crypto/bn/bn_print.c:152: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [0, +oo].
Showing all 11 steps of the trace


crypto/bn/bn_print.c:120:9: <Length trace>
118.        *     <= BN_num_bits(a)/10 + BN_num_bits/1000 + 1 + 1
119.        */
120.       i = BN_num_bits(a) * 3;
               ^
121.       num = (i / 10 + i / 1000 + 1) + 1;
122.       bn_data = OPENSSL_malloc((num / BN_DEC_NUM + 1) * sizeof(BN_ULONG));

crypto/bn/bn_print.c:120:9: Call
118.        *     <= BN_num_bits(a)/10 + BN_num_bits/1000 + 1 + 1
119.        */
120.       i = BN_num_bits(a) * 3;
               ^
121.       num = (i / 10 + i / 1000 + 1) + 1;
122.       bn_data = OPENSSL_malloc((num / BN_DEC_NUM + 1) * sizeof(BN_ULONG));

crypto/bn/bn_lib.c:221:9: Assignment
  219.   
  220.       if (BN_is_zero(a))
  221.           return 0;
                 ^
  222.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));
  223.   }

crypto/bn/bn_print.c:120:5: Assignment
118.        *     <= BN_num_bits(a)/10 + BN_num_bits/1000 + 1 + 1
119.        */
120.       i = BN_num_bits(a) * 3;
           ^
121.       num = (i / 10 + i / 1000 + 1) + 1;
122.       bn_data = OPENSSL_malloc((num / BN_DEC_NUM + 1) * sizeof(BN_ULONG));

crypto/bn/bn_print.c:121:5: Assignment
119.        */
120.       i = BN_num_bits(a) * 3;
121.       num = (i / 10 + i / 1000 + 1) + 1;
           ^
122.       bn_data = OPENSSL_malloc((num / BN_DEC_NUM + 1) * sizeof(BN_ULONG));
123.       buf = OPENSSL_malloc(num + 3);

crypto/bn/bn_print.c:122:15: Call
120.       i = BN_num_bits(a) * 3;
121.       num = (i / 10 + i / 1000 + 1) + 1;
122.       bn_data = OPENSSL_malloc((num / BN_DEC_NUM + 1) * sizeof(BN_ULONG));
                     ^
123.       buf = OPENSSL_malloc(num + 3);
124.       if ((buf == NULL) || (bn_data == NULL)) {

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/bn/bn_print.c:122:5: Assignment
120.       i = BN_num_bits(a) * 3;
121.       num = (i / 10 + i / 1000 + 1) + 1;
122.       bn_data = OPENSSL_malloc((num / BN_DEC_NUM + 1) * sizeof(BN_ULONG));
           ^
123.       buf = OPENSSL_malloc(num + 3);
124.       if ((buf == NULL) || (bn_data == NULL)) {

crypto/bn/bn_print.c:133:5: Assignment
131.   #define BUF_REMAIN (num+3 - (size_t)(p - buf))
132.       p = buf;
133.       lp = bn_data;
           ^
134.       if (BN_is_zero(t)) {
135.           *(p++) = '0';

crypto/bn/bn_print.c:146:9: Assignment
144.               lp++;
145.           }
146.           lp--;
               ^
147.           /*
148.            * We now have a series of blocks, BN_DEC_NUM chars in length, where

crypto/bn/bn_print.c:152:50: Array access: Offset: [-1, +oo] Size: [0, +oo]
150.            * order.
151.            */
152.           BIO_snprintf(p, BUF_REMAIN, BN_DEC_FMT1, *lp);
                                                        ^
153.           while (*p)
154.               p++;
