test/bntest.c:605: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, 8388607] by call to `BN_div_recp`.
Showing all 12 steps of the trace


test/bntest.c:604:9: Call
602.           a->neg = rand_neg();
603.           b->neg = rand_neg();
604.           BN_RECP_CTX_set(recp, b, ctx);
               ^
605.           BN_div_recp(d, c, a, recp, ctx);
606.           if (bp != NULL) {

crypto/bn/bn_recp.c:93:1: Parameter `*recp->Nr.d`
  91.   }
  92.   
  93. > int BN_RECP_CTX_set(BN_RECP_CTX *recp, const BIGNUM *d, BN_CTX *ctx)
  94.   {
  95.       if (!BN_copy(&(recp->N), d))

test/bntest.c:605:9: Call
603.           b->neg = rand_neg();
604.           BN_RECP_CTX_set(recp, b, ctx);
605.           BN_div_recp(d, c, a, recp, ctx);
               ^
606.           if (bp != NULL) {
607.               if (!results) {

crypto/bn/bn_recp.c:139:9: Call
  137.   
  138.       BN_CTX_start(ctx);
  139.       a = BN_CTX_get(ctx);
                 ^
  140.       b = BN_CTX_get(ctx);
  141.       if (dv != NULL)

crypto/bn/bn_ctx.c:284:5: Call
    282.       }
    283.       /* OK, make sure the returned bignum is "zero" */
    284.       BN_zero(ret);
               ^
    285.       ctx->used++;
    286.       CTXDBG_RET(ctx, ret);

crypto/bn/bn_lib.c:530:1: Parameter `*a->d`
      528.   }
      529.   
      530. > int BN_set_word(BIGNUM *a, BN_ULONG w)
      531.   {
      532.       bn_check_top(a);

crypto/bn/bn_recp.c:190:10: Call
  188.       if (!BN_mul(b, a, &(recp->Nr), ctx))
  189.           goto err;
  190.       if (!BN_rshift(d, b, i - recp->num_bits))
                  ^
  191.           goto err;
  192.       d->neg = 0;

crypto/bn/bn_shift.c:169:1: <Length trace>
167.   }
168.   
169. > int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
170.   {
171.       int i, j, nw, lb, rb;

crypto/bn/bn_shift.c:169:1: Parameter `*a->d`
    167.   }
    168.   
    169. > int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
    170.   {
    171.       int i, j, nw, lb, rb;

crypto/bn/bn_shift.c:200:5: Assignment
    198.       }
    199.   
    200.       f = &(a->d[nw]);
               ^
    201.       t = r->d;
    202.       j = a->top - nw;

crypto/bn/bn_shift.c:209:15: Assignment
    207.               *(t++) = *(f++);
    208.       } else {
    209.           l = *(f++);
                         ^
    210.           for (i = j - 1; i != 0; i--) {
    211.               tmp = (l >> rb) & BN_MASK2;

crypto/bn/bn_shift.c:212:17: Array access: Offset: [1, +oo] Size: [0, 8388607] by call to `BN_div_recp` 
    210.           for (i = j - 1; i != 0; i--) {
    211.               tmp = (l >> rb) & BN_MASK2;
    212.               l = *(f++);
                           ^
    213.               *(t++) = (tmp | (l << lb)) & BN_MASK2;
    214.           }
