apps/prime.c:89: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `BN_generate_prime_ex`.
Showing all 17 steps of the trace


apps/prime.c:37:5: Assignment
35.   {
36.       BIGNUM *bn = NULL;
37.       int hex = 0, checks = 20, generate = 0, bits = 0, safe = 0, ret = 1;
          ^
38.       char *prog;
39.       OPTION_CHOICE o;

apps/prime.c:89:14: Call
87.               goto end;
88.           }
89.           if (!BN_generate_prime_ex(bn, bits, safe, NULL, NULL, NULL)) {
                   ^
90.               BIO_printf(bio_err, "Failed to generate prime.\n");
91.               goto end;

crypto/bn/bn_prime.c:52:1: Parameter `bits`
  50.   }
  51.   
  52. > int BN_generate_prime_ex(BIGNUM *ret, int bits, int safe,
  53.                            const BIGNUM *add, const BIGNUM *rem, BN_GENCB *cb)
  54.   {

crypto/bn/bn_prime.c:86:14: Call
  84.       /* make a random number and set the top and bottom bits */
  85.       if (add == NULL) {
  86.           if (!probable_prime(ret, bits, mods))
                     ^
  87.               goto err;
  88.       } else {

crypto/bn/bn_prime.c:274:1: Parameter `bits`
    272.   }
    273.   
    274. > static int probable_prime(BIGNUM *rnd, int bits, prime_t *mods)
    275.   {
    276.       int i;

crypto/bn/bn_prime.c:282:10: Call
    280.   
    281.    again:
    282.       if (!BN_priv_rand(rnd, bits, BN_RAND_TOP_TWO, BN_RAND_BOTTOM_ODD))
                    ^
    283.           return (0);
    284.       /* we now have a random number 'rnd' to test. */

crypto/bn/bn_rand.c:107:1: Parameter `bits`
      105.   }
      106.   
      107. > int BN_priv_rand(BIGNUM *rnd, int bits, int top, int bottom)
      108.   {
      109.       return bnrand(PRIVATE, rnd, bits, top, bottom);

crypto/bn/bn_rand.c:109:12: Call
      107.   int BN_priv_rand(BIGNUM *rnd, int bits, int top, int bottom)
      108.   {
      109.       return bnrand(PRIVATE, rnd, bits, top, bottom);
                        ^
      110.   }
      111.   

crypto/bn/bn_rand.c:57:14: <Offset trace>
55.           unsigned char c;
56.   
57.           for (i = 0; i < bytes; i++) {
                   ^
58.               if (RAND_bytes(&c, 1) <= 0)
59.                   goto err;

crypto/bn/bn_rand.c:57:14: Assignment
        55.           unsigned char c;
        56.   
        57.           for (i = 0; i < bytes; i++) {
                           ^
        58.               if (RAND_bytes(&c, 1) <= 0)
        59.                   goto err;

crypto/bn/bn_rand.c:21:1: <Length trace>
19.   } BNRAND_FLAG;
20.   
21. > static int bnrand(BNRAND_FLAG flag, BIGNUM *rnd, int bits, int top, int bottom)
22.   {
23.       unsigned char *buf = NULL;

crypto/bn/bn_rand.c:21:1: Parameter `bits`
        19.   } BNRAND_FLAG;
        20.   
        21. > static int bnrand(BNRAND_FLAG flag, BIGNUM *rnd, int bits, int top, int bottom)
        22.   {
        23.       unsigned char *buf = NULL;

crypto/bn/bn_rand.c:35:5: Assignment
        33.           goto toosmall;
        34.   
        35.       bytes = (bits + 7) / 8;
                  ^
        36.       bit = (bits - 1) % 8;
        37.       mask = 0xff << (bit + 1);

crypto/bn/bn_rand.c:39:11: Call
        37.       mask = 0xff << (bit + 1);
        38.   
        39.       buf = OPENSSL_malloc(bytes);
                        ^
        40.       if (buf == NULL) {
        41.           BNerr(BN_F_BNRAND, ERR_R_MALLOC_FAILURE);

crypto/mem.c:177:9: Assignment
          175.   
          176.       if (num == 0)
          177.           return NULL;
                         ^
          178.   
          179.       FAILTEST();

crypto/bn/bn_rand.c:39:5: Assignment
        37.       mask = 0xff << (bit + 1);
        38.   
        39.       buf = OPENSSL_malloc(bytes);
                  ^
        40.       if (buf == NULL) {
        41.           BNerr(BN_F_BNRAND, ERR_R_MALLOC_FAILURE);

crypto/bn/bn_rand.c:83:9: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `BN_generate_prime_ex` 
        81.       buf[0] &= ~mask;
        82.       if (bottom)                 /* set bottom bit if requested */
        83.           buf[bytes - 1] |= 1;
                      ^
        84.       if (!BN_bin2bn(buf, bytes, rnd))
        85.           goto err;
