test/drbgtest.c:350: error: BUFFER_OVERRUN_L3
  Offset added: [1, 15] Size: [0, +oo] by call to `RAND_DRBG_generate`.
Showing all 11 steps of the trace


test/drbgtest.c:280:10: Call
278.       int ret = 0;
279.   
280.       if (!TEST_ptr(drbg = RAND_DRBG_new(0, 0, NULL)))
                ^
281.           goto err;
282.   

crypto/rand/drbg_lib.c:77:9: Call
  75.   
  76.       drbg->parent = parent;
  77.       if (RAND_DRBG_set(drbg, type, flags) < 0)
                ^
  78.           goto err;
  79.   

crypto/rand/drbg_lib.c:33:1: Parameter `drbg->max_request`
    31.    * failure.
    32.    */
    33. > int RAND_DRBG_set(RAND_DRBG *drbg, int nid, unsigned int flags)
    34.   {
    35.       int ret = 1;

test/drbgtest.c:350:10: Call
348.   
349.       /* Request too much data for one request */
350.       if (!TEST_false(RAND_DRBG_generate(drbg, buff, drbg->max_request + 1, 0,
                ^
351.                                          td->adin, td->adinlen)))
352.           goto err;

crypto/rand/drbg_lib.c:248:1: Parameter `outlen`
  246.    * sent in |adin| and |adinlen|.
  247.    */
  248. > int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,
  249.                          int prediction_resistance,
  250.                          const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_lib.c:281:10: Call
  279.       }
  280.   
  281.       if (!ctr_generate(drbg, out, outlen, adin, adinlen)) {
                  ^
  282.           drbg->state = DRBG_ERROR;
  283.           RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);

crypto/rand/drbg_rand.c:261:1: <Offset trace>
259.   }
260.   
261. > int ctr_generate(RAND_DRBG *drbg,
262.                    unsigned char *out, size_t outlen,
263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:261:1: Parameter `outlen`
    259.   }
    260.   
    261. > int ctr_generate(RAND_DRBG *drbg,
    262.                    unsigned char *out, size_t outlen,
    263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:261:1: <Length trace>
259.   }
260.   
261. > int ctr_generate(RAND_DRBG *drbg,
262.                    unsigned char *out, size_t outlen,
263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:261:1: Parameter `drbg->ctr.K[*]`
    259.   }
    260.   
    261. > int ctr_generate(RAND_DRBG *drbg,
    262.                    unsigned char *out, size_t outlen,
    263.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:283:13: Array access: Offset added: [1, 15] Size: [0, +oo] by call to `RAND_DRBG_generate` 
    281.               /* Use K as temp space as it will be updated */
    282.               AES_encrypt(ctr->V, ctr->K, &ctr->ks);
    283.               memcpy(out, ctr->K, outlen);
                       ^
    284.               break;
    285.           }
