crypto/bn/bn_gcd.c:396: error: BUFFER_OVERRUN_L3
  Offset: [8, +oo] (⇐ [8, +oo] + [0, +oo]) Size: [0, 8388607] by call to `BN_mul`.
Showing all 18 steps of the trace


crypto/bn/bn_gcd.c:155:9: Call
153.   
154.       BN_CTX_start(ctx);
155.       A = BN_CTX_get(ctx);
               ^
156.       B = BN_CTX_get(ctx);
157.       X = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:229:5: Call
  227.       }
  228.       /* OK, make sure the returned bignum is "zero" */
  229.       BN_zero(ret);
             ^
  230.       ctx->used++;
  231.       CTXDBG_RET(ctx, ret);

crypto/bn/bn_lib.c:357:1: Parameter `*a->d`
    355.   }
    356.   
    357. > int BN_set_word(BIGNUM *a, BN_ULONG w)
    358.   {
    359.       bn_check_top(a);

crypto/bn/bn_lib.c:360:9: Call
    358.   {
    359.       bn_check_top(a);
    360.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                   ^
    361.           return 0;
    362.       a->neg = 0;

crypto/bn/bn_lcl.h:651:1: Parameter `*a->d`
      649.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
      650.   
      651. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
      652.   {
      653.       if (bits > (INT_MAX - BN_BITS2 + 1))

crypto/bn/bn_gcd.c:396:26: Call
394.                           goto err;
395.                   } else {
396.                       if (!BN_mul(tmp, D, X, ctx))
                                ^
397.                           goto err;
398.                   }

crypto/bn/bn_mul.c:497:1: Parameter `*b->d`
  495.   #endif                          /* BN_RECURSION */
  496.   
  497. > int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
  498.   {
  499.       int ret = 0;

crypto/bn/bn_mul.c:577:17: Call
  575.                   if (bn_wexpand(rr, k * 4) == NULL)
  576.                       goto err;
  577.                   bn_mul_part_recursive(rr->d, a->d, b->d,
                         ^
  578.                                         j, al - j, bl - j, t->d);
  579.               } else {            /* al <= j || bl <= j */

crypto/bn/bn_mul.c:322:1: Parameter `n`
    320.    */
    321.   /* tnX may not be negative but less than n */
    322. > void bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n,
    323.                              int tna, int tnb, BN_ULONG *t)
    324.   {

crypto/bn/bn_mul.c:336:10: Call
    334.       /* r=(a[0]-a[1])*(b[1]-b[0]) */
    335.       c1 = bn_cmp_part_words(a, &(a[n]), tna, n - tna);
    336.       c2 = bn_cmp_part_words(&(b[n]), b, tnb, tnb - n);
                    ^
    337.       neg = 0;
    338.       switch (c1 * 3 + c2) {

crypto/bn/bn_lib.c:697:1: Parameter `cl`
      695.    */
      696.   
      697. > int bn_cmp_part_words(const BN_ULONG *a, const BN_ULONG *b, int cl, int dl)
      698.   {
      699.       int n, i;

crypto/bn/bn_lib.c:714:12: Call
      712.           }
      713.       }
      714.       return bn_cmp_words(a, b, cl);
                        ^
      715.   }
      716.   

crypto/bn/bn_lib.c:670:1: <Offset trace>
668.   }
669.   
670. > int bn_cmp_words(const BN_ULONG *a, const BN_ULONG *b, int n)
671.   {
672.       int i;

crypto/bn/bn_lib.c:670:1: Parameter `n`
        668.   }
        669.   
        670. > int bn_cmp_words(const BN_ULONG *a, const BN_ULONG *b, int n)
        671.   {
        672.       int i;

crypto/bn/bn_lib.c:679:10: Assignment
        677.       if (aa != bb)
        678.           return ((aa > bb) ? 1 : -1);
        679.       for (i = n - 2; i >= 0; i--) {
                        ^
        680.           aa = a[i];
        681.           bb = b[i];

crypto/bn/bn_lib.c:670:1: <Length trace>
668.   }
669.   
670. > int bn_cmp_words(const BN_ULONG *a, const BN_ULONG *b, int n)
671.   {
672.       int i;

crypto/bn/bn_lib.c:670:1: Parameter `*a`
        668.   }
        669.   
        670. > int bn_cmp_words(const BN_ULONG *a, const BN_ULONG *b, int n)
        671.   {
        672.       int i;

crypto/bn/bn_lib.c:680:14: Array access: Offset: [8, +oo] (⇐ [8, +oo] + [0, +oo]) Size: [0, 8388607] by call to `BN_mul` 
        678.           return ((aa > bb) ? 1 : -1);
        679.       for (i = n - 2; i >= 0; i--) {
        680.           aa = a[i];
                            ^
        681.           bb = b[i];
        682.           if (aa != bb)
