crypto/bn/bn_rand.c:150: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `bnrand`.
Showing all 13 steps of the trace


crypto/bn/bn_rand.c:138:9: Call
136.       }
137.   
138.       n = BN_num_bits(range);     /* n > 0 */
               ^
139.   
140.       /* BN_is_bit_set(range, n - 1) always holds */

crypto/bn/bn_lib.c:141:9: Assignment
  139.   
  140.       if (BN_is_zero(a))
  141.           return 0;
                 ^
  142.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));
  143.   }

crypto/bn/bn_rand.c:138:5: Assignment
136.       }
137.   
138.       n = BN_num_bits(range);     /* n > 0 */
           ^
139.   
140.       /* BN_is_bit_set(range, n - 1) always holds */

crypto/bn/bn_rand.c:150:18: Call
148.            */
149.           do {
150.               if (!bnrand(flag, r, n + 1, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY,
                        ^
151.                           ctx))
152.                   return 0;

crypto/bn/bn_rand.c:62:14: <Offset trace>
60.           unsigned char c;
61.   
62.           for (i = 0; i < bytes; i++) {
                   ^
63.               if (rand_bytes_ex(libctx, &c, 1) <= 0)
64.                   goto err;

crypto/bn/bn_rand.c:62:14: Assignment
  60.           unsigned char c;
  61.   
  62.           for (i = 0; i < bytes; i++) {
                     ^
  63.               if (rand_bytes_ex(libctx, &c, 1) <= 0)
  64.                   goto err;

crypto/bn/bn_rand.c:23:1: <Length trace>
21.   } BNRAND_FLAG;
22.   
23. > static int bnrand(BNRAND_FLAG flag, BIGNUM *rnd, int bits, int top, int bottom,
24.                     BN_CTX *ctx)
25.   {

crypto/bn/bn_rand.c:23:1: Parameter `bits`
  21.   } BNRAND_FLAG;
  22.   
  23. > static int bnrand(BNRAND_FLAG flag, BIGNUM *rnd, int bits, int top, int bottom,
  24.                     BN_CTX *ctx)
  25.   {

crypto/bn/bn_rand.c:39:5: Assignment
  37.           goto toosmall;
  38.   
  39.       bytes = (bits + 7) / 8;
            ^
  40.       bit = (bits - 1) % 8;
  41.       mask = 0xff << (bit + 1);

crypto/bn/bn_rand.c:43:11: Call
  41.       mask = 0xff << (bit + 1);
  42.   
  43.       buf = OPENSSL_malloc(bytes);
                  ^
  44.       if (buf == NULL) {
  45.           BNerr(BN_F_BNRAND, ERR_R_MALLOC_FAILURE);

crypto/mem.c:201:9: Assignment
    199.   
    200.       if (num == 0)
    201.           return NULL;
                   ^
    202.   
    203.       FAILTEST();

crypto/bn/bn_rand.c:43:5: Assignment
  41.       mask = 0xff << (bit + 1);
  42.   
  43.       buf = OPENSSL_malloc(bytes);
            ^
  44.       if (buf == NULL) {
  45.           BNerr(BN_F_BNRAND, ERR_R_MALLOC_FAILURE);

crypto/bn/bn_rand.c:88:9: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `bnrand` 
  86.       buf[0] &= ~mask;
  87.       if (bottom)                 /* set bottom bit if requested */
  88.           buf[bytes - 1] |= 1;
                ^
  89.       if (!BN_bin2bn(buf, bytes, rnd))
  90.           goto err;
