test/bntest.c:244: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, +oo] by call to `BN_div_recp`.
Showing all 18 steps of the trace


test/bntest.c:243:9: Call
241.           a->neg = rand_neg();
242.           b->neg = rand_neg();
243.           BN_RECP_CTX_set(recp, b, ctx);
               ^
244.           BN_div_recp(d, c, a, recp, ctx);
245.           BN_mul(e, d, b, ctx);

crypto/bn/bn_recp.c:44:1: Parameter `*recp->Nr.d`
  42.   }
  43.   
  44. > int BN_RECP_CTX_set(BN_RECP_CTX *recp, const BIGNUM *d, BN_CTX *ctx)
  45.   {
  46.       if (!BN_copy(&(recp->N), d))

test/bntest.c:244:9: Call
242.           b->neg = rand_neg();
243.           BN_RECP_CTX_set(recp, b, ctx);
244.           BN_div_recp(d, c, a, recp, ctx);
               ^
245.           BN_mul(e, d, b, ctx);
246.           BN_add(d, e, c);

crypto/bn/bn_recp.c:83:1: Parameter `*recp->Nr.d`
  81.   }
  82.   
  83. > int BN_div_recp(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m,
  84.                   BN_RECP_CTX *recp, BN_CTX *ctx)
  85.   {

crypto/bn/bn_recp.c:126:23: Call
  124.       /* Nr := round(2^i / N) */
  125.       if (i != recp->shift)
  126.           recp->shift = BN_reciprocal(&(recp->Nr), &(recp->N), i, ctx);
                               ^
  127.       /* BN_reciprocal could have returned -1 for an error */
  128.       if (recp->shift == -1)

crypto/bn/bn_recp.c:179:1: Parameter `*r->d`
    177.    */
    178.   /* r := 2^len / m */
    179. > int BN_reciprocal(BIGNUM *r, const BIGNUM *m, int len, BN_CTX *ctx)
    180.   {
    181.       int ret = -1;

crypto/bn/bn_recp.c:191:10: Call
    189.           goto err;
    190.   
    191.       if (!BN_div(r, NULL, t, m, ctx))
                    ^
    192.           goto err;
    193.   

crypto/bn/bn_div.c:140:1: Parameter `*dv->d`
      138.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
      139.    */
      140. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
      141.              BN_CTX *ctx)
      142.   {

crypto/bn/bn_div.c:257:10: Call
      255.   
      256.       /* Setup to 'res' */
      257.       if (!bn_wexpand(res, (loop + 1)))
                      ^
      258.           goto err;
      259.       res->neg = (num->neg ^ divisor->neg);

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
        946.   }
        947.   
        948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
        949.   {
        950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:950:37: Call
        948.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
        949.   {
        950.       return (words <= a->dmax) ? a : bn_expand2(a, words);
                                                   ^
        951.   }
        952.   

crypto/bn/bn_lib.c:284:1: Parameter `*b->d`
          282.    */
          283.   
          284. > BIGNUM *bn_expand2(BIGNUM *b, int words)
          285.   {
          286.       bn_check_top(b);

crypto/bn/bn_lib.c:289:23: Call
          287.   
          288.       if (words > b->dmax) {
          289.           BN_ULONG *a = bn_expand_internal(b, words);
                                       ^
          290.           if (!a)
          291.               return NULL;

crypto/bn/bn_lib.c:246:1: <Offset trace>
244.   /* This is used by bn_expand2() */
245.   /* The caller MUST check that words > b->dmax before calling this */
246. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
247.   {
248.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:246:1: Parameter `b->top`
            244.   /* This is used by bn_expand2() */
            245.   /* The caller MUST check that words > b->dmax before calling this */
            246. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
            247.   {
            248.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:246:1: <Length trace>
244.   /* This is used by bn_expand2() */
245.   /* The caller MUST check that words > b->dmax before calling this */
246. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
247.   {
248.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:246:1: Parameter `*b->d`
            244.   /* This is used by bn_expand2() */
            245.   /* The caller MUST check that words > b->dmax before calling this */
            246. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
            247.   {
            248.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:271:9: Array access: Offset added: [8, +oo] Size: [0, +oo] by call to `BN_div_recp` 
            269.       assert(b->top <= words);
            270.       if (b->top > 0)
            271.           memcpy(a, b->d, sizeof(*a) * b->top);
                           ^
            272.   
            273.       return a;
