apps/dhparam.c:271: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `DH_check`.
Showing all 20 steps of the trace


apps/dhparam.c:200:32: Call
198.                          num, g);
199.               BIO_printf(bio_err, "This is going to take a long time\n");
200.               if (dh == NULL || !DH_generate_parameters_ex(dh, num, g, cb)) {
                                      ^
201.                   BN_GENCB_free(cb);
202.                   ERR_print_errors(bio_err);

crypto/dh/dh_gen.c:23:1: Parameter `ret->p->top`
  21.                                   BN_GENCB *cb);
  22.   
  23. > int DH_generate_parameters_ex(DH *ret, int prime_len, int generator,
  24.                                 BN_GENCB *cb)
  25.   {

apps/dhparam.c:271:14: Call
269.   
270.       if (check) {
271.           if (!DH_check(dh, &i)) {
                    ^
272.               ERR_print_errors(bio_err);
273.               goto end;

crypto/dh/dh_check.c:101:1: Parameter `dh->p->top`
  99.   }
  100.   
  101. > int DH_check(const DH *dh, int *ret)
  102.   {
  103.       int ok = 0, r;

crypto/dh/dh_check.c:121:18: Call
  119.           if (BN_cmp(dh->g, BN_value_one()) <= 0)
  120.               *ret |= DH_NOT_SUITABLE_GENERATOR;
  121.           else if (BN_cmp(dh->g, dh->p) >= 0)
                          ^
  122.               *ret |= DH_NOT_SUITABLE_GENERATOR;
  123.           else {

crypto/bn/bn_lib.c:566:1: Parameter `a->top`
    564.   }
    565.   
    566. > int BN_cmp(const BIGNUM *a, const BIGNUM *b)
    567.   {
    568.       int i;

crypto/dh/dh_check.c:125:18: Call
  123.           else {
  124.               /* Check g^q == 1 mod p */
  125.               if (!BN_mod_exp(t1, dh->g, dh->q, dh->p, ctx))
                          ^
  126.                   goto err;
  127.               if (!BN_is_one(t1))

crypto/bn/bn_exp.c:89:1: Parameter `m->top`
    87.   }
    88.   
    89. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
    90.                  BN_CTX *ctx)
    91.   {

crypto/bn/bn_exp.c:134:9: Call
    132.   
    133.   #ifdef MONT_MUL_MOD
    134.       if (BN_is_odd(m)) {
                   ^
    135.   # ifdef MONT_EXP_WORD
    136.           if (a->top == 1 && !a->neg

crypto/bn/bn_lib.c:856:1: Parameter `a->top`
      854.   }
      855.   
      856. > int BN_is_odd(const BIGNUM *a)
      857.   {
      858.       return (a->top > 0) && (a->d[0] & 1);

crypto/bn/bn_exp.c:149:15: Call
    147.   #ifdef RECP_MUL_MOD
    148.       {
    149.           ret = BN_mod_exp_recp(r, a, p, m, ctx);
                         ^
    150.       }
    151.   #else

crypto/bn/bn_exp.c:161:1: Parameter `m->top`
      159.   }
      160.   
      161. > int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
      162.                       const BIGNUM *m, BN_CTX *ctx)
      163.   {

crypto/bn/bn_exp.c:200:14: Call
      198.       if (m->neg) {
      199.           /* ignore sign of 'm' */
      200.           if (!BN_copy(aa, m))
                          ^
      201.               goto err;
      202.           aa->neg = 0;

crypto/bn/bn_lib.c:312:1: <Offset trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `b->top`
        310.   }
        311.   
        312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        313.   {
        314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: <Length trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `*a->d`
        310.   }
        311.   
        312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        313.   {
        314.       bn_check_top(b);

crypto/bn/bn_lib.c:318:9: Call
        316.       if (a == b)
        317.           return a;
        318.       if (bn_wexpand(a, b->top) == NULL)
                       ^
        319.           return NULL;
        320.   

crypto/bn/bn_lib.c:937:1: Parameter `*a->d`
          935.   }
          936.   
          937. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
          938.   {
          939.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:322:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `DH_check` 
        320.   
        321.       if (b->top > 0)
        322.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                       ^
        323.   
        324.       a->top = b->top;
