test/bntest.c:1485: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_exp`.
Showing all 14 steps of the trace


test/bntest.c:1478:19: Call
1476.       BIGNUM *a = getBN(s, "A");
1477.       BIGNUM *e = getBN(s, "E");
1478.       BIGNUM *exp = getBN(s, "Exp");
                          ^
1479.       BIGNUM *ret = BN_new();
1480.       int st = 0;

test/bntest.c:115:9: Call
  113.       }
  114.   
  115.       if (parseBN(&ret, hex) != (int)strlen(hex)) {
                 ^
  116.           fprintf(stderr, "Could not decode '%s'.\n", hex);
  117.           return NULL;

test/bntest.c:95:12: Call
    93.   {
    94.       *out = NULL;
    95.       return BN_hex2bn(out, in);
                     ^
    96.   }
    97.   

crypto/bn/bn_print.c:126:1: Parameter `(*bn)->top`
      124.   }
      125.   
      126. > int BN_hex2bn(BIGNUM **bn, const char *a)
      127.   {
      128.       BIGNUM *ret = NULL;

test/bntest.c:1485:10: Call
1483.           goto err;
1484.   
1485.       if (!BN_exp(ret, a, e, ctx)
                 ^
1486.               || !equalBN("A ^ E", exp, ret))
1487.           goto err;

crypto/bn/bn_exp.c:41:1: Parameter `a->top`
  39.   
  40.   /* this one works - simple but works */
  41. > int BN_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
  42.   {
  43.       int i, bits, ret = 0;

crypto/bn/bn_exp.c:61:9: Call
  59.           goto err;
  60.   
  61.       if (BN_copy(v, a) == NULL)
                ^
  62.           goto err;
  63.       bits = BN_num_bits(p);

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
    321.   }
    322.   
    323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    324.   {
    325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
    321.   }
    322.   
    323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    324.   {
    325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
    327.       if (a == b)
    328.           return a;
    329.       if (bn_wexpand(a, b->top) == NULL)
                   ^
    330.           return NULL;
    331.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
      946.   }
      947.   
      948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
      949.   {
      950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_exp` 
    331.   
    332.       if (b->top > 0)
    333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                   ^
    334.   
    335.       a->top = b->top;
