crypto/bn/bn_word.c:153: error: BUFFER_OVERRUN_S2
  Offset: [max(0, `a->top`), `a->top`] Size: [0, 8388607].
Showing all 7 steps of the trace


crypto/bn/bn_word.c:145:10: <Offset trace>
143.           return (i);
144.       }
145.       for (i = 0; w != 0 && i < a->top; i++) {
                ^
146.           a->d[i] = l = (a->d[i] + w) & BN_MASK2;
147.           w = (w > l) ? 1 : 0;

crypto/bn/bn_word.c:145:10: Assignment
143.           return (i);
144.       }
145.       for (i = 0; w != 0 && i < a->top; i++) {
                ^
146.           a->d[i] = l = (a->d[i] + w) & BN_MASK2;
147.           w = (w > l) ? 1 : 0;

crypto/bn/bn_word.c:123:1: <Length trace>
121.   }
122.   
123. > int BN_add_word(BIGNUM *a, BN_ULONG w)
124.   {
125.       BN_ULONG l;

crypto/bn/bn_word.c:123:1: Parameter `*a->d`
121.   }
122.   
123. > int BN_add_word(BIGNUM *a, BN_ULONG w)
124.   {
125.       BN_ULONG l;

crypto/bn/bn_word.c:150:13: Call
148.       }
149.       if (w && i == a->top) {
150.           if (bn_wexpand(a, a->top + 1) == NULL)
                   ^
151.               return 0;
152.           a->top++;

crypto/bn/bn_lib.c:995:1: Parameter `*a->d`
  993.   }
  994.   
  995. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
  996.   {
  997.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_word.c:153:9: Array access: Offset: [max(0, a->top), a->top] Size: [0, 8388607]
151.               return 0;
152.           a->top++;
153.           a->d[i] = w;
               ^
154.       }
155.       bn_check_top(a);
