test/srptest.c:45: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `SRP_create_verifier_BN`.
Showing all 16 steps of the trace


test/srptest.c:45:10: Call
43.   
44.       /* Set up server's password entry */
45.       if (!TEST_true(SRP_create_verifier_BN(username, server_pass,
               ^
46.                                             &s, &v, GN->N, GN->g)))
47.           goto end;

crypto/srp/srp_vfy.c:668:1: Parameter `N->top`
  666.    * BIGNUMS.
  667.    */
  668. > int SRP_create_verifier_BN(const char *user, const char *pass, BIGNUM **salt,
  669.                              BIGNUM **verifier, const BIGNUM *N,
  670.                              const BIGNUM *g)

crypto/srp/srp_vfy.c:699:10: Call
  697.           goto err;
  698.   
  699.       if (!BN_mod_exp(*verifier, g, x, N, bn_ctx)) {
                  ^
  700.           BN_clear_free(*verifier);
  701.           goto err;

crypto/bn/bn_exp.c:89:1: Parameter `m->top`
    87.   }
    88.   
    89. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
    90.                  BN_CTX *ctx)
    91.   {

crypto/bn/bn_exp.c:134:9: Call
    132.   
    133.   #ifdef MONT_MUL_MOD
    134.       if (BN_is_odd(m)) {
                   ^
    135.   # ifdef MONT_EXP_WORD
    136.           if (a->top == 1 && !a->neg

crypto/bn/bn_lib.c:861:1: Parameter `a->top`
      859.   }
      860.   
      861. > int BN_is_odd(const BIGNUM *a)
      862.   {
      863.       return (a->top > 0) && (a->d[0] & 1);

crypto/bn/bn_exp.c:149:15: Call
    147.   #ifdef RECP_MUL_MOD
    148.       {
    149.           ret = BN_mod_exp_recp(r, a, p, m, ctx);
                         ^
    150.       }
    151.   #else

crypto/bn/bn_exp.c:161:1: Parameter `m->top`
      159.   }
      160.   
      161. > int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
      162.                       const BIGNUM *m, BN_CTX *ctx)
      163.   {

crypto/bn/bn_exp.c:200:14: Call
      198.       if (m->neg) {
      199.           /* ignore sign of 'm' */
      200.           if (!BN_copy(aa, m))
                          ^
      201.               goto err;
      202.           aa->neg = 0;

crypto/bn/bn_lib.c:280:1: <Offset trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `b->top`
        278.   }
        279.   
        280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        281.   {
        282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: <Length trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `*a->d`
        278.   }
        279.   
        280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        281.   {
        282.       bn_check_top(b);

crypto/bn/bn_lib.c:286:9: Call
        284.       if (a == b)
        285.           return a;
        286.       if (bn_wexpand(a, b->top) == NULL)
                       ^
        287.           return NULL;
        288.   

crypto/bn/bn_lib.c:942:1: Parameter `*a->d`
          940.   }
          941.   
          942. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
          943.   {
          944.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:290:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `SRP_create_verifier_BN` 
        288.   
        289.       if (b->top > 0)
        290.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                       ^
        291.   
        292.       a->neg = b->neg;
