apps/dhparam.c:271: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `DH_check`.
Showing all 20 steps of the trace


apps/dhparam.c:200:32: Call
198.                          num, g);
199.               BIO_printf(bio_err, "This is going to take a long time\n");
200.               if (dh == NULL || !DH_generate_parameters_ex(dh, num, g, cb)) {
                                      ^
201.                   BN_GENCB_free(cb);
202.                   ERR_print_errors(bio_err);

crypto/dh/dh_gen.c:23:1: Parameter `ret->p->top`
  21.                                   BN_GENCB *cb);
  22.   
  23. > int DH_generate_parameters_ex(DH *ret, int prime_len, int generator,
  24.                                 BN_GENCB *cb)
  25.   {

apps/dhparam.c:271:14: Call
269.   
270.       if (check) {
271.           if (!DH_check(dh, &i)) {
                    ^
272.               ERR_print_errors(bio_err);
273.               goto end;

crypto/dh/dh_check.c:65:1: Parameter `dh->p->top`
  63.    */
  64.   
  65. > int DH_check(const DH *dh, int *ret)
  66.   {
  67.       int ok = 0, r;

crypto/dh/dh_check.c:85:18: Call
  83.           if (BN_cmp(dh->g, BN_value_one()) <= 0)
  84.               *ret |= DH_NOT_SUITABLE_GENERATOR;
  85.           else if (BN_cmp(dh->g, dh->p) >= 0)
                         ^
  86.               *ret |= DH_NOT_SUITABLE_GENERATOR;
  87.           else {

crypto/bn/bn_lib.c:580:1: Parameter `a->top`
    578.   }
    579.   
    580. > int BN_cmp(const BIGNUM *a, const BIGNUM *b)
    581.   {
    582.       int i;

crypto/dh/dh_check.c:89:18: Call
  87.           else {
  88.               /* Check g^q == 1 mod p */
  89.               if (!BN_mod_exp(t1, dh->g, dh->q, dh->p, ctx))
                         ^
  90.                   goto err;
  91.               if (!BN_is_one(t1))

crypto/bn/bn_exp.c:88:1: Parameter `m->top`
    86.   }
    87.   
    88. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
    89.                  BN_CTX *ctx)
    90.   {

crypto/bn/bn_exp.c:133:9: Call
    131.   
    132.   #ifdef MONT_MUL_MOD
    133.       if (BN_is_odd(m)) {
                   ^
    134.   # ifdef MONT_EXP_WORD
    135.           if (a->top == 1 && !a->neg

crypto/bn/bn_lib.c:870:1: Parameter `a->top`
      868.   }
      869.   
      870. > int BN_is_odd(const BIGNUM *a)
      871.   {
      872.       return (a->top > 0) && (a->d[0] & 1);

crypto/bn/bn_exp.c:146:15: Call
    144.   #ifdef RECP_MUL_MOD
    145.       {
    146.           ret = BN_mod_exp_recp(r, a, p, m, ctx);
                         ^
    147.       }
    148.   #else

crypto/bn/bn_exp.c:158:1: Parameter `m->top`
      156.   }
      157.   
      158. > int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
      159.                       const BIGNUM *m, BN_CTX *ctx)
      160.   {

crypto/bn/bn_exp.c:195:14: Call
      193.       if (m->neg) {
      194.           /* ignore sign of 'm' */
      195.           if (!BN_copy(aa, m))
                          ^
      196.               goto err;
      197.           aa->neg = 0;

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
        321.   }
        322.   
        323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        324.   {
        325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
        321.   }
        322.   
        323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        324.   {
        325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
        327.       if (a == b)
        328.           return a;
        329.       if (bn_wexpand(a, b->top) == NULL)
                       ^
        330.           return NULL;
        331.   

crypto/bn/bn_lib.c:951:1: Parameter `*a->d`
          949.   }
          950.   
          951. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
          952.   {
          953.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `DH_check` 
        331.   
        332.       if (b->top > 0)
        333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                       ^
        334.   
        335.       if (BN_get_flags(b, BN_FLG_CONSTTIME) != 0)
