crypto/bn/bn_blind.c:109: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_BLINDING_create_param`.
Showing all 12 steps of the trace


crypto/bn/bn_blind.c:109:14: Call
107.           !(b->flags & BN_BLINDING_NO_RECREATE)) {
108.           /* re-create blinding parameters */
109.           if (!BN_BLINDING_create_param(b, NULL, NULL, ctx, NULL, NULL))
                    ^
110.               goto err;
111.       } else if (!(b->flags & BN_BLINDING_NO_UPDATE)) {

crypto/bn/bn_blind.c:214:1: Parameter `e->top`
  212.   }
  213.   
  214. > BN_BLINDING *BN_BLINDING_create_param(BN_BLINDING *b,
  215.                                         const BIGNUM *e, BIGNUM *m, BN_CTX *ctx,
  216.                                         int (*bn_mod_exp) (BIGNUM *r,

crypto/bn/bn_blind.c:242:18: Call
  240.       if (e != NULL) {
  241.           BN_free(ret->e);
  242.           ret->e = BN_dup(e);
                          ^
  243.       }
  244.       if (ret->e == NULL)

crypto/bn/bn_lib.c:304:1: Parameter `a->top`
    302.   }
    303.   
    304. > BIGNUM *BN_dup(const BIGNUM *a)
    305.   {
    306.       BIGNUM *t;

crypto/bn/bn_lib.c:315:10: Call
    313.       if (t == NULL)
    314.           return NULL;
    315.       if (!BN_copy(t, a)) {
                    ^
    316.           BN_free(t);
    317.           return NULL;

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
      321.   }
      322.   
      323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      324.   {
      325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
      321.   }
      322.   
      323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      324.   {
      325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
      327.       if (a == b)
      328.           return a;
      329.       if (bn_wexpand(a, b->top) == NULL)
                     ^
      330.           return NULL;
      331.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
        946.   }
        947.   
        948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
        949.   {
        950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_BLINDING_create_param` 
      331.   
      332.       if (b->top > 0)
      333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      334.   
      335.       a->top = b->top;
