crypto/dsa/dsa_ossl.c:180: error: INTEGER_OVERFLOW_L2
  ([0, `dsa->q->top`] - 1):unsigned64 by call to `BN_num_bits`.
Showing all 7 steps of the trace


crypto/dsa/dsa_ossl.c:131:1: Parameter `dsa->q->top`
129.   }
130.   
131. > static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
132.   	{
133.   	BIGNUM *kinv=NULL,*r=NULL,*s=NULL;

crypto/dsa/dsa_ossl.c:176:13: Call
174.   
175.   	
176.   	if (dlen > BN_num_bytes(dsa->q))
                   ^
177.   		/* if the digest length is greater than the size of q use the
178.   		 * BN_num_bits(dsa->q) leftmost bits of the digest, see

crypto/bn/bn_lib.c:248:1: Parameter `a->top`
  246.   	}
  247.   
  248. > int BN_num_bits(const BIGNUM *a)
  249.   	{
  250.   	int i = a->top - 1;

crypto/dsa/dsa_ossl.c:180:10: Call
178.   		 * BN_num_bits(dsa->q) leftmost bits of the digest, see
179.   		 * fips 186-3, 4.2 */
180.   		dlen = BN_num_bytes(dsa->q);
                ^
181.   	if (BN_bin2bn(dgst,dlen,&m) == NULL)
182.   		goto err;

crypto/bn/bn_lib.c:248:1: <LHS trace>
246.   	}
247.   
248. > int BN_num_bits(const BIGNUM *a)
249.   	{
250.   	int i = a->top - 1;

crypto/bn/bn_lib.c:248:1: Parameter `a->top`
  246.   	}
  247.   
  248. > int BN_num_bits(const BIGNUM *a)
  249.   	{
  250.   	int i = a->top - 1;

crypto/bn/bn_lib.c:250:2: Binary operation: ([0, dsa->q->top] - 1):unsigned64 by call to `BN_num_bits` 
  248.   int BN_num_bits(const BIGNUM *a)
  249.   	{
  250.   	int i = a->top - 1;
          ^
  251.   	bn_check_top(a);
  252.   

int BN_num_bits(const BIGNUM *a)
	{
	int i = a->top - 1;
	bn_check_top(a);
	if (BN_is_zero(a)) return 0;
	return ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));
	}
['static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)\n\t{\n\tBIGNUM *kinv=NULL,*r=NULL,*s=NULL;\n\tBIGNUM m;\n\tBIGNUM xr;\n\tBN_CTX *ctx=NULL;\n\tint reason=ERR_R_BN_LIB;\n\tDSA_SIG *ret=NULL;\n\tBN_init(&m);\n\tBN_init(&xr);\n\tif (!dsa->p || !dsa->q || !dsa->g)\n\t\t{\n\t\treason=DSA_R_MISSING_PARAMETERS;\n\t\tgoto err;\n\t\t}\n\ts=BN_new();\n\tif (s == NULL) goto err;\n\tif (dlen > SHA256_DIGEST_LENGTH)\n\t\t{\n\t\treason=DSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE;\n\t\tgoto err;\n\t\t}\n\tctx=BN_CTX_new();\n\tif (ctx == NULL) goto err;\n\tif ((dsa->kinv == NULL) || (dsa->r == NULL))\n\t\t{\n\t\tif (!DSA_sign_setup(dsa,ctx,&kinv,&r)) goto err;\n\t\t}\n\telse\n\t\t{\n\t\tkinv=dsa->kinv;\n\t\tdsa->kinv=NULL;\n\t\tr=dsa->r;\n\t\tdsa->r=NULL;\n\t\t}\n\tif (dlen > BN_num_bytes(dsa->q))\n\t\tdlen = BN_num_bytes(dsa->q);\n\tif (BN_bin2bn(dgst,dlen,&m) == NULL)\n\t\tgoto err;\n\tif (!BN_mod_mul(&xr,dsa->priv_key,r,dsa->q,ctx)) goto err;\n\tif (!BN_add(s, &xr, &m)) goto err;\n\tif (BN_cmp(s,dsa->q) > 0)\n\t\tBN_sub(s,s,dsa->q);\n\tif (!BN_mod_mul(s,s,kinv,dsa->q,ctx)) goto err;\n\tret=DSA_SIG_new();\n\tif (ret == NULL) goto err;\n\tret->r = r;\n\tret->s = s;\nerr:\n\tif (!ret)\n\t\t{\n\t\tDSAerr(DSA_F_DSA_DO_SIGN,reason);\n\t\tBN_free(r);\n\t\tBN_free(s);\n\t\t}\n\tif (ctx != NULL) BN_CTX_free(ctx);\n\tBN_clear_free(&m);\n\tBN_clear_free(&xr);\n\tif (kinv != NULL)\n\t    BN_clear_free(kinv);\n\treturn(ret);\n\t}', 'int BN_num_bits(const BIGNUM *a)\n\t{\n\tint i = a->top - 1;\n\tbn_check_top(a);\n\tif (BN_is_zero(a)) return 0;\n\treturn ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));\n\t}']