crypto/bn/bn_mont.c:421: error: BUFFER_OVERRUN_L1
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: 2 by call to `BN_mod_inverse`.
Showing all 11 steps of the trace


crypto/bn/bn_mont.c:355:1: Array declaration
353.   	}
354.   
355. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
356.   	{
357.   	int ret = 0;

crypto/bn/bn_mont.c:372:3: Assignment
370.   
371.   		BN_init(&tmod);
372.   		tmod.d=buf;
         ^
373.   		tmod.dmax=2;
374.   		tmod.neg=0;

crypto/bn/bn_mont.c:421:8: Call
419.   		tmod.top = buf[0] != 0 ? 1 : 0;
420.   							/* Ri = R^-1 mod N*/
421.   		if ((BN_mod_inverse(Ri,R,&tmod,ctx)) == NULL)
              ^
422.   			goto err;
423.   		if (!BN_lshift(Ri,Ri,BN_BITS2)) goto err; /* R*Ri */

crypto/bn/bn_gcd.c:209:1: Parameter `*n->d`
  207.           const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx);
  208.   
  209. > BIGNUM *BN_mod_inverse(BIGNUM *in,
  210.   	const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
  211.   	{

crypto/bn/bn_gcd.c:218:10: Call
  216.   	if ((BN_get_flags(a, BN_FLG_CONSTTIME) != 0) || (BN_get_flags(n, BN_FLG_CONSTTIME) != 0))
  217.   		{
  218.   		return BN_mod_inverse_no_branch(in, a, n, ctx);
                  ^
  219.   		}
  220.   

crypto/bn/bn_gcd.c:507:1: Parameter `*n->d`
    505.    * It does not contain branches that may leak sensitive information.
    506.    */
    507. > static BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in,
    508.   	const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
    509.   	{

crypto/bn/bn_gcd.c:538:6: Call
    536.   	BN_zero(Y);
    537.   	if (BN_copy(B,a) == NULL) goto err;
    538.   	if (BN_copy(A,n) == NULL) goto err;
                ^
    539.   	A->neg = 0;
    540.   

crypto/bn/bn_lib.c:478:1: <Length trace>
476.   	}
477.   
478. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
479.   	{
480.   	int i;

crypto/bn/bn_lib.c:478:1: Parameter `*b->d`
      476.   	}
      477.   
      478. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      479.   	{
      480.   	int i;

crypto/bn/bn_lib.c:491:2: Assignment
      489.   #if 1
      490.   	A=a->d;
      491.   	B=b->d;
              ^
      492.   	for (i=b->top>>2; i>0; i--,A+=4,B+=4)
      493.   		{

crypto/bn/bn_lib.c:495:33: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: 2 by call to `BN_mod_inverse` 
      493.   		{
      494.   		BN_ULONG a0,a1,a2,a3;
      495.   		a0=B[0]; a1=B[1]; a2=B[2]; a3=B[3];
                                             ^
      496.   		A[0]=a0; A[1]=a1; A[2]=a2; A[3]=a3;
      497.   		}
