crypto/rsa/rsa_crpt.c:149: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_BLINDING_create_param`.
Showing all 11 steps of the trace


crypto/rsa/rsa_crpt.c:110:1: Parameter `rsa->e->d`
108.   }
109.   
110. > BN_BLINDING *RSA_setup_blinding(RSA *rsa, BN_CTX *in_ctx)
111.   {
112.       BIGNUM *e;

crypto/rsa/rsa_crpt.c:149:15: Call
147.           BN_with_flags(n, rsa->n, BN_FLG_CONSTTIME);
148.   
149.           ret = BN_BLINDING_create_param(NULL, e, n, ctx, rsa->meth->bn_mod_exp,
                     ^
150.                                          rsa->_method_mod_n);
151.           /* We MUST free n before any further use of rsa->n */

crypto/bn/bn_blind.c:214:1: Parameter `*e->d`
  212.   }
  213.   
  214. > BN_BLINDING *BN_BLINDING_create_param(BN_BLINDING *b,
  215.                                         const BIGNUM *e, BIGNUM *m, BN_CTX *ctx,
  216.                                         int (*bn_mod_exp) (BIGNUM *r,

crypto/bn/bn_blind.c:242:18: Call
  240.       if (e != NULL) {
  241.           BN_free(ret->e);
  242.           ret->e = BN_dup(e);
                          ^
  243.       }
  244.       if (ret->e == NULL)

crypto/bn/bn_lib.c:293:1: Parameter `*a->d`
    291.   }
    292.   
    293. > BIGNUM *BN_dup(const BIGNUM *a)
    294.   {
    295.       BIGNUM *t;

crypto/bn/bn_lib.c:304:10: Call
    302.       if (t == NULL)
    303.           return NULL;
    304.       if (!BN_copy(t, a)) {
                    ^
    305.           BN_free(t);
    306.           return NULL;

crypto/bn/bn_lib.c:312:1: <Offset trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `b->top`
      310.   }
      311.   
      312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      313.   {
      314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: <Length trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `*b->d`
      310.   }
      311.   
      312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      313.   {
      314.       bn_check_top(b);

crypto/bn/bn_lib.c:322:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_BLINDING_create_param` 
      320.   
      321.       if (b->top > 0)
      322.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      323.   
      324.       a->top = b->top;
