crypto/bn/bn_word.c:188: error: BUFFER_OVERRUN_S2
  Offset: [`a->top` + 7, +oo] (⇐ [`a->top`, +oo] + 7) Size: [`a->top` + 2, `a->top` + 2] by call to `bn_expand2`.
Showing all 6 steps of the trace


crypto/bn/bn_word.c:178:1: Parameter `a->max`
176.   	}
177.   
178. > int BN_mul_word(BIGNUM *a, BN_ULONG w)
179.   	{
180.   	BN_ULONG ll;

crypto/bn/bn_word.c:188:8: Call
186.   		if (ll)
187.   			{
188.   			if (bn_wexpand(a,a->top+1) == NULL) return(0);
              ^
189.   			a->d[a->top++]=ll;
190.   			}

crypto/bn/bn_lib.c:344:1: <Length trace>
342.   	}
343.   
344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
345.   	{
346.   	BN_ULONG *A,*a;

crypto/bn/bn_lib.c:344:1: Parameter `b->top`
  342.   	}
  343.   
  344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
  345.   	{
  346.   	BN_ULONG *A,*a;

crypto/bn/bn_lib.c:466:3: Assignment
  464.   		/* Now need to zero any data between b->top and b->max */
  465.   
  466.   		A= &(b->d[b->top]);
           ^
  467.   		for (i=(b->max - b->top)>>3; i>0; i--,A+=8)
  468.   			{

crypto/bn/bn_lib.c:470:28: Array access: Offset: [a->top + 7, +oo] (⇐ [a->top, +oo] + 7) Size: [a->top + 2, a->top + 2] by call to `bn_expand2` 
  468.   			{
  469.   			A[0]=0; A[1]=0; A[2]=0; A[3]=0;
  470.   			A[4]=0; A[5]=0; A[6]=0; A[7]=0;
                                    ^
  471.   			}
  472.   		for (i=(b->max - b->top)&7; i>0; i--,A++)
