crypto/rand/drbg_lib.c:357: error: BUFFER_OVERRUN_L3
  Offset added: [0, 15] Size: [0, +oo] by call to `RAND_DRBG_generate`.
Showing all 10 steps of the trace


crypto/rand/drbg_lib.c:343:1: Parameter `count`
341.    */
342.   
343. > static int drbg_bytes(unsigned char *out, int count)
344.   {
345.       int ret = 0;

crypto/rand/drbg_lib.c:354:9: Assignment
352.   
353.       for ( ; count > 0; count -= chunk, out += chunk) {
354.           chunk = count;
               ^
355.           if (chunk > rand_drbg.max_request)
356.               chunk = rand_drbg.max_request;

crypto/rand/drbg_lib.c:357:15: Call
355.           if (chunk > rand_drbg.max_request)
356.               chunk = rand_drbg.max_request;
357.           ret = RAND_DRBG_generate(&rand_drbg, out, chunk, 0, NULL, 0);
                     ^
358.           if (!ret)
359.               goto err;

crypto/rand/drbg_lib.c:248:1: Parameter `outlen`
  246.    * sent in |adin| and |adinlen|.
  247.    */
  248. > int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,
  249.                          int prediction_resistance,
  250.                          const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_lib.c:281:10: Call
  279.       }
  280.   
  281.       if (!ctr_generate(drbg, out, outlen, adin, adinlen)) {
                  ^
  282.           drbg->state = DRBG_ERROR;
  283.           RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);

crypto/rand/drbg_rand.c:261:1: <Offset trace>
259.   }
260.   
261. > int ctr_generate(RAND_DRBG *drbg,
262.                    unsigned char *out, size_t outlen,
263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:261:1: Parameter `outlen`
    259.   }
    260.   
    261. > int ctr_generate(RAND_DRBG *drbg,
    262.                    unsigned char *out, size_t outlen,
    263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:261:1: <Length trace>
259.   }
260.   
261. > int ctr_generate(RAND_DRBG *drbg,
262.                    unsigned char *out, size_t outlen,
263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:261:1: Parameter `drbg->ctr.K[*]`
    259.   }
    260.   
    261. > int ctr_generate(RAND_DRBG *drbg,
    262.                    unsigned char *out, size_t outlen,
    263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:283:13: Array access: Offset added: [0, 15] Size: [0, +oo] by call to `RAND_DRBG_generate` 
    281.               /* Use K as temp space as it will be updated */
    282.               AES_encrypt(ctr->V, ctr->K, &ctr->ks);
    283.               memcpy(out, ctr->K, outlen);
                       ^
    284.               break;
    285.           }
