crypto/bn/bn_sqr.c:93: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_copy`.
Showing all 11 steps of the trace


crypto/bn/bn_sqr.c:17:1: Parameter `r->top`
15.    * I've just gone over this and it is now %20 faster on x86 - eay - 27 Jun 96
16.    */
17. > int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
18.   {
19.       int max, al;

crypto/bn/bn_sqr.c:39:9: Call
37.   
38.       max = 2 * al;               /* Non-zero (from above) */
39.       if (bn_wexpand(rr, max) == NULL)
              ^
40.           goto err;
41.   

crypto/bn/bn_lib.c:951:1: Parameter `a->top`
  949.   }
  950.   
  951. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
  952.   {
  953.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_sqr.c:93:20: Call
91.       else
92.           rr->top = max;
93.       if (r != rr && BN_copy(r, rr) == NULL)
                         ^
94.           goto err;
95.   

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
  321.   }
  322.   
  323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  324.   {
  325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
  321.   }
  322.   
  323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  324.   {
  325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
  327.       if (a == b)
  328.           return a;
  329.       if (bn_wexpand(a, b->top) == NULL)
                 ^
  330.           return NULL;
  331.   

crypto/bn/bn_lib.c:951:1: Parameter `*a->d`
    949.   }
    950.   
    951. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
    952.   {
    953.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_copy` 
  331.   
  332.       if (b->top > 0)
  333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                 ^
  334.   
  335.       if (BN_get_flags(b, BN_FLG_CONSTTIME) != 0)
