crypto/rsa/rsa_ossl.c:797: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_add`.
Showing all 12 steps of the trace


crypto/rsa/rsa_ossl.c:790:10: Call
788.       }
789.   
790.       if (!BN_sub(r0, r0, m1))
                ^
791.           goto err;
792.       /*

crypto/bn/bn_add.c:45:1: Parameter `*r->d`
  43.   
  44.   /* signed sub of b from a. */
  45. > int BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
  46.   {
  47.       int ret, r_neg, cmp_res;

crypto/bn/bn_add.c:59:19: Call
  57.           if (cmp_res > 0) {
  58.               r_neg = a->neg;
  59.               ret = BN_usub(r, a, b);
                          ^
  60.           } else if (cmp_res < 0) {
  61.               r_neg = !b->neg;

crypto/bn/bn_add.c:125:1: Parameter `*r->d`
    123.   
    124.   /* unsigned subtraction of b from a, a must be larger than b. */
    125. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
    126.   {
    127.       int max, min, dif;

crypto/rsa/rsa_ossl.c:797:14: Call
795.        */
796.       if (BN_is_negative(r0))
797.           if (!BN_add(r0, r0, rsa->p))
                    ^
798.               goto err;
799.   

crypto/bn/bn_add.c:14:1: Parameter `*r->d`
  12.   
  13.   /* signed add of b to a. */
  14. > int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
  15.   {
  16.       int ret, r_neg, cmp_res;

crypto/bn/bn_add.c:34:13: Call
  32.           } else {
  33.               r_neg = 0;
  34.               BN_zero(r);
                    ^
  35.               ret = 1;
  36.           }

crypto/bn/bn_lib.c:358:1: <Length trace>
356.   }
357.   
358. > int BN_set_word(BIGNUM *a, BN_ULONG w)
359.   {
360.       bn_check_top(a);

crypto/bn/bn_lib.c:358:1: Parameter `*a->d`
    356.   }
    357.   
    358. > int BN_set_word(BIGNUM *a, BN_ULONG w)
    359.   {
    360.       bn_check_top(a);

crypto/bn/bn_lib.c:361:9: Call
    359.   {
    360.       bn_check_top(a);
    361.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                   ^
    362.           return 0;
    363.       a->neg = 0;

crypto/bn/bn_lcl.h:660:1: Parameter `*a->d`
      658.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
      659.   
      660. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
      661.   {
      662.       if (bits > (INT_MAX - BN_BITS2 + 1))

crypto/bn/bn_lib.c:364:5: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_add` 
    362.           return 0;
    363.       a->neg = 0;
    364.       a->d[0] = w;
               ^
    365.       a->top = (w ? 1 : 0);
    366.       a->flags &= ~BN_FLG_FIXED_TOP;
