crypto/bn/bn_gf2m.c:1104: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, 8388607] by call to `BN_GF2m_mod_mul_arr`.
Showing all 8 steps of the trace


crypto/bn/bn_gf2m.c:1097:18: Call
1095.                   goto err;
1096.               BN_zero(z);
1097.               if (!BN_copy(w, rho))
                         ^
1098.                   goto err;
1099.               for (j = 1; j <= p[0] - 1; j++) {

crypto/bn/bn_lib.c:323:1: Parameter `a->top`
  321.   }
  322.   
  323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  324.   {
  325.       bn_check_top(b);

crypto/bn/bn_gf2m.c:1104:22: Call
1102.                   if (!BN_GF2m_mod_sqr_arr(w2, w, p, ctx))
1103.                       goto err;
1104.                   if (!BN_GF2m_mod_mul_arr(tmp, w2, a, p, ctx))
                             ^
1105.                       goto err;
1106.                   if (!BN_GF2m_add(z, z, tmp))

crypto/bn/bn_gf2m.c:418:1: <Offset trace>
416.    * the result in r.  r could be a or b; a could be b.
417.    */
418. > int BN_GF2m_mod_mul_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
419.                           const int p[], BN_CTX *ctx)
420.   {

crypto/bn/bn_gf2m.c:418:1: Parameter `b->top`
  416.    * the result in r.  r could be a or b; a could be b.
  417.    */
  418. > int BN_GF2m_mod_mul_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
  419.                           const int p[], BN_CTX *ctx)
  420.   {

crypto/bn/bn_gf2m.c:418:1: <Length trace>
416.    * the result in r.  r could be a or b; a could be b.
417.    */
418. > int BN_GF2m_mod_mul_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
419.                           const int p[], BN_CTX *ctx)
420.   {

crypto/bn/bn_gf2m.c:418:1: Parameter `*b->d`
  416.    * the result in r.  r could be a or b; a could be b.
  417.    */
  418. > int BN_GF2m_mod_mul_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
  419.                           const int p[], BN_CTX *ctx)
  420.   {

crypto/bn/bn_gf2m.c:446:40: Array access: Offset: [1, +oo] Size: [0, 8388607] by call to `BN_GF2m_mod_mul_arr` 
  444.       for (j = 0; j < b->top; j += 2) {
  445.           y0 = b->d[j];
  446.           y1 = ((j + 1) == b->top) ? 0 : b->d[j + 1];
                                                ^
  447.           for (i = 0; i < a->top; i += 2) {
  448.               x0 = a->d[i];
