crypto/bn/bn_gf2m.c:936: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, 8388607] by call to `BN_GF2m_mod_mul_arr`.
Showing all 8 steps of the trace


crypto/bn/bn_gf2m.c:933:14: Call
931.       n = BN_num_bits(b) - 1;
932.       for (i = n - 1; i >= 0; i--) {
933.           if (!BN_GF2m_mod_sqr_arr(u, u, p, ctx))
                    ^
934.               goto err;
935.           if (BN_is_bit_set(b, i)) {

crypto/bn/bn_gf2m.c:497:1: Parameter `r->top`
  495.   
  496.   /* Square a, reduce the result mod p, and store it in a.  r could be a. */
  497. > int BN_GF2m_mod_sqr_arr(BIGNUM *r, const BIGNUM *a, const int p[],
  498.                           BN_CTX *ctx)
  499.   {

crypto/bn/bn_gf2m.c:936:18: Call
934.               goto err;
935.           if (BN_is_bit_set(b, i)) {
936.               if (!BN_GF2m_mod_mul_arr(u, u, a, p, ctx))
                        ^
937.                   goto err;
938.           }

crypto/bn/bn_gf2m.c:418:1: <Offset trace>
416.    * the result in r.  r could be a or b; a could be b.
417.    */
418. > int BN_GF2m_mod_mul_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
419.                           const int p[], BN_CTX *ctx)
420.   {

crypto/bn/bn_gf2m.c:418:1: Parameter `a->top`
  416.    * the result in r.  r could be a or b; a could be b.
  417.    */
  418. > int BN_GF2m_mod_mul_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
  419.                           const int p[], BN_CTX *ctx)
  420.   {

crypto/bn/bn_gf2m.c:418:1: <Length trace>
416.    * the result in r.  r could be a or b; a could be b.
417.    */
418. > int BN_GF2m_mod_mul_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
419.                           const int p[], BN_CTX *ctx)
420.   {

crypto/bn/bn_gf2m.c:418:1: Parameter `*a->d`
  416.    * the result in r.  r could be a or b; a could be b.
  417.    */
  418. > int BN_GF2m_mod_mul_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
  419.                           const int p[], BN_CTX *ctx)
  420.   {

crypto/bn/bn_gf2m.c:449:44: Array access: Offset: [1, +oo] Size: [0, 8388607] by call to `BN_GF2m_mod_mul_arr` 
  447.           for (i = 0; i < a->top; i += 2) {
  448.               x0 = a->d[i];
  449.               x1 = ((i + 1) == a->top) ? 0 : a->d[i + 1];
                                                    ^
  450.               bn_GF2m_mul_2x2(zz, x1, x0, y1, y0);
  451.               for (k = 0; k < 4; k++)
