crypto/bn/bn_mont.c:254: error: BUFFER_OVERRUN_S2
  Offset: [-4+max(4, `mont->N.top`), `mont->N.top` - 1] Size: [0, 8388607].
Showing all 8 steps of the trace


crypto/bn/bn_mont.c:237:14: <Offset trace>
235.               (BN_ULONG *)(((PTR_SIZE_INT) rp & ~m) | ((PTR_SIZE_INT) ap & m));
236.   
237.           for (i = 0, nl -= 4; i < nl; i += 4) {
                    ^
238.               BN_ULONG t1, t2, t3, t4;
239.   

crypto/bn/bn_mont.c:237:14: Assignment
235.               (BN_ULONG *)(((PTR_SIZE_INT) rp & ~m) | ((PTR_SIZE_INT) ap & m));
236.   
237.           for (i = 0, nl -= 4; i < nl; i += 4) {
                    ^
238.               BN_ULONG t1, t2, t3, t4;
239.   

crypto/bn/bn_mont.c:177:1: <Length trace>
175.   
176.   #ifdef MONT_WORD
177. > static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)
178.   {
179.       BIGNUM *n;

crypto/bn/bn_mont.c:177:1: Parameter `*ret->d`
175.   
176.   #ifdef MONT_WORD
177. > static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)
178.   {
179.       BIGNUM *n;

crypto/bn/bn_mont.c:214:9: Call
212.       }
213.   
214.       if (bn_wexpand(ret, nl) == NULL)
               ^
215.           return (0);
216.       ret->top = nl;

crypto/bn/bn_lib.c:995:1: Parameter `*a->d`
  993.   }
  994.   
  995. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
  996.   {
  997.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_mont.c:219:5: Assignment
217.       ret->neg = r->neg;
218.   
219.       rp = ret->d;
           ^
220.       ap = &(r->d[nl]);
221.   

crypto/bn/bn_mont.c:254:13: Array access: Offset: [-4+max(4, mont->N.top), mont->N.top - 1] Size: [0, 8388607]
252.           }
253.           for (nl += 4; i < nl; i++)
254.               rp[i] = nrp[i], ap[i] = 0;
                   ^
255.       }
256.   # else
