crypto/bn/bn_sqr.c:97: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_copy`.
Showing all 11 steps of the trace


crypto/bn/bn_sqr.c:27:1: Parameter `r->top`
25.   }
26.   
27. > int bn_sqr_fixed_top(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
28.   {
29.       int max, al;

crypto/bn/bn_sqr.c:49:9: Call
47.   
48.       max = 2 * al;               /* Non-zero (from above) */
49.       if (bn_wexpand(rr, max) == NULL)
              ^
50.           goto err;
51.   

crypto/bn/bn_lib.c:948:1: Parameter `a->top`
  946.   }
  947.   
  948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
  949.   {
  950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_sqr.c:97:20: Call
95.       rr->top = max;
96.       rr->flags |= BN_FLG_FIXED_TOP;
97.       if (r != rr && BN_copy(r, rr) == NULL)
                          ^
98.           goto err;
99.   

crypto/bn/bn_lib.c:281:1: <Offset trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `b->top`
  279.   }
  280.   
  281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  282.   {
  283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: <Length trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `*a->d`
  279.   }
  280.   
  281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  282.   {
  283.       bn_check_top(b);

crypto/bn/bn_lib.c:287:9: Call
  285.       if (a == b)
  286.           return a;
  287.       if (bn_wexpand(a, b->top) == NULL)
                 ^
  288.           return NULL;
  289.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
    946.   }
    947.   
    948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
    949.   {
    950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:291:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_copy` 
  289.   
  290.       if (b->top > 0)
  291.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                 ^
  292.   
  293.       a->neg = b->neg;
