test/bntest.c:682: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, 8388607] by call to `BN_div`.
Showing all 14 steps of the trace


test/bntest.c:665:13: Call
663.       for (i = 0; i < num0 + num1; i++) {
664.           if (i <= num1) {
665.               BN_bntest_rand(a, 100, 0, 0);
                   ^
666.               BN_bntest_rand(b, 100, 0, 0);
667.           } else

crypto/bn/bn_rand.c:210:1: Parameter `*rnd->d`
  208.   }
  209.   
  210. > int BN_bntest_rand(BIGNUM *rnd, int bits, int top, int bottom)
  211.   {
  212.       return bnrand(2, rnd, bits, top, bottom);

crypto/bn/bn_rand.c:212:12: Call
  210.   int BN_bntest_rand(BIGNUM *rnd, int bits, int top, int bottom)
  211.   {
  212.       return bnrand(2, rnd, bits, top, bottom);
                    ^
  213.   }
  214.   

crypto/bn/bn_rand.c:119:1: Parameter `*rnd->d`
    117.   #include <openssl/sha.h>
    118.   
    119. > static int bnrand(int pseudorand, BIGNUM *rnd, int bits, int top, int bottom)
    120.   {
    121.       unsigned char *buf = NULL;

test/bntest.c:682:9: Call
680.               BIO_puts(bp, "\n");
681.           }
682.           BN_div(d, e, c, a, ctx);
               ^
683.           BN_sub(d, d, b);
684.           if (!BN_is_zero(d) || !BN_is_zero(e)) {

crypto/bn/bn_div.c:243:11: Call
  241.   
  242.       BN_CTX_start(ctx);
  243.       tmp = BN_CTX_get(ctx);
                   ^
  244.       snum = BN_CTX_get(ctx);
  245.       sdiv = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:284:5: Call
    282.       }
    283.       /* OK, make sure the returned bignum is "zero" */
    284.       BN_zero(ret);
               ^
    285.       ctx->used++;
    286.       CTXDBG_RET(ctx, ret);

crypto/bn/bn_lib.c:530:1: Parameter `*a->d`
      528.   }
      529.   
      530. > int BN_set_word(BIGNUM *a, BN_ULONG w)
      531.   {
      532.       bn_check_top(a);

crypto/bn/bn_div.c:462:9: Call
  460.            */
  461.           int neg = num->neg;
  462.           BN_rshift(rm, snum, norm_shift);
                 ^
  463.           if (!BN_is_zero(rm))
  464.               rm->neg = neg;

crypto/bn/bn_shift.c:169:1: <Length trace>
167.   }
168.   
169. > int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
170.   {
171.       int i, j, nw, lb, rb;

crypto/bn/bn_shift.c:169:1: Parameter `*a->d`
    167.   }
    168.   
    169. > int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
    170.   {
    171.       int i, j, nw, lb, rb;

crypto/bn/bn_shift.c:200:5: Assignment
    198.       }
    199.   
    200.       f = &(a->d[nw]);
               ^
    201.       t = r->d;
    202.       j = a->top - nw;

crypto/bn/bn_shift.c:209:15: Assignment
    207.               *(t++) = *(f++);
    208.       } else {
    209.           l = *(f++);
                         ^
    210.           for (i = j - 1; i != 0; i--) {
    211.               tmp = (l >> rb) & BN_MASK2;

crypto/bn/bn_shift.c:212:17: Array access: Offset: [1, +oo] Size: [0, 8388607] by call to `BN_div` 
    210.           for (i = j - 1; i != 0; i--) {
    211.               tmp = (l >> rb) & BN_MASK2;
    212.               l = *(f++);
                           ^
    213.               *(t++) = (tmp | (l << lb)) & BN_MASK2;
    214.           }
