test/bntest.c:2038: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_rshift1`.
Showing all 10 steps of the trace


test/bntest.c:2035:5: Call
2033.       c = BN_new();
2034.   
2035.       BN_bntest_rand(a, 200, 0, 0);
            ^
2036.       a->neg = rand_neg();
2037.       for (i = 0; i < num0; i++) {

crypto/bn/bn_rand.c:210:1: Parameter `*rnd->d`
  208.   }
  209.   
  210. > int BN_bntest_rand(BIGNUM *rnd, int bits, int top, int bottom)
  211.   {
  212.       return bnrand(2, rnd, bits, top, bottom);

crypto/bn/bn_rand.c:212:12: Call
  210.   int BN_bntest_rand(BIGNUM *rnd, int bits, int top, int bottom)
  211.   {
  212.       return bnrand(2, rnd, bits, top, bottom);
                    ^
  213.   }
  214.   

crypto/bn/bn_rand.c:119:1: Parameter `*rnd->d`
    117.   #include <openssl/sha.h>
    118.   
    119. > static int bnrand(int pseudorand, BIGNUM *rnd, int bits, int top, int bottom)
    120.   {
    121.       unsigned char *buf = NULL;

test/bntest.c:2038:9: Call
2036.       a->neg = rand_neg();
2037.       for (i = 0; i < num0; i++) {
2038.           BN_rshift1(b, a);
                ^
2039.           if (bp != NULL) {
2040.               if (!results) {

crypto/bn/bn_shift.c:95:1: Parameter `*r->d`
  93.   }
  94.   
  95. > int BN_rshift1(BIGNUM *r, const BIGNUM *a)
  96.   {
  97.       BN_ULONG *ap, *rp, t, c;

crypto/bn/bn_shift.c:104:9: Call
  102.   
  103.       if (BN_is_zero(a)) {
  104.           BN_zero(r);
                 ^
  105.           return (1);
  106.       }

crypto/bn/bn_lib.c:530:1: <Length trace>
528.   }
529.   
530. > int BN_set_word(BIGNUM *a, BN_ULONG w)
531.   {
532.       bn_check_top(a);

crypto/bn/bn_lib.c:530:1: Parameter `*a->d`
    528.   }
    529.   
    530. > int BN_set_word(BIGNUM *a, BN_ULONG w)
    531.   {
    532.       bn_check_top(a);

crypto/bn/bn_lib.c:536:5: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_rshift1` 
    534.           return (0);
    535.       a->neg = 0;
    536.       a->d[0] = w;
               ^
    537.       a->top = (w ? 1 : 0);
    538.       bn_check_top(a);
