crypto/bn/bn_print.c:106: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [0, +oo].
Showing all 12 steps of the trace


crypto/bn/bn_print.c:70:9: <Length trace>
68.        *     <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
69.        */
70.       i = BN_num_bits(a) * 3;
              ^
71.       num = (i / 10 + i / 1000 + 1) + 1;
72.       bn_data_num = num / BN_DEC_NUM + 1;

crypto/bn/bn_print.c:70:9: Call
68.        *     <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
69.        */
70.       i = BN_num_bits(a) * 3;
              ^
71.       num = (i / 10 + i / 1000 + 1) + 1;
72.       bn_data_num = num / BN_DEC_NUM + 1;

crypto/bn/bn_lib.c:167:9: Assignment
  165.   
  166.       if (BN_is_zero(a))
  167.           return 0;
                 ^
  168.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));
  169.   }

crypto/bn/bn_print.c:70:5: Assignment
68.        *     <= 3 * BN_num_bits(a) / 10 + 3 * BN_num_bits / 1000 + 1 + 1
69.        */
70.       i = BN_num_bits(a) * 3;
          ^
71.       num = (i / 10 + i / 1000 + 1) + 1;
72.       bn_data_num = num / BN_DEC_NUM + 1;

crypto/bn/bn_print.c:71:5: Assignment
69.        */
70.       i = BN_num_bits(a) * 3;
71.       num = (i / 10 + i / 1000 + 1) + 1;
          ^
72.       bn_data_num = num / BN_DEC_NUM + 1;
73.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));

crypto/bn/bn_print.c:72:5: Assignment
70.       i = BN_num_bits(a) * 3;
71.       num = (i / 10 + i / 1000 + 1) + 1;
72.       bn_data_num = num / BN_DEC_NUM + 1;
          ^
73.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
74.       buf = OPENSSL_malloc(num + 3);

crypto/bn/bn_print.c:73:15: Call
71.       num = (i / 10 + i / 1000 + 1) + 1;
72.       bn_data_num = num / BN_DEC_NUM + 1;
73.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
                    ^
74.       buf = OPENSSL_malloc(num + 3);
75.       if ((buf == NULL) || (bn_data == NULL)) {

crypto/mem.c:165:9: Assignment
  163.   
  164.       if (num <= 0)
  165.           return NULL;
                 ^
  166.   
  167.       FAILTEST();

crypto/bn/bn_print.c:73:5: Assignment
71.       num = (i / 10 + i / 1000 + 1) + 1;
72.       bn_data_num = num / BN_DEC_NUM + 1;
73.       bn_data = OPENSSL_malloc(bn_data_num * sizeof(BN_ULONG));
          ^
74.       buf = OPENSSL_malloc(num + 3);
75.       if ((buf == NULL) || (bn_data == NULL)) {

crypto/bn/bn_print.c:84:5: Assignment
82.   #define BUF_REMAIN (num+3 - (size_t)(p - buf))
83.       p = buf;
84.       lp = bn_data;
          ^
85.       if (BN_is_zero(t)) {
86.           *(p++) = '0';

crypto/bn/bn_print.c:100:9: Assignment
98.               lp++;
99.           }
100.           lp--;
               ^
101.           /*
102.            * We now have a series of blocks, BN_DEC_NUM chars in length, where

crypto/bn/bn_print.c:106:50: Array access: Offset: [-1, +oo] Size: [0, +oo]
104.            * order.
105.            */
106.           BIO_snprintf(p, BUF_REMAIN, BN_DEC_FMT1, *lp);
                                                        ^
107.           while (*p)
108.               p++;
