crypto/bn/bn_recp.c:76: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_div_recp`.
Showing all 11 steps of the trace


crypto/bn/bn_recp.c:54:1: Parameter `x->top`
52.   }
53.   
54. > int BN_mod_mul_reciprocal(BIGNUM *r, const BIGNUM *x, const BIGNUM *y,
55.                             BN_RECP_CTX *recp, BN_CTX *ctx)
56.   {

crypto/bn/bn_recp.c:76:11: Call
74.           ca = x;                 /* Just do the mod */
75.   
76.       ret = BN_div_recp(NULL, r, ca, recp, ctx);
                ^
77.    err:
78.       BN_CTX_end(ctx);

crypto/bn/bn_recp.c:83:1: Parameter `m->top`
  81.   }
  82.   
  83. > int BN_div_recp(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m,
  84.                   BN_RECP_CTX *recp, BN_CTX *ctx)
  85.   {

crypto/bn/bn_recp.c:99:14: Call
  97.       if (BN_ucmp(m, &(recp->N)) < 0) {
  98.           BN_zero(d);
  99.           if (!BN_copy(r, m)) {
                      ^
  100.               BN_CTX_end(ctx);
  101.               return 0;

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
    321.   }
    322.   
    323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    324.   {
    325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
    321.   }
    322.   
    323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    324.   {
    325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
    327.       if (a == b)
    328.           return a;
    329.       if (bn_wexpand(a, b->top) == NULL)
                   ^
    330.           return NULL;
    331.   

crypto/bn/bn_lib.c:951:1: Parameter `*a->d`
      949.   }
      950.   
      951. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
      952.   {
      953.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_div_recp` 
    331.   
    332.       if (b->top > 0)
    333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                   ^
    334.   
    335.       if (BN_get_flags(b, BN_FLG_CONSTTIME) != 0)
