crypto/dh/dh_rfc7919.c:69: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_rshift1`.
Showing all 11 steps of the trace


crypto/dh/dh_rfc7919.c:66:21: Call
64.           return NID_undef;
65.       if (dh->q != NULL) {
66.           BIGNUM *q = BN_dup(dh->p);
                          ^
67.   
68.           /* Check q = p * 2 + 1 we already know q is odd, so just shift right */

crypto/bn/bn_lib.c:272:10: Call
  270.       if (t == NULL)
  271.           return NULL;
  272.       if (!BN_copy(t, a)) {
                  ^
  273.           BN_free(t);
  274.           return NULL;

crypto/bn/bn_lib.c:280:1: Parameter `*a->d`
    278.   }
    279.   
    280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    281.   {
    282.       bn_check_top(b);

crypto/dh/dh_rfc7919.c:69:27: Call
67.   
68.           /* Check q = p * 2 + 1 we already know q is odd, so just shift right */
69.           if (q == NULL || !BN_rshift1(q, q) || !BN_cmp(dh->q, q))
                                ^
70.               nid = NID_undef;
71.           BN_free(q);

crypto/bn/bn_shift.c:46:1: Parameter `*r->d`
  44.   }
  45.   
  46. > int BN_rshift1(BIGNUM *r, const BIGNUM *a)
  47.   {
  48.       BN_ULONG *ap, *rp, t, c;

crypto/bn/bn_shift.c:55:9: Call
  53.   
  54.       if (BN_is_zero(a)) {
  55.           BN_zero(r);
                ^
  56.           return 1;
  57.       }

crypto/bn/bn_lib.c:358:1: <Length trace>
356.   }
357.   
358. > int BN_set_word(BIGNUM *a, BN_ULONG w)
359.   {
360.       bn_check_top(a);

crypto/bn/bn_lib.c:358:1: Parameter `*a->d`
    356.   }
    357.   
    358. > int BN_set_word(BIGNUM *a, BN_ULONG w)
    359.   {
    360.       bn_check_top(a);

crypto/bn/bn_lib.c:361:9: Call
    359.   {
    360.       bn_check_top(a);
    361.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                   ^
    362.           return 0;
    363.       a->neg = 0;

crypto/bn/bn_lcl.h:660:1: Parameter `*a->d`
      658.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
      659.   
      660. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
      661.   {
      662.       if (bits > (INT_MAX - BN_BITS2 + 1))

crypto/bn/bn_lib.c:364:5: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_rshift1` 
    362.           return 0;
    363.       a->neg = 0;
    364.       a->d[0] = w;
               ^
    365.       a->top = (w ? 1 : 0);
    366.       a->flags &= ~BN_FLG_FIXED_TOP;
