test/bntest.c:285: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `BN_div_recp`.
Showing all 21 steps of the trace


test/bntest.c:285:9: Call
283.           BN_set_negative(b, rand_neg());
284.           BN_RECP_CTX_set(recp, b, ctx);
285.           BN_div_recp(d, c, a, recp, ctx);
               ^
286.           BN_mul(e, d, b, ctx);
287.           BN_add(d, e, c);

crypto/bn/bn_recp.c:84:1: Parameter `ctx->stack.depth`
  82.   }
  83.   
  84. > int BN_div_recp(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m,
  85.                   BN_RECP_CTX *recp, BN_CTX *ctx)
  86.   {

crypto/bn/bn_recp.c:90:5: Call
  88.       BIGNUM *a, *b, *d, *r;
  89.   
  90.       BN_CTX_start(ctx);
            ^
  91.       d = (dv != NULL) ? dv : BN_CTX_get(ctx);
  92.       r = (rem != NULL) ? rem : BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:171:1: Parameter `ctx->stack.depth`
    169.   }
    170.   
    171. > void BN_CTX_start(BN_CTX *ctx)
    172.   {
    173.       CTXDBG("ENTER BN_CTX_start()", ctx);

crypto/bn/bn_recp.c:101:13: Call
  99.           BN_zero(d);
  100.           if (!BN_copy(r, m)) {
  101.               BN_CTX_end(ctx);
                     ^
  102.               return 0;
  103.           }

crypto/bn/bn_ctx.c:185:1: Parameter `ctx->stack.depth`
    183.   }
    184.   
    185. > void BN_CTX_end(BN_CTX *ctx)
    186.   {
    187.       CTXDBG("ENTER BN_CTX_end()", ctx);

test/bntest.c:286:9: Call
284.           BN_RECP_CTX_set(recp, b, ctx);
285.           BN_div_recp(d, c, a, recp, ctx);
286.           BN_mul(e, d, b, ctx);
               ^
287.           BN_add(d, e, c);
288.           BN_sub(d, d, a);

crypto/bn/bn_mul.c:497:1: Parameter `ctx->stack.depth`
  495.   #endif                          /* BN_RECURSION */
  496.   
  497. > int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
  498.   {
  499.       int ret = bn_mul_fixed_top(r, a, b, ctx);

crypto/bn/bn_mul.c:499:15: Call
  497.   int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
  498.   {
  499.       int ret = bn_mul_fixed_top(r, a, b, ctx);
                       ^
  500.   
  501.       bn_correct_top(r);

crypto/bn/bn_mul.c:507:1: Parameter `ctx->stack.depth`
    505.   }
    506.   
    507. > int bn_mul_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
    508.   {
    509.       int ret = 0;

test/bntest.c:285:9: Call
283.           BN_set_negative(b, rand_neg());
284.           BN_RECP_CTX_set(recp, b, ctx);
285.           BN_div_recp(d, c, a, recp, ctx);
               ^
286.           BN_mul(e, d, b, ctx);
287.           BN_add(d, e, c);

crypto/bn/bn_recp.c:90:5: Call
  88.       BIGNUM *a, *b, *d, *r;
  89.   
  90.       BN_CTX_start(ctx);
            ^
  91.       d = (dv != NULL) ? dv : BN_CTX_get(ctx);
  92.       r = (rem != NULL) ? rem : BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:171:1: Parameter `*ctx->stack.indexes`
    169.   }
    170.   
    171. > void BN_CTX_start(BN_CTX *ctx)
    172.   {
    173.       CTXDBG("ENTER BN_CTX_start()", ctx);

crypto/bn/bn_recp.c:101:13: Call
  99.           BN_zero(d);
  100.           if (!BN_copy(r, m)) {
  101.               BN_CTX_end(ctx);
                     ^
  102.               return 0;
  103.           }

crypto/bn/bn_ctx.c:185:1: Parameter `*ctx->stack.indexes`
    183.   }
    184.   
    185. > void BN_CTX_end(BN_CTX *ctx)
    186.   {
    187.       CTXDBG("ENTER BN_CTX_end()", ctx);

crypto/bn/bn_ctx.c:191:27: Call
    189.           ctx->err_stack--;
    190.       else {
    191.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                     ^
    192.           /* Does this stack frame have anything to release? */
    193.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:266:1: <Offset trace>
264.   }
265.   
266. > static unsigned int BN_STACK_pop(BN_STACK *st)
267.   {
268.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:266:1: Parameter `st->depth`
      264.   }
      265.   
      266. > static unsigned int BN_STACK_pop(BN_STACK *st)
      267.   {
      268.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:266:1: <Length trace>
264.   }
265.   
266. > static unsigned int BN_STACK_pop(BN_STACK *st)
267.   {
268.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:266:1: Parameter `*st->indexes`
      264.   }
      265.   
      266. > static unsigned int BN_STACK_pop(BN_STACK *st)
      267.   {
      268.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:268:12: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `BN_div_recp` 
      266.   static unsigned int BN_STACK_pop(BN_STACK *st)
      267.   {
      268.       return st->indexes[--(st->depth)];
                        ^
      269.   }
      270.   
