crypto/bn/bn_mont.c:152: error: BUFFER_OVERRUN_S2
  Offset: [-4+max(4, `mont->N.top`), `mont->N.top` - 1] Size: [0, 8388607].
Showing all 8 steps of the trace


crypto/bn/bn_mont.c:135:14: <Offset trace>
133.               (BN_ULONG *)(((PTR_SIZE_INT) rp & ~m) | ((PTR_SIZE_INT) ap & m));
134.   
135.           for (i = 0, nl -= 4; i < nl; i += 4) {
                    ^
136.               BN_ULONG t1, t2, t3, t4;
137.   

crypto/bn/bn_mont.c:135:14: Assignment
133.               (BN_ULONG *)(((PTR_SIZE_INT) rp & ~m) | ((PTR_SIZE_INT) ap & m));
134.   
135.           for (i = 0, nl -= 4; i < nl; i += 4) {
                    ^
136.               BN_ULONG t1, t2, t3, t4;
137.   

crypto/bn/bn_mont.c:75:1: <Length trace>
73.   
74.   #ifdef MONT_WORD
75. > static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)
76.   {
77.       BIGNUM *n;

crypto/bn/bn_mont.c:75:1: Parameter `*ret->d`
73.   
74.   #ifdef MONT_WORD
75. > static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)
76.   {
77.       BIGNUM *n;

crypto/bn/bn_mont.c:112:9: Call
110.       }
111.   
112.       if (bn_wexpand(ret, nl) == NULL)
               ^
113.           return 0;
114.       ret->top = nl;

crypto/bn/bn_lib.c:940:1: Parameter `*a->d`
  938.   }
  939.   
  940. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
  941.   {
  942.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_mont.c:117:5: Assignment
115.       ret->neg = r->neg;
116.   
117.       rp = ret->d;
           ^
118.       ap = &(r->d[nl]);
119.   

crypto/bn/bn_mont.c:152:13: Array access: Offset: [-4+max(4, mont->N.top), mont->N.top - 1] Size: [0, 8388607]
150.           }
151.           for (nl += 4; i < nl; i++)
152.               rp[i] = nrp[i], ap[i] = 0;
                   ^
153.       }
154.   # else
