test/bntest.c:417: error: BUFFER_OVERRUN_L3
  Offset: [54, +oo] (⇐ [0, +oo] + [54, 64]) Size: [1, +oo] by call to `parse_bigBN`.
Showing all 10 steps of the trace


test/bntest.c:386:37: Array declaration
384.       /* Regression test for carry bug in bn_sqrx8x_internal */
385.       {
386.           static const char *ahex[] = {
                                           ^
387.                         "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",
388.               "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF",

test/bntest.c:417:9: Call
415.           };
416.   
417.           parse_bigBN(&a, ahex);
               ^
418.           parse_bigBN(&n, nhex);
419.       }

test/bntest.c:85:1: Parameter `(*bn_strings)->strlen`
  83.    * Parse BIGNUM from sparse hex-strings, return |BN_hex2bn| result.
  84.    */
  85. > static int parse_bigBN(BIGNUM **out, const char *bn_strings[])
  86.   {
  87.       char *bigstring = glue_strings(bn_strings, NULL);

test/bntest.c:87:23: Call
  85.   static int parse_bigBN(BIGNUM **out, const char *bn_strings[])
  86.   {
  87.       char *bigstring = glue_strings(bn_strings, NULL);
                              ^
  88.       int ret = BN_hex2bn(out, bigstring);
  89.   

test/testutil/driver.c:279:1: <Offset trace>
277.    * Optionally return the whole length of this string in |out_len|
278.    */
279. > char *glue_strings(const char *list[], size_t *out_len)
280.   {
281.       size_t len = 0;

test/testutil/driver.c:279:1: Parameter `(*list)->strlen`
    277.    * Optionally return the whole length of this string in |out_len|
    278.    */
    279. > char *glue_strings(const char *list[], size_t *out_len)
    280.   {
    281.       size_t len = 0;

test/testutil/driver.c:279:1: <Length trace>
277.    * Optionally return the whole length of this string in |out_len|
278.    */
279. > char *glue_strings(const char *list[], size_t *out_len)
280.   {
281.       size_t len = 0;

test/testutil/driver.c:279:1: Parameter `(*list)->strlen`
    277.    * Optionally return the whole length of this string in |out_len|
    278.    */
    279. > char *glue_strings(const char *list[], size_t *out_len)
    280.   {
    281.       size_t len = 0;

test/testutil/driver.c:295:9: Assignment
    293.   
    294.       for (i = 0; list[i] != NULL; i++)
    295.           p += strlen(strcpy(p, list[i]));
                   ^
    296.   
    297.       return ret;

test/testutil/driver.c:295:21: Array access: Offset: [54, +oo] (⇐ [0, +oo] + [54, 64]) Size: [1, +oo] by call to `parse_bigBN` 
    293.   
    294.       for (i = 0; list[i] != NULL; i++)
    295.           p += strlen(strcpy(p, list[i]));
                               ^
    296.   
    297.       return ret;
