crypto/x509v3/v3_utl.c:123: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_bn2dec`.
Showing all 13 steps of the trace


crypto/x509v3/v3_utl.c:122:18: Call
120.       if (!a)
121.           return NULL;
122.       if ((bntmp = ASN1_INTEGER_to_BN(a, NULL)) == NULL
                        ^
123.           || (strtmp = BN_bn2dec(bntmp)) == NULL)
124.           X509V3err(X509V3_F_I2S_ASN1_INTEGER, ERR_R_MALLOC_FAILURE);

crypto/asn1/a_int.c:559:12: Call
  557.   BIGNUM *ASN1_INTEGER_to_BN(const ASN1_INTEGER *ai, BIGNUM *bn)
  558.   {
  559.       return asn1_string_to_bn(ai, bn, V_ASN1_INTEGER);
                    ^
  560.   }
  561.   

crypto/asn1/a_int.c:493:1: Parameter `bn->d`
    491.   }
    492.   
    493. > static BIGNUM *asn1_string_to_bn(const ASN1_INTEGER *ai, BIGNUM *bn,
    494.                                    int itype)
    495.   {

crypto/x509v3/v3_utl.c:123:22: Call
121.           return NULL;
122.       if ((bntmp = ASN1_INTEGER_to_BN(a, NULL)) == NULL
123.           || (strtmp = BN_bn2dec(bntmp)) == NULL)
                            ^
124.           X509V3err(X509V3_F_I2S_ASN1_INTEGER, ERR_R_MALLOC_FAILURE);
125.       BN_free(bntmp);

crypto/bn/bn_print.c:53:1: Parameter `*a->d`
  51.   
  52.   /* Must 'OPENSSL_free' the returned data */
  53. > char *BN_bn2dec(const BIGNUM *a)
  54.   {
  55.       int i = 0, num, ok = 0, n, tbytes;

crypto/bn/bn_print.c:78:14: Call
  76.           goto err;
  77.       }
  78.       if ((t = BN_dup(a)) == NULL)
                     ^
  79.           goto err;
  80.   

crypto/bn/bn_lib.c:293:1: Parameter `*a->d`
    291.   }
    292.   
    293. > BIGNUM *BN_dup(const BIGNUM *a)
    294.   {
    295.       BIGNUM *t;

crypto/bn/bn_lib.c:304:10: Call
    302.       if (t == NULL)
    303.           return NULL;
    304.       if (!BN_copy(t, a)) {
                    ^
    305.           BN_free(t);
    306.           return NULL;

crypto/bn/bn_lib.c:312:1: <Offset trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `b->top`
      310.   }
      311.   
      312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      313.   {
      314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: <Length trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `*b->d`
      310.   }
      311.   
      312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      313.   {
      314.       bn_check_top(b);

crypto/bn/bn_lib.c:322:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_bn2dec` 
      320.   
      321.       if (b->top > 0)
      322.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      323.   
      324.       if (BN_get_flags(b, BN_FLG_CONSTTIME) != 0)
