crypto/dh/dh_rfc5114.c:40: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_dup`.
Showing all 10 steps of the trace


crypto/dh/dh_rfc5114.c:40:1: Call
38.   
39.   make_dh(1024_160)
40. > make_dh(2048_224)
41.   make_dh(2048_256)

crypto/bn/bn_lib.c:261:1: Parameter `a->top`
  259.   }
  260.   
  261. > BIGNUM *BN_dup(const BIGNUM *a)
  262.   {
  263.       BIGNUM *t;

crypto/bn/bn_lib.c:272:10: Call
  270.       if (t == NULL)
  271.           return NULL;
  272.       if (!BN_copy(t, a)) {
                  ^
  273.           BN_free(t);
  274.           return NULL;

crypto/bn/bn_lib.c:280:1: <Offset trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `b->top`
    278.   }
    279.   
    280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    281.   {
    282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: <Length trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `*a->d`
    278.   }
    279.   
    280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    281.   {
    282.       bn_check_top(b);

crypto/bn/bn_lib.c:286:9: Call
    284.       if (a == b)
    285.           return a;
    286.       if (bn_wexpand(a, b->top) == NULL)
                   ^
    287.           return NULL;
    288.   

crypto/bn/bn_lib.c:942:1: Parameter `*a->d`
      940.   }
      941.   
      942. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
      943.   {
      944.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:290:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_dup` 
    288.   
    289.       if (b->top > 0)
    290.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                   ^
    291.   
    292.       a->neg = b->neg;
