crypto/dh/dh_key.c:155: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_is_one`.
Showing all 11 steps of the trace


crypto/dh/dh_key.c:114:1: Parameter `dh->priv_key->d`
112.   }
113.   
114. > static int generate_key(DH *dh)
115.   {
116.       int ok = 0;

crypto/dh/dh_key.c:152:22: Call
150.           if (dh->q) {
151.               do {
152.                   if (!BN_rand_range(priv_key, dh->q))
                            ^
153.                       goto err;
154.               }

crypto/bn/bn_rand.c:281:1: Parameter `*r->d`
  279.   }
  280.   
  281. > int BN_rand_range(BIGNUM *r, const BIGNUM *range)
  282.   {
  283.       return bn_rand_range(0, r, range);

crypto/bn/bn_rand.c:283:12: Call
  281.   int BN_rand_range(BIGNUM *r, const BIGNUM *range)
  282.   {
  283.       return bn_rand_range(0, r, range);
                    ^
  284.   }
  285.   

crypto/bn/bn_rand.c:216:1: Parameter `*r->d`
    214.   
    215.   /* random number r:  0 <= r < range */
    216. > static int bn_rand_range(int pseudo, BIGNUM *r, const BIGNUM *range)
    217.   {
    218.       int (*bn_rand) (BIGNUM *, int, int, int) =

crypto/dh/dh_key.c:155:44: Call
153.                       goto err;
154.               }
155.               while (BN_is_zero(priv_key) || BN_is_one(priv_key));
                                                  ^
156.           } else {
157.               /* secret exponent length */

crypto/bn/bn_lib.c:904:1: Parameter `*a->d`
  902.   }
  903.   
  904. > int BN_is_one(const BIGNUM *a)
  905.   {
  906.       return BN_abs_is_word(a, 1) && !a->neg;

crypto/bn/bn_lib.c:906:12: Call
  904.   int BN_is_one(const BIGNUM *a)
  905.   {
  906.       return BN_abs_is_word(a, 1) && !a->neg;
                    ^
  907.   }
  908.   

crypto/bn/bn_lib.c:894:1: <Length trace>
892.   }
893.   
894. > int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
895.   {
896.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));

crypto/bn/bn_lib.c:894:1: Parameter `*a->d`
    892.   }
    893.   
    894. > int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
    895.   {
    896.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));

crypto/bn/bn_lib.c:896:31: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_is_one` 
    894.   int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
    895.   {
    896.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));
                                         ^
    897.   }
    898.   
