crypto/dh/dh_key.c:192: error: BUFFER_OVERRUN_L3
  Offset: [-2, +oo] Size: 12 by call to `BN_CTX_end`.
Showing all 14 steps of the trace


crypto/dh/dh_key.c:166:2: Call
164.   	int ret= -1;
165.   
166.   	BN_CTX_init(&ctx);
        ^
167.   	BN_CTX_start(&ctx);
168.   	tmp = BN_CTX_get(&ctx);

crypto/bn/bn_ctx.c:89:2: Assignment
  87.   	ctx->tos = 0;
  88.   	ctx->flags = 0;
  89.   	ctx->depth = 0;
         ^
  90.   	ctx->too_many = 0;
  91.   	for (i = 0; i < BN_CTX_NUM; i++)

crypto/dh/dh_key.c:167:2: Call
165.   
166.   	BN_CTX_init(&ctx);
167.   	BN_CTX_start(&ctx);
        ^
168.   	tmp = BN_CTX_get(&ctx);
169.   	

crypto/bn/bn_ctx.c:108:1: Parameter `ctx->depth`
  106.   	}
  107.   
  108. > void BN_CTX_start(BN_CTX *ctx)
  109.   	{
  110.   	if (ctx->depth < BN_CTX_NUM_POS)

crypto/bn/bn_ctx.c:112:2: Assignment
  110.   	if (ctx->depth < BN_CTX_NUM_POS)
  111.   		ctx->pos[ctx->depth] = ctx->tos;
  112.   	ctx->depth++;
          ^
  113.   	}
  114.   

crypto/dh/dh_key.c:168:8: Call
166.   	BN_CTX_init(&ctx);
167.   	BN_CTX_start(&ctx);
168.   	tmp = BN_CTX_get(&ctx);
              ^
169.   	
170.   	if (dh->priv_key == NULL)

crypto/bn/bn_ctx.c:116:1: Parameter `ctx->depth`
  114.   
  115.   
  116. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
  117.   	{
  118.   	/* Note: If BN_CTX_get is ever changed to allocate BIGNUMs dynamically,

crypto/dh/dh_key.c:192:2: Call
190.   	ret=BN_bn2bin(tmp,key);
191.   err:
192.   	BN_CTX_end(&ctx);
        ^
193.   	BN_CTX_free(&ctx);
194.   	return(ret);

crypto/bn/bn_ctx.c:136:1: <Offset trace>
134.   	}
135.   
136. > void BN_CTX_end(BN_CTX *ctx)
137.   	{
138.   	if (ctx == NULL) return;

crypto/bn/bn_ctx.c:136:1: Parameter `ctx->depth`
  134.   	}
  135.   
  136. > void BN_CTX_end(BN_CTX *ctx)
  137.   	{
  138.   	if (ctx == NULL) return;

crypto/bn/bn_ctx.c:147:2: Assignment
  145.   
  146.   	ctx->too_many = 0;
  147.   	ctx->depth--;
          ^
  148.   	if (ctx->depth < BN_CTX_NUM_POS)
  149.   		ctx->tos = ctx->pos[ctx->depth];

crypto/bn/bn_ctx.c:136:1: <Length trace>
134.   	}
135.   
136. > void BN_CTX_end(BN_CTX *ctx)
137.   	{
138.   	if (ctx == NULL) return;

crypto/bn/bn_ctx.c:136:1: Parameter `ctx->pos[*]`
  134.   	}
  135.   
  136. > void BN_CTX_end(BN_CTX *ctx)
  137.   	{
  138.   	if (ctx == NULL) return;

crypto/bn/bn_ctx.c:149:14: Array access: Offset: [-2, +oo] Size: 12 by call to `BN_CTX_end` 
  147.   	ctx->depth--;
  148.   	if (ctx->depth < BN_CTX_NUM_POS)
  149.   		ctx->tos = ctx->pos[ctx->depth];
                      ^
  150.   	}
