crypto/bn/bntest.c:454: error: BUFFER_OVERRUN_L3
  Offset: [16, +oo] Size: [0, +oo] by call to `BN_mul`.
Showing all 9 steps of the trace


crypto/bn/bntest.c:449:3: Call
447.   		{
448.   		BN_rand(&b,250+i,0,0);
449.   		BN_rand(&b,200,0,0);
         ^
450.   		a.neg=rand_neg();
451.   		b.neg=rand_neg();

crypto/bn/bn_rand.c:65:1: Parameter `rnd->top`
  63.   #include <openssl/rand.h>
  64.   
  65. > int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  66.   	{
  67.   	unsigned char *buf=NULL;

crypto/bn/bntest.c:454:5: Call
452.   		if (bp == NULL)
453.   			for (j=0; j<100; j++)
454.   				BN_mul(&c,&a,&b,&ctx);
           ^
455.   		BN_mul(&c,&a,&b,&ctx);
456.   		if (bp != NULL)

crypto/bn/bn_mul.c:560:1: <Offset trace>
558.   #endif
559.   
560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
561.   	{
562.   	int top,al,bl;

crypto/bn/bn_mul.c:560:1: Parameter `a->top`
  558.   #endif
  559.   
  560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
  561.   	{
  562.   	int top,al,bl;

crypto/bn/bn_mul.c:577:2: Assignment
  575.   	bn_check_top(r);
  576.   
  577.   	al=a->top;
          ^
  578.   	bl=b->top;
  579.   	r->neg=a->neg^b->neg;

crypto/bn/bn_mul.c:560:1: <Length trace>
558.   #endif
559.   
560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
561.   	{
562.   	int top,al,bl;

crypto/bn/bn_mul.c:560:1: Parameter `*b->d`
  558.   #endif
  559.   
  560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
  561.   	{
  562.   	int top,al,bl;

crypto/bn/bn_mul.c:641:4: Array access: Offset: [16, +oo] Size: [0, +oo] by call to `BN_mul` 
  639.   			{
  640.   			bn_wexpand(b,al);
  641.   			b->d[bl]=0;
            ^
  642.   			bl++;
  643.   			goto symetric;
