crypto/srp/srp_vfy.c:699: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_mod_exp`.
Showing all 13 steps of the trace


crypto/srp/srp_vfy.c:693:9: Call
691.       }
692.   
693.       x = SRP_Calc_x(salttmp, user, pass);
               ^
694.   
695.       *verifier = BN_new();

crypto/srp/srp_lib.c:150:11: Call
  148.           goto err;
  149.   
  150.       res = BN_bin2bn(dig, sizeof(dig), NULL);
                   ^
  151.   
  152.    err:

crypto/bn/bn_lib.c:372:1: Parameter `*ret->d`
    370.   }
    371.   
    372. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
    373.   {
    374.       unsigned int i, m;

crypto/srp/srp_vfy.c:699:10: Call
697.           goto err;
698.   
699.       if (!BN_mod_exp(*verifier, g, x, N, bn_ctx)) {
                ^
700.           BN_clear_free(*verifier);
701.           goto err;

crypto/bn/bn_exp.c:89:1: Parameter `*r->d`
  87.   }
  88.   
  89. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
  90.                  BN_CTX *ctx)
  91.   {

crypto/bn/bn_exp.c:141:19: Call
  139.               && (BN_get_flags(m, BN_FLG_CONSTTIME) == 0)) {
  140.               BN_ULONG A = a->d[0];
  141.               ret = BN_mod_exp_mont_word(r, A, p, m, ctx, NULL);
                           ^
  142.           } else
  143.   # endif

crypto/bn/bn_exp.c:1101:1: Parameter `*rr->d`
    1099.   }
    1100.   
    1101. > int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
    1102.                            const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
    1103.   {

crypto/bn/bn_exp.c:1149:13: Call
    1147.           if (BN_abs_is_word(m, 1)) {
    1148.               ret = 1;
    1149.               BN_zero(rr);
                        ^
    1150.           } else {
    1151.               ret = BN_one(rr);

crypto/bn/bn_lib.c:360:1: <Length trace>
358.   }
359.   
360. > int BN_set_word(BIGNUM *a, BN_ULONG w)
361.   {
362.       bn_check_top(a);

crypto/bn/bn_lib.c:360:1: Parameter `*a->d`
      358.   }
      359.   
      360. > int BN_set_word(BIGNUM *a, BN_ULONG w)
      361.   {
      362.       bn_check_top(a);

crypto/bn/bn_lib.c:363:9: Call
      361.   {
      362.       bn_check_top(a);
      363.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                     ^
      364.           return 0;
      365.       a->neg = 0;

crypto/bn/bn_lcl.h:651:1: Parameter `*a->d`
        649.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
        650.   
        651. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
        652.   {
        653.       if (bits > (INT_MAX - BN_BITS2 + 1))

crypto/bn/bn_lib.c:366:5: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_mod_exp` 
      364.           return 0;
      365.       a->neg = 0;
      366.       a->d[0] = w;
                 ^
      367.       a->top = (w ? 1 : 0);
      368.       bn_check_top(a);
