crypto/bn/bn_conv.c:77: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_dup`.
Showing all 14 steps of the trace


crypto/bn/bn_conv.c:52:1: Parameter `a->top`
50.   /* No BIO_snprintf in FIPS_MODE */
51.   /* Must 'OPENSSL_free' the returned data */
52. > char *BN_bn2dec(const BIGNUM *a)
53.   {
54.       int i = 0, num, ok = 0, n, tbytes;

crypto/bn/bn_conv.c:67:9: Call
65.        *     <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
66.        */
67.       i = BN_num_bits(a) * 3;
              ^
68.       num = (i / 10 + i / 1000 + 1) + 1;
69.       tbytes = num + 3;   /* negative and terminator and one spare? */

crypto/bn/bn_lib.c:140:9: Call
  138.       bn_check_top(a);
  139.   
  140.       if (BN_is_zero(a))
                 ^
  141.           return 0;
  142.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));

crypto/bn/bn_lib.c:866:1: Parameter `a->top`
    864.   }
    865.   
    866. > int BN_is_zero(const BIGNUM *a)
    867.   {
    868.       return a->top == 0;

crypto/bn/bn_conv.c:77:14: Call
75.           goto err;
76.       }
77.       if ((t = BN_dup(a)) == NULL)
                   ^
78.           goto err;
79.   

crypto/bn/bn_lib.c:262:1: Parameter `a->top`
  260.   }
  261.   
  262. > BIGNUM *BN_dup(const BIGNUM *a)
  263.   {
  264.       BIGNUM *t;

crypto/bn/bn_lib.c:273:10: Call
  271.       if (t == NULL)
  272.           return NULL;
  273.       if (!BN_copy(t, a)) {
                  ^
  274.           BN_free(t);
  275.           return NULL;

crypto/bn/bn_lib.c:281:1: <Offset trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `b->top`
    279.   }
    280.   
    281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    282.   {
    283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: <Length trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `*a->d`
    279.   }
    280.   
    281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    282.   {
    283.       bn_check_top(b);

crypto/bn/bn_lib.c:287:9: Call
    285.       if (a == b)
    286.           return a;
    287.       if (bn_wexpand(a, b->top) == NULL)
                   ^
    288.           return NULL;
    289.   

crypto/bn/bn_lib.c:962:1: Parameter `*a->d`
      960.   }
      961.   
      962. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
      963.   {
      964.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:291:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_dup` 
    289.   
    290.       if (b->top > 0)
    291.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                   ^
    292.   
    293.       a->neg = b->neg;
