test/bntest.c:1243: error: BUFFER_OVERRUN_L3
  Offset: [0, 518] Size: [1, 519] by call to `BN_rand`.
Showing all 12 steps of the trace


test/bntest.c:1243:9: Call
1241.   
1242.       for (i = 0; i < num0; i++) {
1243.           BN_rand(a, 512, 0, 0);
                ^
1244.           BN_copy(b, BN_value_one());
1245.           a->neg = rand_neg();

crypto/bn/bn_rand.c:200:1: Parameter `bits`
  198.   }
  199.   
  200. > int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  201.   {
  202.       return bnrand(0, rnd, bits, top, bottom);

crypto/bn/bn_rand.c:202:12: Call
  200.   int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  201.   {
  202.       return bnrand(0, rnd, bits, top, bottom);
                    ^
  203.   }
  204.   

crypto/bn/bn_rand.c:164:14: <Offset trace>
162.           unsigned char c;
163.   
164.           for (i = 0; i < bytes; i++) {
                    ^
165.               if (RAND_bytes(&c, 1) <= 0)
166.                   goto err;

crypto/bn/bn_rand.c:164:14: Assignment
    162.           unsigned char c;
    163.   
    164.           for (i = 0; i < bytes; i++) {
                        ^
    165.               if (RAND_bytes(&c, 1) <= 0)
    166.                   goto err;

crypto/bn/bn_rand.c:119:1: <Length trace>
117.   #include <openssl/sha.h>
118.   
119. > static int bnrand(int pseudorand, BIGNUM *rnd, int bits, int top, int bottom)
120.   {
121.       unsigned char *buf = NULL;

crypto/bn/bn_rand.c:119:1: Parameter `bits`
    117.   #include <openssl/sha.h>
    118.   
    119. > static int bnrand(int pseudorand, BIGNUM *rnd, int bits, int top, int bottom)
    120.   {
    121.       unsigned char *buf = NULL;

crypto/bn/bn_rand.c:135:5: Assignment
    133.       }
    134.   
    135.       bytes = (bits + 7) / 8;
               ^
    136.       bit = (bits - 1) % 8;
    137.       mask = 0xff << (bit + 1);

crypto/bn/bn_rand.c:139:11: Call
    137.       mask = 0xff << (bit + 1);
    138.   
    139.       buf = OPENSSL_malloc(bytes);
                     ^
    140.       if (buf == NULL) {
    141.           BNerr(BN_F_BNRAND, ERR_R_MALLOC_FAILURE);

crypto/mem.c:125:9: Assignment
      123.   
      124.       if (num <= 0)
      125.           return NULL;
                     ^
      126.   
      127.       allow_customize = 0;

crypto/bn/bn_rand.c:139:5: Assignment
    137.       mask = 0xff << (bit + 1);
    138.   
    139.       buf = OPENSSL_malloc(bytes);
               ^
    140.       if (buf == NULL) {
    141.           BNerr(BN_F_BNRAND, ERR_R_MALLOC_FAILURE);

crypto/bn/bn_rand.c:170:17: Array access: Offset: [0, 518] Size: [1, 519] by call to `BN_rand` 
    168.                   buf[i] = buf[i - 1];
    169.               else if (c < 42)
    170.                   buf[i] = 0;
                           ^
    171.               else if (c < 84)
    172.                   buf[i] = 255;
