test/bntest.c:1243: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_rand`.
Showing all 12 steps of the trace


test/bntest.c:1243:9: Call
1241.   
1242.       for (i = 0; i < num0; i++) {
1243.           BN_rand(a, 512, 0, 0);
                ^
1244.           BN_copy(b, BN_value_one());
1245.           a->neg = rand_neg();

crypto/bn/bn_rand.c:200:1: Parameter `*rnd->d`
  198.   }
  199.   
  200. > int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  201.   {
  202.       return bnrand(0, rnd, bits, top, bottom);

crypto/bn/bn_rand.c:202:12: Call
  200.   int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  201.   {
  202.       return bnrand(0, rnd, bits, top, bottom);
                    ^
  203.   }
  204.   

crypto/bn/bn_rand.c:119:1: Parameter `*rnd->d`
    117.   #include <openssl/sha.h>
    118.   
    119. > static int bnrand(int pseudorand, BIGNUM *rnd, int bits, int top, int bottom)
    120.   {
    121.       unsigned char *buf = NULL;

test/bntest.c:1243:9: Call
1241.   
1242.       for (i = 0; i < num0; i++) {
1243.           BN_rand(a, 512, 0, 0);
                ^
1244.           BN_copy(b, BN_value_one());
1245.           a->neg = rand_neg();

crypto/bn/bn_rand.c:200:1: Parameter `*rnd->d`
  198.   }
  199.   
  200. > int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  201.   {
  202.       return bnrand(0, rnd, bits, top, bottom);

crypto/bn/bn_rand.c:202:12: Call
  200.   int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  201.   {
  202.       return bnrand(0, rnd, bits, top, bottom);
                    ^
  203.   }
  204.   

crypto/bn/bn_rand.c:119:1: Parameter `*rnd->d`
    117.   #include <openssl/sha.h>
    118.   
    119. > static int bnrand(int pseudorand, BIGNUM *rnd, int bits, int top, int bottom)
    120.   {
    121.       unsigned char *buf = NULL;

crypto/bn/bn_rand.c:131:9: Call
    129.   
    130.       if (bits == 0) {
    131.           BN_zero(rnd);
                   ^
    132.           return 1;
    133.       }

crypto/bn/bn_lib.c:530:1: <Length trace>
528.   }
529.   
530. > int BN_set_word(BIGNUM *a, BN_ULONG w)
531.   {
532.       bn_check_top(a);

crypto/bn/bn_lib.c:530:1: Parameter `*a->d`
      528.   }
      529.   
      530. > int BN_set_word(BIGNUM *a, BN_ULONG w)
      531.   {
      532.       bn_check_top(a);

crypto/bn/bn_lib.c:536:5: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_rand` 
      534.           return (0);
      535.       a->neg = 0;
      536.       a->d[0] = w;
                 ^
      537.       a->top = (w ? 1 : 0);
      538.       bn_check_top(a);
