crypto/bn/bn_gf2m.c:966: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, 8388607] by call to `BN_GF2m_mod_div`.
Showing all 16 steps of the trace


crypto/bn/bn_gf2m.c:961:18: Call
959.   
960.       BN_CTX_start(ctx);
961.       if ((field = BN_CTX_get(ctx)) == NULL)
                        ^
962.           goto err;
963.       if (!BN_GF2m_arr2poly(p, field))

crypto/bn/bn_ctx.c:275:5: Call
  273.       }
  274.       /* OK, make sure the returned bignum is "zero" */
  275.       BN_zero(ret);
             ^
  276.       ctx->used++;
  277.       CTXDBG_RET(ctx, ret);

crypto/bn/bn_lib.c:520:1: Parameter `a->top`
    518.   }
    519.   
    520. > int BN_set_word(BIGNUM *a, BN_ULONG w)
    521.   {
    522.       bn_check_top(a);

crypto/bn/bn_gf2m.c:966:11: Call
964.           goto err;
965.   
966.       ret = BN_GF2m_mod_div(r, yy, xx, field, ctx);
                 ^
967.       bn_check_top(r);
968.   

crypto/bn/bn_gf2m.c:830:1: Parameter `p->top`
  828.    * or y, x could equal y.
  829.    */
  830. > int BN_GF2m_mod_div(BIGNUM *r, const BIGNUM *y, const BIGNUM *x,
  831.                       const BIGNUM *p, BN_CTX *ctx)
  832.   {

crypto/bn/bn_gf2m.c:845:10: Call
  843.           goto err;
  844.   
  845.       if (!BN_GF2m_mod_inv(xinv, x, p, ctx))
                  ^
  846.           goto err;
  847.       if (!BN_GF2m_mod_mul(r, y, xinv, p, ctx))

crypto/bn/bn_gf2m.c:709:14: <Offset trace>
707.           bdp = b->d;
708.           bdp[0] = 1;
709.           for (i = 1; i < top; i++)
                    ^
710.               bdp[i] = 0;
711.           b->top = top;

crypto/bn/bn_gf2m.c:709:14: Assignment
    707.           bdp = b->d;
    708.           bdp[0] = 1;
    709.           for (i = 1; i < top; i++)
                        ^
    710.               bdp[i] = 0;
    711.           b->top = top;

crypto/bn/bn_gf2m.c:640:14: <Length trace>
638.       BN_CTX_start(ctx);
639.   
640.       if ((b = BN_CTX_get(ctx)) == NULL)
                    ^
641.           goto err;
642.       if ((c = BN_CTX_get(ctx)) == NULL)

crypto/bn/bn_gf2m.c:640:14: Call
    638.       BN_CTX_start(ctx);
    639.   
    640.       if ((b = BN_CTX_get(ctx)) == NULL)
                        ^
    641.           goto err;
    642.       if ((c = BN_CTX_get(ctx)) == NULL)

crypto/bn/bn_ctx.c:275:5: Call
      273.       }
      274.       /* OK, make sure the returned bignum is "zero" */
      275.       BN_zero(ret);
                 ^
      276.       ctx->used++;
      277.       CTXDBG_RET(ctx, ret);

crypto/bn/bn_lib.c:520:1: Parameter `*a->d`
        518.   }
        519.   
        520. > int BN_set_word(BIGNUM *a, BN_ULONG w)
        521.   {
        522.       bn_check_top(a);

crypto/bn/bn_lib.c:523:9: Call
        521.   {
        522.       bn_check_top(a);
        523.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                       ^
        524.           return (0);
        525.       a->neg = 0;

crypto/bn/bn_lcl.h:777:1: Parameter `*a->d`
          775.   int bn_probable_prime_dh_coprime(BIGNUM *rnd, int bits, BN_CTX *ctx);
          776.   
          777. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
          778.   {
          779.       if (bits > (INT_MAX - BN_BITS2 + 1))

crypto/bn/bn_gf2m.c:707:9: Assignment
    705.           if (!bn_wexpand(b, top))
    706.             goto err;
    707.           bdp = b->d;
                   ^
    708.           bdp[0] = 1;
    709.           for (i = 1; i < top; i++)

crypto/bn/bn_gf2m.c:710:13: Array access: Offset: [1, +oo] Size: [0, 8388607] by call to `BN_GF2m_mod_div` 
    708.           bdp[0] = 1;
    709.           for (i = 1; i < top; i++)
    710.               bdp[i] = 0;
                       ^
    711.           b->top = top;
    712.           if (!bn_wexpand(c, top))
