crypto/rsa/rsa_ossl.c:809: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_div`.
Showing all 11 steps of the trace


crypto/rsa/rsa_ossl.c:637:9: Call
635.               goto err;
636.           }
637.           BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME);
               ^
638.           BN_with_flags(q, rsa->q, BN_FLG_CONSTTIME);
639.   

crypto/bn/bn_lib.c:877:1: Parameter `*b->d`
  875.   }
  876.   
  877. > void BN_with_flags(BIGNUM *dest, const BIGNUM *b, int flags)
  878.   {
  879.       dest->d = b->d;

crypto/bn/bn_lib.c:879:5: Assignment
  877.   void BN_with_flags(BIGNUM *dest, const BIGNUM *b, int flags)
  878.   {
  879.       dest->d = b->d;
             ^
  880.       dest->top = b->top;
  881.       dest->dmax = b->dmax;

crypto/rsa/rsa_ossl.c:809:14: Call
807.           BN_with_flags(pr1, r1, BN_FLG_CONSTTIME);
808.   
809.           if (!BN_mod(r0, pr1, rsa->p, ctx)) {
                    ^
810.               BN_free(pr1);
811.               goto err;

crypto/bn/bn_div.c:137:1: Parameter `*num->d`
  135.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
  136.    */
  137. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
  138.              BN_CTX *ctx)
  139.   {

crypto/bn/bn_div.c:182:17: Call
  180.       if (!no_branch && BN_ucmp(num, divisor) < 0) {
  181.           if (rm != NULL) {
  182.               if (BN_copy(rm, num) == NULL)
                         ^
  183.                   return 0;
  184.           }

crypto/bn/bn_lib.c:280:1: <Offset trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `b->top`
    278.   }
    279.   
    280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    281.   {
    282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: <Length trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `*b->d`
    278.   }
    279.   
    280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    281.   {
    282.       bn_check_top(b);

crypto/bn/bn_lib.c:290:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_div` 
    288.   
    289.       if (b->top > 0)
    290.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                   ^
    291.   
    292.       a->neg = b->neg;
