crypto/bn/bn_print.c:104: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [0, +oo].
Showing all 12 steps of the trace


crypto/bn/bn_print.c:68:9: <Length trace>
66.        *     <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
67.        */
68.       i = BN_num_bits(a) * 3;
              ^
69.       num = (i / 10 + i / 1000 + 1) + 1;
70.       tbytes = num + 3;   /* negative and terminator and one spare? */

crypto/bn/bn_print.c:68:9: Call
66.        *     <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
67.        */
68.       i = BN_num_bits(a) * 3;
              ^
69.       num = (i / 10 + i / 1000 + 1) + 1;
70.       tbytes = num + 3;   /* negative and terminator and one spare? */

crypto/bn/bn_lib.c:167:9: Assignment
  165.   
  166.       if (BN_is_zero(a))
  167.           return 0;
                 ^
  168.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));
  169.   }

crypto/bn/bn_print.c:68:5: Assignment
66.        *     <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
67.        */
68.       i = BN_num_bits(a) * 3;
          ^
69.       num = (i / 10 + i / 1000 + 1) + 1;
70.       tbytes = num + 3;   /* negative and terminator and one spare? */

crypto/bn/bn_print.c:69:5: Assignment
67.        */
68.       i = BN_num_bits(a) * 3;
69.       num = (i / 10 + i / 1000 + 1) + 1;
          ^
70.       tbytes = num + 3;   /* negative and terminator and one spare? */
71.       bn_data_num = num / BN_DEC_NUM + 1;

crypto/bn/bn_print.c:71:5: Assignment
69.       num = (i / 10 + i / 1000 + 1) + 1;
70.       tbytes = num + 3;   /* negative and terminator and one spare? */
71.       bn_data_num = num / BN_DEC_NUM + 1;
          ^
72.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
73.       buf = OPENSSL_malloc(tbytes);

crypto/bn/bn_print.c:72:15: Call
70.       tbytes = num + 3;   /* negative and terminator and one spare? */
71.       bn_data_num = num / BN_DEC_NUM + 1;
72.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
                    ^
73.       buf = OPENSSL_malloc(tbytes);
74.       if (buf == NULL || bn_data == NULL) {

crypto/mem.c:177:9: Assignment
  175.   
  176.       if (num == 0)
  177.           return NULL;
                 ^
  178.   
  179.       FAILTEST();

crypto/bn/bn_print.c:72:5: Assignment
70.       tbytes = num + 3;   /* negative and terminator and one spare? */
71.       bn_data_num = num / BN_DEC_NUM + 1;
72.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
          ^
73.       buf = OPENSSL_malloc(tbytes);
74.       if (buf == NULL || bn_data == NULL) {

crypto/bn/bn_print.c:82:5: Assignment
80.   
81.       p = buf;
82.       lp = bn_data;
          ^
83.       if (BN_is_zero(t)) {
84.           *p++ = '0';

crypto/bn/bn_print.c:98:9: Assignment
96.               lp++;
97.           }
98.           lp--;
               ^
99.           /*
100.            * We now have a series of blocks, BN_DEC_NUM chars in length, where

crypto/bn/bn_print.c:104:70: Array access: Offset: [-1, +oo] Size: [0, +oo]
102.            * order.
103.            */
104.           n = BIO_snprintf(p, tbytes - (size_t)(p - buf), BN_DEC_FMT1, *lp);
                                                                            ^
105.           if (n < 0)
106.               goto err;
