crypto/rsa/rsa_lib.c:273: error: BUFFER_OVERRUN_L3
  Offset: 19 Size: [1, +oo].
Showing all 11 steps of the trace


crypto/rsa/rsa_lib.c:262:9: <Offset trace>
260.       t[4] = &r->dmq1;
261.       t[5] = &r->iqmp;
262.       k = bn_sizeof_BIGNUM() * 6;
               ^
263.       off = k / sizeof(BN_ULONG) + 1;
264.       j = 1;

crypto/rsa/rsa_lib.c:262:9: Call
260.       t[4] = &r->dmq1;
261.       t[5] = &r->iqmp;
262.       k = bn_sizeof_BIGNUM() * 6;
               ^
263.       off = k / sizeof(BN_ULONG) + 1;
264.       j = 1;

crypto/bn/bn_intern.c:248:5: Assignment
  246.   size_t bn_sizeof_BIGNUM(void)
  247.   {
  248.       return sizeof(BIGNUM);
             ^
  249.   }
  250.   

crypto/rsa/rsa_lib.c:262:5: Assignment
260.       t[4] = &r->dmq1;
261.       t[5] = &r->iqmp;
262.       k = bn_sizeof_BIGNUM() * 6;
           ^
263.       off = k / sizeof(BN_ULONG) + 1;
264.       j = 1;

crypto/rsa/rsa_lib.c:263:5: Assignment
261.       t[5] = &r->iqmp;
262.       k = bn_sizeof_BIGNUM() * 6;
263.       off = k / sizeof(BN_ULONG) + 1;
           ^
264.       j = 1;
265.       for (i = 0; i < 6; i++)

crypto/rsa/rsa_lib.c:264:5: <Length trace>
262.       k = bn_sizeof_BIGNUM() * 6;
263.       off = k / sizeof(BN_ULONG) + 1;
264.       j = 1;
           ^
265.       for (i = 0; i < 6; i++)
266.           j += bn_get_top(*t[i]);

crypto/rsa/rsa_lib.c:264:5: Assignment
262.       k = bn_sizeof_BIGNUM() * 6;
263.       off = k / sizeof(BN_ULONG) + 1;
264.       j = 1;
           ^
265.       for (i = 0; i < 6; i++)
266.           j += bn_get_top(*t[i]);

crypto/rsa/rsa_lib.c:267:14: Call
265.       for (i = 0; i < 6; i++)
266.           j += bn_get_top(*t[i]);
267.       if ((p = OPENSSL_malloc((off + j) * sizeof(*p))) == NULL) {
                    ^
268.           RSAerr(RSA_F_RSA_MEMORY_LOCK, ERR_R_MALLOC_FAILURE);
269.           return (0);

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/rsa/rsa_lib.c:267:10: Assignment
265.       for (i = 0; i < 6; i++)
266.           j += bn_get_top(*t[i]);
267.       if ((p = OPENSSL_malloc((off + j) * sizeof(*p))) == NULL) {
                ^
268.           RSAerr(RSA_F_RSA_MEMORY_LOCK, ERR_R_MALLOC_FAILURE);
269.           return (0);

crypto/rsa/rsa_lib.c:273:5: Array access: Offset: 19 Size: [1, +oo]
271.       memset(p, 0, sizeof(*p) * (off + j));
272.       bn = (BIGNUM *)p;
273.       ul = (BN_ULONG *)&(p[off]);
           ^
274.       for (i = 0; i < 6; i++) {
275.           b = *(t[i]);
