crypto/dh/dh_pmeth.c:337: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `DSA_dup_DH`.
Showing all 15 steps of the trace


crypto/dh/dh_pmeth.c:333:18: Call
331.       if (dctx->use_dsa) {
332.           DSA *dsa_dh;
333.           dsa_dh = dsa_dh_generate(dctx, pcb);
                        ^
334.           BN_GENCB_free(pcb);
335.           if (dsa_dh == NULL)

crypto/dh/dh_pmeth.c:285:14: Call
  283.                                     NULL, 0, NULL, NULL, NULL, pcb);
  284.       else if (dctx->use_dsa == 2)
  285.           rv = dsa_builtin_paramgen2(ret, prime_len, subprime_len, md,
                      ^
  286.                                      NULL, 0, -1, NULL, NULL, NULL, pcb);
  287.       if (rv <= 0) {

crypto/dsa/dsa_gen.c:300:1: Parameter `ret->q->top`
    298.    */
    299.   
    300. > int dsa_builtin_paramgen2(DSA *ret, size_t L, size_t N,
    301.                             const EVP_MD *evpmd, const unsigned char *seed_in,
    302.                             size_t seed_len, int idx, unsigned char *seed_out,

crypto/dh/dh_pmeth.c:337:14: Call
335.           if (dsa_dh == NULL)
336.               return 0;
337.           dh = DSA_dup_DH(dsa_dh);
                    ^
338.           DSA_free(dsa_dh);
339.           if (!dh)

crypto/dsa/dsa_lib.c:199:1: Parameter `r->p->top`
  197.   
  198.   #ifndef OPENSSL_NO_DH
  199. > DH *DSA_dup_DH(const DSA *r)
  200.   {
  201.       /*

crypto/dsa/dsa_lib.c:219:13: Call
  217.               goto err;
  218.           }
  219.           p = BN_dup(r->p);
                     ^
  220.           g = BN_dup(r->g);
  221.           q = BN_dup(r->q);

crypto/bn/bn_lib.c:304:1: Parameter `a->top`
    302.   }
    303.   
    304. > BIGNUM *BN_dup(const BIGNUM *a)
    305.   {
    306.       BIGNUM *t;

crypto/bn/bn_lib.c:315:10: Call
    313.       if (t == NULL)
    314.           return NULL;
    315.       if (!BN_copy(t, a)) {
                    ^
    316.           BN_free(t);
    317.           return NULL;

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
      321.   }
      322.   
      323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      324.   {
      325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
      321.   }
      322.   
      323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      324.   {
      325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
      327.       if (a == b)
      328.           return a;
      329.       if (bn_wexpand(a, b->top) == NULL)
                     ^
      330.           return NULL;
      331.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
        946.   }
        947.   
        948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
        949.   {
        950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `DSA_dup_DH` 
      331.   
      332.       if (b->top > 0)
      333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      334.   
      335.       a->top = b->top;
