crypto/bn/bn_mont.c:175: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_from_montgomery_word`.
Showing all 14 steps of the trace


crypto/bn/bn_mont.c:174:34: Call
172.   
173.       BN_CTX_start(ctx);
174.       if ((t = BN_CTX_get(ctx)) && BN_copy(t, a))
                                        ^
175.           retn = BN_from_montgomery_word(ret, t, mont);
176.       BN_CTX_end(ctx);

crypto/bn/bn_lib.c:312:1: Parameter `a->top`
  310.   }
  311.   
  312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  313.   {
  314.       bn_check_top(b);

crypto/bn/bn_mont.c:175:16: Call
173.       BN_CTX_start(ctx);
174.       if ((t = BN_CTX_get(ctx)) && BN_copy(t, a))
175.           retn = BN_from_montgomery_word(ret, t, mont);
                      ^
176.       BN_CTX_end(ctx);
177.   #else                           /* !MONT_WORD */

crypto/bn/bn_mont.c:75:1: Parameter `*r->d`
  73.   
  74.   #ifdef MONT_WORD
  75. > static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)
  76.   {
  77.       BIGNUM *n;

crypto/bn/bn_mont.c:89:9: Call
  87.   
  88.       max = (2 * nl);             /* carry is stored separately */
  89.       if (bn_wexpand(r, max) == NULL)
                ^
  90.           return 0;
  91.   

crypto/bn/bn_lib.c:940:1: Parameter `*a->d`
    938.   }
    939.   
    940. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
    941.   {
    942.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:942:37: Call
    940.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
    941.   {
    942.       return (words <= a->dmax) ? a : bn_expand2(a, words);
                                               ^
    943.   }
    944.   

crypto/bn/bn_lib.c:273:1: Parameter `*b->d`
      271.    */
      272.   
      273. > BIGNUM *bn_expand2(BIGNUM *b, int words)
      274.   {
      275.       bn_check_top(b);

crypto/bn/bn_lib.c:278:23: Call
      276.   
      277.       if (words > b->dmax) {
      278.           BN_ULONG *a = bn_expand_internal(b, words);
                                   ^
      279.           if (!a)
      280.               return NULL;

crypto/bn/bn_lib.c:235:1: <Offset trace>
233.   /* This is used by bn_expand2() */
234.   /* The caller MUST check that words > b->dmax before calling this */
235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
236.   {
237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:235:1: Parameter `b->top`
        233.   /* This is used by bn_expand2() */
        234.   /* The caller MUST check that words > b->dmax before calling this */
        235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
        236.   {
        237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:235:1: <Length trace>
233.   /* This is used by bn_expand2() */
234.   /* The caller MUST check that words > b->dmax before calling this */
235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
236.   {
237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:235:1: Parameter `*b->d`
        233.   /* This is used by bn_expand2() */
        234.   /* The caller MUST check that words > b->dmax before calling this */
        235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
        236.   {
        237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:260:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_from_montgomery_word` 
        258.       assert(b->top <= words);
        259.       if (b->top > 0)
        260.           memcpy(a, b->d, sizeof(*a) * b->top);
                       ^
        261.   
        262.       return a;
