crypto/rand/rand_lib.c:165: error: BUFFER_OVERRUN_L3
  Offset added: [0, 15] Size: [0, +oo] by call to `RAND_DRBG_generate`.
Showing all 11 steps of the trace


crypto/rand/rand_lib.c:152:31: Call
150.   
151.       if (drbg->parent) {
152.           size_t bytes_needed = RAND_POOL_bytes_needed(pool, 8);
                                     ^
153.           unsigned char *buffer = RAND_POOL_add_begin(pool, bytes_needed);
154.   

crypto/rand/rand_lib.c:440:9: Assignment
  438.       if (entropy_per_byte < 1 || entropy_per_byte > 8) {
  439.           RANDerr(RAND_F_RAND_POOL_BYTES_NEEDED, RAND_R_ARGUMENT_OUT_OF_RANGE);
  440.           return 0;
                 ^
  441.       }
  442.   

crypto/rand/rand_lib.c:152:9: Assignment
150.   
151.       if (drbg->parent) {
152.           size_t bytes_needed = RAND_POOL_bytes_needed(pool, 8);
               ^
153.           unsigned char *buffer = RAND_POOL_add_begin(pool, bytes_needed);
154.   

crypto/rand/rand_lib.c:165:17: Call
163.               if (drbg->parent->lock)
164.                   CRYPTO_THREAD_write_lock(drbg->parent->lock);
165.               if (RAND_DRBG_generate(drbg->parent,
                       ^
166.                                      buffer, bytes_needed,
167.                                      0,

crypto/rand/drbg_lib.c:363:1: Parameter `outlen`
  361.    *
  362.    */
  363. > int RAND_DRBG_generate(RAND_DRBG *drbg, unsigned char *out, size_t outlen,
  364.                          int prediction_resistance,
  365.                          const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_lib.c:409:10: Call
  407.       }
  408.   
  409.       if (!ctr_generate(drbg, out, outlen, adin, adinlen)) {
                  ^
  410.           drbg->state = DRBG_ERROR;
  411.           RANDerr(RAND_F_RAND_DRBG_GENERATE, RAND_R_GENERATE_ERROR);

crypto/rand/drbg_rand.c:266:1: <Offset trace>
264.   }
265.   
266. > int ctr_generate(RAND_DRBG *drbg,
267.                    unsigned char *out, size_t outlen,
268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: Parameter `outlen`
    264.   }
    265.   
    266. > int ctr_generate(RAND_DRBG *drbg,
    267.                    unsigned char *out, size_t outlen,
    268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: <Length trace>
264.   }
265.   
266. > int ctr_generate(RAND_DRBG *drbg,
267.                    unsigned char *out, size_t outlen,
268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:266:1: Parameter `drbg->ctr.K[*]`
    264.   }
    265.   
    266. > int ctr_generate(RAND_DRBG *drbg,
    267.                    unsigned char *out, size_t outlen,
    268.                    const unsigned char *adin, size_t adinlen)

crypto/rand/drbg_rand.c:288:13: Array access: Offset added: [0, 15] Size: [0, +oo] by call to `RAND_DRBG_generate` 
    286.               /* Use K as temp space as it will be updated */
    287.               AES_encrypt(ctr->V, ctr->K, &ctr->ks);
    288.               memcpy(out, ctr->K, outlen);
                       ^
    289.               break;
    290.           }
