crypto/bn/bn_prime.c:129: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `BN_rshift1`.
Showing all 11 steps of the trace


crypto/bn/bn_prime.c:105:9: Call
103.   		if (strong)
104.   			{
105.   			if (!probable_prime_dh_strong(rnd,bits,add,rem,ctx))
               ^
106.   				 goto err;
107.   			}

crypto/bn/bn_prime.c:334:1: Parameter `p->top`
  332.   	}
  333.   
  334. > static int probable_prime_dh_strong(BIGNUM *p, int bits, BIGNUM *padd,
  335.   	     BIGNUM *rem, BN_CTX *ctx)
  336.   	{

crypto/bn/bn_prime.c:129:8: Call
127.   		 * Since a prime is odd, We just
128.   		 * need to divide by 2 */
129.   		if (!BN_rshift1(&t,rnd)) goto err;
              ^
130.   
131.   		for (i=0; i<BN_prime_checks; i++)

crypto/bn/bn_shift.c:95:1: Parameter `*r->d`
  93.   	}
  94.   
  95. > int BN_rshift1(BIGNUM *r, BIGNUM *a)
  96.   	{
  97.   	BN_ULONG *ap,*rp,t,c;

crypto/bn/bn_prime.c:129:8: Call
127.   		 * Since a prime is odd, We just
128.   		 * need to divide by 2 */
129.   		if (!BN_rshift1(&t,rnd)) goto err;
              ^
130.   
131.   		for (i=0; i<BN_prime_checks; i++)

crypto/bn/bn_shift.c:95:1: Parameter `*r->d`
  93.   	}
  94.   
  95. > int BN_rshift1(BIGNUM *r, BIGNUM *a)
  96.   	{
  97.   	BN_ULONG *ap,*rp,t,c;

crypto/bn/bn_shift.c:107:7: Call
  105.   	if (a != r)
  106.   		{
  107.   		if (bn_wexpand(r,a->top) == NULL) return(0);
               ^
  108.   		r->top=a->top;
  109.   		r->neg=a->neg;

crypto/bn/bn_lib.c:344:1: <Length trace>
342.   	}
343.   
344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
345.   	{
346.   	BN_ULONG *A,*a;

crypto/bn/bn_lib.c:344:1: Parameter `*b->d`
    342.   	}
    343.   
    344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
    345.   	{
    346.   	BN_ULONG *A,*a;

crypto/bn/bn_lib.c:367:3: Assignment
    365.   			}
    366.   #if 1
    367.   		B=b->d;
             ^
    368.   		/* Check if the previous number needs to be copied */
    369.   		if (B != NULL)

crypto/bn/bn_lib.c:447:35: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `BN_rshift1` 
    445.   				 */
    446.   				BN_ULONG a0,a1,a2,a3;
    447.   				a0=B[0]; a1=B[1]; a2=B[2]; a3=B[3];
                                             ^
    448.   				A[0]=a0; A[1]=a1; A[2]=a2; A[3]=a3;
    449.   				}
