apps/dh.c:227: error: BUFFER_OVERRUN_L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [2, +oo] by call to `DH_check`.
Showing all 18 steps of the trace


apps/dh.c:213:3: Call
211.   	if (text)
212.   		{
213.   		DHparams_print(out,dh);
         ^
214.   #ifdef undef
215.   		printf("p=");

crypto/asn1/t_pkey.c:290:1: Parameter `x->p->top`
  288.   #endif
  289.   
  290. > int DHparams_print(BIO *bp, DH *x)
  291.   	{
  292.   	unsigned char *m=NULL;

crypto/asn1/t_pkey.c:295:4: Call
  293.   	int reason=ERR_R_BUF_LIB,i,ret=0;
  294.   
  295.   	i=BN_num_bytes(x->p);
            ^
  296.   	m=(unsigned char *)Malloc((unsigned int)i+10);
  297.   	if (m == NULL)

crypto/bn/bn_lib.c:238:1: Parameter `a->top`
    236.   	}
    237.   
    238. > int BN_num_bits(BIGNUM *a)
    239.   	{
    240.   	BN_ULONG l;

apps/dh.c:227:8: Call
225.   	if (check)
226.   		{
227.   		if (!DH_check(dh,&i))
              ^
228.   			{
229.   			ERR_print_errors(bio_err);

crypto/dh/dh_check.c:73:1: Parameter `dh->p->top`
  71.    */
  72.   
  73. > int DH_check(DH *dh, int *ret)
  74.   	{
  75.   	int ok=0;

crypto/dh/dh_check.c:105:7: Call
  103.   		*ret|=DH_UNABLE_TO_CHECK_GENERATOR;
  104.   
  105.   	if (!BN_is_prime(dh->p,BN_prime_checks,NULL,ctx,NULL))
               ^
  106.   		*ret|=DH_CHECK_P_NOT_PRIME;
  107.   	else

crypto/bn/bn_prime.c:162:1: Parameter `a->top`
    160.   	}
    161.   
    162. > int BN_is_prime(BIGNUM *a, int checks, void (*callback)(P_I_I_P),
    163.   	     BN_CTX *ctx_passed, char *cb_arg)
    164.   	{

crypto/bn/bn_prime.c:183:7: Call
    181.   
    182.   	/* Setup the montgomery structure */
    183.   	if (!BN_MONT_CTX_set(mont,a,ctx2)) goto err;
                 ^
    184.   
    185.   	for (i=0; i<checks; i++)

crypto/bn/bn_mont.c:301:1: Parameter `mod->top`
      299.   	}
      300.   
      301. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, BIGNUM *mod, BN_CTX *ctx)
      302.   	{
      303.   	BIGNUM Ri,*R;

crypto/bn/bn_mont.c:307:2: Call
      305.   	BN_init(&Ri);
      306.   	R= &(mont->RR);					/* grab RR as a temp */
      307.   	BN_copy(&(mont->N),mod);			/* Set N */
              ^
      308.   
      309.   #ifdef BN_RECURSION_MONT

crypto/bn/bn_lib.c:454:1: Parameter `a->max`
        452.   	}
        453.   
        454. > BIGNUM *BN_copy(BIGNUM *a, BIGNUM *b)
        455.   	{
        456.   	int i;

crypto/bn/bn_lib.c:462:6: Call
        460.   
        461.   	if (a == b) return(a);
        462.   	if (bn_wexpand(a,b->top) == NULL) return(NULL);
                    ^
        463.   
        464.   #if 1

crypto/bn/bn_lib.c:344:1: <Length trace>
342.   	}
343.   
344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
345.   	{
346.   	BN_ULONG *A,*B,*a;

crypto/bn/bn_lib.c:344:1: Parameter `words`
          342.   	}
          343.   
          344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
          345.   	{
          346.   	BN_ULONG *A,*B,*a;

crypto/bn/bn_lib.c:359:19: Array declaration
          357.   			return(NULL);
          358.   			}
          359.   		a=A=(BN_ULONG *)Malloc(sizeof(BN_ULONG)*(words+1));
                                   ^
          360.   		if (A == NULL)
          361.   			{

crypto/bn/bn_lib.c:359:5: Assignment
          357.   			return(NULL);
          358.   			}
          359.   		a=A=(BN_ULONG *)Malloc(sizeof(BN_ULONG)*(words+1));
                     ^
          360.   		if (A == NULL)
          361.   			{

crypto/bn/bn_lib.c:377:38: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [2, +oo] by call to `DH_check` 
          375.   				{
          376.   				A[0]=B[0]; A[1]=B[1]; A[2]=B[2]; A[3]=B[3];
          377.   				A[4]=B[4]; A[5]=B[5]; A[6]=B[6]; A[7]=B[7];
                                                      ^
          378.   				A+=8;
          379.   				B+=8;
