crypto/dh/dh_check.c:156: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_sub_word`.
Showing all 6 steps of the trace


crypto/dh/dh_check.c:152:5: Call
150.       if (q == NULL)
151.           goto err;
152.       BN_set_word(q, 1);
           ^
153.       if (BN_cmp(pub_key, q) <= 0)
154.           *ret |= DH_CHECK_PUBKEY_TOO_SMALL;

crypto/bn/bn_lib.c:530:1: Parameter `*a->d`
  528.   }
  529.   
  530. > int BN_set_word(BIGNUM *a, BN_ULONG w)
  531.   {
  532.       bn_check_top(a);

crypto/dh/dh_check.c:156:5: Call
154.           *ret |= DH_CHECK_PUBKEY_TOO_SMALL;
155.       BN_copy(q, dh->p);
156.       BN_sub_word(q, 1);
           ^
157.       if (BN_cmp(pub_key, q) >= 0)
158.           *ret |= DH_CHECK_PUBKEY_TOO_LARGE;

crypto/bn/bn_word.c:159:1: <Length trace>
157.   }
158.   
159. > int BN_sub_word(BIGNUM *a, BN_ULONG w)
160.   {
161.       int i;

crypto/bn/bn_word.c:159:1: Parameter `*a->d`
  157.   }
  158.   
  159. > int BN_sub_word(BIGNUM *a, BN_ULONG w)
  160.   {
  161.       int i;

crypto/bn/bn_word.c:184:27: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_sub_word` 
  182.       }
  183.   
  184.       if ((a->top == 1) && (a->d[0] < w)) {
                                   ^
  185.           a->d[0] = w - a->d[0];
  186.           a->neg = 1;
