apps/x509.c:933: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_add_word`.
Showing all 15 steps of the trace


apps/x509.c:929:14: Call
927.       }
928.   
929.       serial = load_serial(serialfile, create, NULL);
                    ^
930.       if (serial == NULL)
931.           goto end;

apps/apps.c:1380:29: Call
  1378.           ERR_clear_error();
  1379.           ret = BN_new();
  1380.           if (ret == NULL || !rand_serial(ret, ai))
                                      ^
  1381.               BIO_printf(bio_err, "Out of memory\n");
  1382.       } else {

apps/apps.c:1499:1: Parameter `b->d`
    1497.   }
    1498.   
    1499. > int rand_serial(BIGNUM *b, ASN1_INTEGER *ai)
    1500.   {
    1501.       BIGNUM *btmp;

apps/x509.c:933:10: Call
931.           goto end;
932.   
933.       if (!BN_add_word(serial, 1)) {
                ^
934.           BIO_printf(bio_err, "add_word failure\n");
935.           goto end;

crypto/bn/bn_word.c:98:1: Parameter `*a->d`
  96.   }
  97.   
  98. > int BN_add_word(BIGNUM *a, BN_ULONG w)
  99.   {
  100.       BN_ULONG l;

crypto/bn/bn_word.c:125:13: Call
  123.       }
  124.       if (w && i == a->top) {
  125.           if (bn_wexpand(a, a->top + 1) == NULL)
                     ^
  126.               return 0;
  127.           a->top++;

crypto/bn/bn_lib.c:940:1: Parameter `*a->d`
    938.   }
    939.   
    940. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
    941.   {
    942.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:942:37: Call
    940.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
    941.   {
    942.       return (words <= a->dmax) ? a : bn_expand2(a, words);
                                               ^
    943.   }
    944.   

crypto/bn/bn_lib.c:273:1: Parameter `*b->d`
      271.    */
      272.   
      273. > BIGNUM *bn_expand2(BIGNUM *b, int words)
      274.   {
      275.       bn_check_top(b);

crypto/bn/bn_lib.c:278:23: Call
      276.   
      277.       if (words > b->dmax) {
      278.           BN_ULONG *a = bn_expand_internal(b, words);
                                   ^
      279.           if (!a)
      280.               return NULL;

crypto/bn/bn_lib.c:235:1: <Offset trace>
233.   /* This is used by bn_expand2() */
234.   /* The caller MUST check that words > b->dmax before calling this */
235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
236.   {
237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:235:1: Parameter `b->top`
        233.   /* This is used by bn_expand2() */
        234.   /* The caller MUST check that words > b->dmax before calling this */
        235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
        236.   {
        237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:235:1: <Length trace>
233.   /* This is used by bn_expand2() */
234.   /* The caller MUST check that words > b->dmax before calling this */
235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
236.   {
237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:235:1: Parameter `*b->d`
        233.   /* This is used by bn_expand2() */
        234.   /* The caller MUST check that words > b->dmax before calling this */
        235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
        236.   {
        237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:260:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_add_word` 
        258.       assert(b->top <= words);
        259.       if (b->top > 0)
        260.           memcpy(a, b->d, sizeof(*a) * b->top);
                       ^
        261.   
        262.       return a;
