test/bntest.c:2096: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_is_prime_fasttest_ex`.
Showing all 10 steps of the trace


test/bntest.c:2095:10: Call
2093.        * do_trial_division was set. */
2094.       if (r == NULL ||
2095.           !BN_set_word(r, 3) ||
                 ^
2096.           BN_is_prime_fasttest_ex(r, 3 /* nchecks */, ctx,
2097.                                   0 /* do_trial_division */, NULL) != 1 ||

crypto/bn/bn_lib.c:395:1: Parameter `*a->d`
  393.   }
  394.   
  395. > int BN_set_word(BIGNUM *a, BN_ULONG w)
  396.   {
  397.       bn_check_top(a);

crypto/bn/bn_lib.c:398:9: Call
  396.   {
  397.       bn_check_top(a);
  398.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                 ^
  399.           return (0);
  400.       a->neg = 0;

crypto/bn/bn_lcl.h:660:1: Parameter `*a->d`
    658.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
    659.   
    660. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
    661.   {
    662.       if (bits > (INT_MAX - BN_BITS2 + 1))

test/bntest.c:2096:9: Call
2094.       if (r == NULL ||
2095.           !BN_set_word(r, 3) ||
2096.           BN_is_prime_fasttest_ex(r, 3 /* nchecks */, ctx,
                ^
2097.                                   0 /* do_trial_division */, NULL) != 1 ||
2098.           BN_is_prime_fasttest_ex(r, 3 /* nchecks */, ctx,

crypto/bn/bn_prime.c:153:1: Parameter `*a->d`
  151.   }
  152.   
  153. > int BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed,
  154.                               int do_trial_division, BN_GENCB *cb)
  155.   {

crypto/bn/bn_prime.c:229:10: Call
  227.       if (mont == NULL)
  228.           goto err;
  229.       if (!BN_MONT_CTX_set(mont, A, ctx))
                  ^
  230.           goto err;
  231.   

crypto/bn/bn_mont.c:247:1: <Length trace>
245.   }
246.   
247. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
248.   {
249.       int ret = 0;

crypto/bn/bn_mont.c:247:1: Parameter `*mod->d`
    245.   }
    246.   
    247. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
    248.   {
    249.       int ret = 0;

crypto/bn/bn_mont.c:322:18: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_is_prime_fasttest_ex` 
    320.               goto err;           /* R */
    321.   
    322.           buf[0] = mod->d[0];     /* tmod = N mod word size */
                            ^
    323.           buf[1] = 0;
    324.           tmod.top = buf[0] != 0 ? 1 : 0;
