crypto/bn/bn_lib.c:356: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607].
Showing all 6 steps of the trace


crypto/bn/bn_lib.c:300:1: <Length trace>
298.   /* This is used by bn_expand2() */
299.   /* The caller MUST check that words > b->dmax before calling this */
300. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
301.   {
302.       BN_ULONG *A, *a = NULL;

crypto/bn/bn_lib.c:300:1: Parameter `words`
298.   /* This is used by bn_expand2() */
299.   /* The caller MUST check that words > b->dmax before calling this */
300. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
301.   {
302.       BN_ULONG *A, *a = NULL;

crypto/bn/bn_lib.c:319:17: Call
317.           a = A = OPENSSL_secure_malloc(words * sizeof(*a));
318.       else
319.           a = A = OPENSSL_malloc(words * sizeof(*a));
                       ^
320.       if (A == NULL) {
321.           BNerr(BN_F_BN_EXPAND_INTERNAL, ERR_R_MALLOC_FAILURE);

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/bn/bn_lib.c:319:13: Assignment
317.           a = A = OPENSSL_secure_malloc(words * sizeof(*a));
318.       else
319.           a = A = OPENSSL_malloc(words * sizeof(*a));
                   ^
320.       if (A == NULL) {
321.           BNerr(BN_F_BN_EXPAND_INTERNAL, ERR_R_MALLOC_FAILURE);

crypto/bn/bn_lib.c:356:13: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607]
354.               A[1] = a1;
355.               A[2] = a2;
356.               A[3] = a3;
                   ^
357.           }
358.           /*
