crypto/bn/bn_exp.c:461: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_from_montgomery`.
Showing all 12 steps of the trace


crypto/bn/bn_exp.c:389:14: Assignment
387.           /* 2^(top*BN_BITS2) - m */
388.           r->d[0] = (0 - m->d[0]) & BN_MASK2;
389.           for (i = 1; i < j; i++)
                    ^
390.               r->d[i] = (~m->d[i]) & BN_MASK2;
391.           r->top = j;

crypto/bn/bn_exp.c:391:9: Assignment
389.           for (i = 1; i < j; i++)
390.               r->d[i] = (~m->d[i]) & BN_MASK2;
391.           r->top = j;
               ^
392.           /*
393.            * Upper words will be zero if the corresponding words of 'm' were

crypto/bn/bn_exp.c:461:10: Call
459.       } else
460.   #endif
461.       if (!BN_from_montgomery(rr, r, mont, ctx))
                ^
462.           goto err;
463.       ret = 1;

crypto/bn/bn_mont.c:166:1: Parameter `a->top`
  164.   #endif                          /* MONT_WORD */
  165.   
  166. > int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
  167.                          BN_CTX *ctx)
  168.   {

crypto/bn/bn_mont.c:174:34: Call
  172.   
  173.       BN_CTX_start(ctx);
  174.       if ((t = BN_CTX_get(ctx)) && BN_copy(t, a))
                                          ^
  175.           retn = BN_from_montgomery_word(ret, t, mont);
  176.       BN_CTX_end(ctx);

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
    321.   }
    322.   
    323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    324.   {
    325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
    321.   }
    322.   
    323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    324.   {
    325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
    327.       if (a == b)
    328.           return a;
    329.       if (bn_wexpand(a, b->top) == NULL)
                   ^
    330.           return NULL;
    331.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
      946.   }
      947.   
      948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
      949.   {
      950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_from_montgomery` 
    331.   
    332.       if (b->top > 0)
    333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                   ^
    334.   
    335.       a->top = b->top;
