test/bntest.c:2142: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_is_prime_fasttest_ex`.
Showing all 12 steps of the trace


test/bntest.c:2141:17: Call
2139.        */
2140.       if (!TEST_ptr(r = BN_new())
2141.               || !TEST_true(BN_set_word(r, 3))
                        ^
2142.               || !TEST_int_eq(BN_is_prime_fasttest_ex(r, 3 /* nchecks */, ctx,
2143.                                   0 /* do_trial_division */, NULL), 1)

crypto/bn/bn_lib.c:360:1: Parameter `*a->d`
  358.   }
  359.   
  360. > int BN_set_word(BIGNUM *a, BN_ULONG w)
  361.   {
  362.       bn_check_top(a);

crypto/bn/bn_lib.c:363:9: Call
  361.   {
  362.       bn_check_top(a);
  363.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                 ^
  364.           return 0;
  365.       a->neg = 0;

crypto/bn/bn_lcl.h:651:1: Parameter `*a->d`
    649.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
    650.   
    651. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
    652.   {
    653.       if (bits > (INT_MAX - BN_BITS2 + 1))

test/bntest.c:2142:17: Call
2140.       if (!TEST_ptr(r = BN_new())
2141.               || !TEST_true(BN_set_word(r, 3))
2142.               || !TEST_int_eq(BN_is_prime_fasttest_ex(r, 3 /* nchecks */, ctx,
                        ^
2143.                                   0 /* do_trial_division */, NULL), 1)
2144.               || !TEST_int_eq(BN_is_prime_fasttest_ex(r, 3 /* nchecks */, ctx,

crypto/bn/bn_prime.c:151:1: Parameter `*a->d`
  149.   }
  150.   
  151. > int BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed,
  152.                               int do_trial_division, BN_GENCB *cb)
  153.   {

crypto/bn/bn_prime.c:195:10: Call
  193.   
  194.       /* compute A1 := a - 1 */
  195.       if (!BN_copy(A1, a))
                  ^
  196.           goto err;
  197.       if (!BN_sub_word(A1, 1))

crypto/bn/bn_lib.c:285:1: <Offset trace>
283.   }
284.   
285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
286.   {
287.       bn_check_top(b);

crypto/bn/bn_lib.c:285:1: Parameter `b->top`
    283.   }
    284.   
    285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    286.   {
    287.       bn_check_top(b);

crypto/bn/bn_lib.c:285:1: <Length trace>
283.   }
284.   
285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
286.   {
287.       bn_check_top(b);

crypto/bn/bn_lib.c:285:1: Parameter `*b->d`
    283.   }
    284.   
    285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    286.   {
    287.       bn_check_top(b);

crypto/bn/bn_lib.c:295:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_is_prime_fasttest_ex` 
    293.   
    294.       if (b->top > 0)
    295.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                   ^
    296.   
    297.       a->top = b->top;
