crypto/bn/bn_gf2m.c:456: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, 8388607] by call to `bn_correct_top`.
Showing all 10 steps of the trace


crypto/bn/bn_gf2m.c:418:1: Parameter `b->top`
416.    * the result in r.  r could be a or b; a could be b.
417.    */
418. > int BN_GF2m_mod_mul_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
419.                           const int p[], BN_CTX *ctx)
420.   {

crypto/bn/bn_gf2m.c:436:5: Assignment
434.           goto err;
435.   
436.       zlen = a->top + b->top + 4;
           ^
437.       if (!bn_wexpand(s, zlen))
438.           goto err;

crypto/bn/bn_gf2m.c:439:5: Assignment
437.       if (!bn_wexpand(s, zlen))
438.           goto err;
439.       s->top = zlen;
           ^
440.   
441.       for (i = 0; i < zlen; i++)

crypto/bn/bn_gf2m.c:456:5: Call
454.       }
455.   
456.       bn_correct_top(s);
           ^
457.       if (BN_GF2m_mod_arr(r, s, p))
458.           ret = 1;

crypto/bn/bn_lib.c:1019:1: <Offset trace>
1017.   }
1018.   
1019. > void bn_correct_top(BIGNUM *a)
1020.   {
1021.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:1019:1: Parameter `a->top`
  1017.   }
  1018.   
  1019. > void bn_correct_top(BIGNUM *a)
  1020.   {
  1021.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:1022:5: Assignment
  1020.   {
  1021.       BN_ULONG *ftl;
  1022.       int tmp_top = a->top;
              ^
  1023.   
  1024.       if (tmp_top > 0) {

crypto/bn/bn_lib.c:1019:1: <Length trace>
1017.   }
1018.   
1019. > void bn_correct_top(BIGNUM *a)
1020.   {
1021.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:1019:1: Parameter `*a->d`
  1017.   }
  1018.   
  1019. > void bn_correct_top(BIGNUM *a)
  1020.   {
  1021.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:1025:14: Array access: Offset: [1, +oo] Size: [0, 8388607] by call to `bn_correct_top` 
  1023.   
  1024.       if (tmp_top > 0) {
  1025.           for (ftl = &(a->d[tmp_top]); tmp_top > 0; tmp_top--) {
                       ^
  1026.               ftl--;
  1027.               if (*ftl != 0)
