crypto/srp/srp_vfy.c:564: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_mod_exp`.
Showing all 13 steps of the trace


crypto/srp/srp_vfy.c:558:9: Call
556.       }
557.   
558.       x = SRP_Calc_x(salttmp, user, pass);
               ^
559.   
560.       *verifier = BN_new();

crypto/srp/srp_lib.c:146:11: Call
  144.           goto err;
  145.   
  146.       res = BN_bin2bn(dig, sizeof(dig), NULL);
                   ^
  147.   
  148.    err:

crypto/bn/bn_lib.c:369:1: Parameter `*ret->d`
    367.   }
    368.   
    369. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
    370.   {
    371.       unsigned int i, m;

crypto/srp/srp_vfy.c:564:10: Call
562.           goto err;
563.   
564.       if (!BN_mod_exp(*verifier, g, x, N, bn_ctx)) {
                ^
565.           BN_clear_free(*verifier);
566.           goto err;

crypto/bn/bn_exp.c:89:1: Parameter `*r->d`
  87.   }
  88.   
  89. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
  90.                  BN_CTX *ctx)
  91.   {

crypto/bn/bn_exp.c:141:19: Call
  139.               && (BN_get_flags(m, BN_FLG_CONSTTIME) == 0)) {
  140.               BN_ULONG A = a->d[0];
  141.               ret = BN_mod_exp_mont_word(r, A, p, m, ctx, NULL);
                           ^
  142.           } else
  143.   # endif

crypto/bn/bn_exp.c:1101:1: Parameter `*rr->d`
    1099.   }
    1100.   
    1101. > int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
    1102.                            const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
    1103.   {

crypto/bn/bn_exp.c:1151:19: Call
    1149.               BN_zero(rr);
    1150.           } else {
    1151.               ret = BN_one(rr);
                              ^
    1152.           }
    1153.           return ret;

crypto/bn/bn_lib.c:357:1: <Length trace>
355.   }
356.   
357. > int BN_set_word(BIGNUM *a, BN_ULONG w)
358.   {
359.       bn_check_top(a);

crypto/bn/bn_lib.c:357:1: Parameter `*a->d`
      355.   }
      356.   
      357. > int BN_set_word(BIGNUM *a, BN_ULONG w)
      358.   {
      359.       bn_check_top(a);

crypto/bn/bn_lib.c:360:9: Call
      358.   {
      359.       bn_check_top(a);
      360.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                     ^
      361.           return 0;
      362.       a->neg = 0;

crypto/bn/bn_lcl.h:651:1: Parameter `*a->d`
        649.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
        650.   
        651. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
        652.   {
        653.       if (bits > (INT_MAX - BN_BITS2 + 1))

crypto/bn/bn_lib.c:363:5: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_mod_exp` 
      361.           return 0;
      362.       a->neg = 0;
      363.       a->d[0] = w;
                 ^
      364.       a->top = (w ? 1 : 0);
      365.       bn_check_top(a);
