crypto/rsa/rsa_ossl.c:892: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, 8388607] by call to `bn_correct_top`.
Showing all 10 steps of the trace


crypto/rsa/rsa_ossl.c:688:17: Call
686.                                         ctx)
687.               || !bn_mul_fixed_top(r0, r1, rsa->q, ctx)
688.               || !bn_mod_add_fixed_top(r0, r0, m1, rsa->n))
                       ^
689.               goto err;
690.   

crypto/bn/bn_mod.c:66:10: Assignment
  64.       bp = b->d != NULL ? b->d : tp;
  65.   
  66.       for (i = 0, ai = 0, bi = 0, carry = 0; i < mtop;) {
                 ^
  67.           mask = (BN_ULONG)0 - ((i - a->top) >> (8 * sizeof(i) - 1));
  68.           temp = ((ap[ai] & mask) + carry) & BN_MASK2;

crypto/bn/bn_mod.c:85:5: Assignment
  83.           ((volatile BN_ULONG *)tp)[i] = 0;
  84.       }
  85.       r->top = mtop;
            ^
  86.       r->flags |= BN_FLG_FIXED_TOP;
  87.       r->neg = 0;

crypto/rsa/rsa_ossl.c:892:13: Call
890.                   goto err;
891.           } else {
892.               bn_correct_top(r0);
                   ^
893.               if (!rsa->meth->bn_mod_exp(vrfy, r0, rsa->e, rsa->n, ctx,
894.                                          rsa->_method_mod_n))

crypto/bn/bn_lib.c:953:1: <Offset trace>
951.   }
952.   
953. > void bn_correct_top(BIGNUM *a)
954.   {
955.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:953:1: Parameter `a->top`
  951.   }
  952.   
  953. > void bn_correct_top(BIGNUM *a)
  954.   {
  955.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:956:5: Assignment
  954.   {
  955.       BN_ULONG *ftl;
  956.       int tmp_top = a->top;
             ^
  957.   
  958.       if (tmp_top > 0) {

crypto/bn/bn_lib.c:953:1: <Length trace>
951.   }
952.   
953. > void bn_correct_top(BIGNUM *a)
954.   {
955.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:953:1: Parameter `*a->d`
  951.   }
  952.   
  953. > void bn_correct_top(BIGNUM *a)
  954.   {
  955.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:959:14: Array access: Offset: [1, +oo] Size: [0, 8388607] by call to `bn_correct_top` 
  957.   
  958.       if (tmp_top > 0) {
  959.           for (ftl = &(a->d[tmp_top]); tmp_top > 0; tmp_top--) {
                      ^
  960.               ftl--;
  961.               if (*ftl != 0)
