crypto/rsa/rsa_pmeth.c:742: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `RSA_generate_multi_prime_key`.
Showing all 15 steps of the trace


crypto/rsa/rsa_pmeth.c:726:39: Call
724.       if (rctx->pub_exp == NULL) {
725.           rctx->pub_exp = BN_new();
726.           if (rctx->pub_exp == NULL || !BN_set_word(rctx->pub_exp, RSA_F4))
                                             ^
727.               return 0;
728.       }

crypto/bn/bn_lib.c:365:15: Assignment
  363.       a->neg = 0;
  364.       a->d[0] = w;
  365.       a->top = (w ? 1 : 0);
                       ^
  366.       a->flags &= ~BN_FLG_FIXED_TOP;
  367.       bn_check_top(a);

crypto/bn/bn_lib.c:365:5: Assignment
  363.       a->neg = 0;
  364.       a->d[0] = w;
  365.       a->top = (w ? 1 : 0);
             ^
  366.       a->flags &= ~BN_FLG_FIXED_TOP;
  367.       bn_check_top(a);

crypto/rsa/rsa_pmeth.c:742:11: Call
740.           pcb = NULL;
741.       }
742.       ret = RSA_generate_multi_prime_key(rsa, rctx->nbits, rctx->primes,
                 ^
743.                                          rctx->pub_exp, pcb);
744.       BN_GENCB_free(pcb);

crypto/rsa/rsa_gen.c:41:1: Parameter `e_value->top`
  39.   }
  40.   
  41. > int RSA_generate_multi_prime_key(RSA *rsa, int bits, int primes,
  42.                                    BIGNUM *e_value, BN_GENCB *cb)
  43.   {

crypto/rsa/rsa_gen.c:61:12: Call
  59.       }
  60.   
  61.       return rsa_builtin_keygen(rsa, bits, primes, e_value, cb);
                   ^
  62.   }
  63.   

crypto/rsa/rsa_gen.c:64:1: Parameter `e_value->top`
    62.   }
    63.   
    64. > static int rsa_builtin_keygen(RSA *rsa, int bits, int primes, BIGNUM *e_value,
    65.                                 BN_GENCB *cb)
    66.   {

crypto/rsa/rsa_gen.c:144:9: Call
    142.       }
    143.   
    144.       if (BN_copy(rsa->e, e_value) == NULL)
                   ^
    145.           goto err;
    146.   

crypto/bn/bn_lib.c:280:1: <Offset trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `b->top`
      278.   }
      279.   
      280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      281.   {
      282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: <Length trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `*a->d`
      278.   }
      279.   
      280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      281.   {
      282.       bn_check_top(b);

crypto/bn/bn_lib.c:286:9: Call
      284.       if (a == b)
      285.           return a;
      286.       if (bn_wexpand(a, b->top) == NULL)
                     ^
      287.           return NULL;
      288.   

crypto/bn/bn_lib.c:942:1: Parameter `*a->d`
        940.   }
        941.   
        942. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
        943.   {
        944.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:290:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `RSA_generate_multi_prime_key` 
      288.   
      289.       if (b->top > 0)
      290.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      291.   
      292.       a->neg = b->neg;
