
  Offset: [max(0, `num->top`), `num->top` + 191] Size: [0, 8388607] by call to `BN_lshift`.
Showing all 11 steps of the trace


crypto/bn/bn_div.c:189:1: Parameter `num->top`
187.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
188.    */
189. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
190.              BN_CTX *ctx)
191.   {

crypto/bn/bn_div.c:259:11: Call
257.       sdiv->neg = 0;
258.       norm_shift += BN_BITS2;
259.       if (!(BN_lshift(snum, num, norm_shift)))
                 ^
260.           goto err;
261.       snum->neg = 0;

crypto/bn/bn_shift.c:130:1: Parameter `a->top`
  128.   }
  129.   
  130. > int BN_lshift(BIGNUM *r, const BIGNUM *a, int n)
  131.   {
  132.       int i, nw, lb, rb;

crypto/bn/bn_shift.c:163:5: Assignment
  161.           }
  162.       memset(t, 0, sizeof(*t) * nw);
  163.       r->top = a->top + nw + 1;
             ^
  164.       bn_correct_top(r);
  165.       bn_check_top(r);

crypto/bn/bn_shift.c:164:5: Call
  162.       memset(t, 0, sizeof(*t) * nw);
  163.       r->top = a->top + nw + 1;
  164.       bn_correct_top(r);
             ^
  165.       bn_check_top(r);
  166.       return (1);

crypto/bn/bn_lib.c:1000:1: <Offset trace>
998.   }
999.   
1000. > void bn_correct_top(BIGNUM *a)
1001.   {
1002.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:1000:1: Parameter `a->top`
    998.   }
    999.   
    1000. > void bn_correct_top(BIGNUM *a)
    1001.   {
    1002.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:1003:5: Assignment
    1001.   {
    1002.       BN_ULONG *ftl;
    1003.       int tmp_top = a->top;
                ^
    1004.   
    1005.       if (tmp_top > 0) {

crypto/bn/bn_lib.c:1000:1: <Length trace>
998.   }
999.   
1000. > void bn_correct_top(BIGNUM *a)
1001.   {
1002.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:1000:1: Parameter `*a->d`
    998.   }
    999.   
    1000. > void bn_correct_top(BIGNUM *a)
    1001.   {
    1002.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:1006:14: Array access: Offset: [max(0, num->top), num->top + 191] Size: [0, 8388607] by call to `BN_lshift` 
    1004.   
    1005.       if (tmp_top > 0) {
    1006.           for (ftl = &(a->d[tmp_top - 1]); tmp_top > 0; tmp_top--)
                         ^
    1007.               if (*(ftl--))
    1008.                   break;
