crypto/rsa/rsa_pmeth.c:741: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `RSA_generate_multi_prime_key`.
Showing all 15 steps of the trace


crypto/rsa/rsa_pmeth.c:725:39: Call
723.       if (rctx->pub_exp == NULL) {
724.           rctx->pub_exp = BN_new();
725.           if (rctx->pub_exp == NULL || !BN_set_word(rctx->pub_exp, RSA_F4))
                                             ^
726.               return 0;
727.       }

crypto/bn/bn_lib.c:391:15: Assignment
  389.       a->neg = 0;
  390.       a->d[0] = w;
  391.       a->top = (w ? 1 : 0);
                       ^
  392.       bn_check_top(a);
  393.       return 1;

crypto/bn/bn_lib.c:391:5: Assignment
  389.       a->neg = 0;
  390.       a->d[0] = w;
  391.       a->top = (w ? 1 : 0);
             ^
  392.       bn_check_top(a);
  393.       return 1;

crypto/rsa/rsa_pmeth.c:741:11: Call
739.           pcb = NULL;
740.       }
741.       ret = RSA_generate_multi_prime_key(rsa, rctx->nbits, rctx->primes,
                 ^
742.                                          rctx->pub_exp, pcb);
743.       BN_GENCB_free(pcb);

crypto/rsa/rsa_gen.c:41:1: Parameter `e_value->top`
  39.   }
  40.   
  41. > int RSA_generate_multi_prime_key(RSA *rsa, int bits, int primes,
  42.                                    BIGNUM *e_value, BN_GENCB *cb)
  43.   {

crypto/rsa/rsa_gen.c:61:12: Call
  59.       }
  60.   
  61.       return rsa_builtin_keygen(rsa, bits, primes, e_value, cb);
                   ^
  62.   }
  63.   

crypto/rsa/rsa_gen.c:64:1: Parameter `e_value->top`
    62.   }
    63.   
    64. > static int rsa_builtin_keygen(RSA *rsa, int bits, int primes, BIGNUM *e_value,
    65.                                 BN_GENCB *cb)
    66.   {

crypto/rsa/rsa_gen.c:143:9: Call
    141.       }
    142.   
    143.       if (BN_copy(rsa->e, e_value) == NULL)
                   ^
    144.           goto err;
    145.   

crypto/bn/bn_lib.c:312:1: <Offset trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `b->top`
      310.   }
      311.   
      312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      313.   {
      314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: <Length trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `*a->d`
      310.   }
      311.   
      312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      313.   {
      314.       bn_check_top(b);

crypto/bn/bn_lib.c:318:9: Call
      316.       if (a == b)
      317.           return a;
      318.       if (bn_wexpand(a, b->top) == NULL)
                     ^
      319.           return NULL;
      320.   

crypto/bn/bn_lib.c:937:1: Parameter `*a->d`
        935.   }
        936.   
        937. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
        938.   {
        939.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:322:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `RSA_generate_multi_prime_key` 
      320.   
      321.       if (b->top > 0)
      322.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      323.   
      324.       a->top = b->top;
