crypto/rsa/rsa_ossl.c:616: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607] by call to `BN_MONT_CTX_set_locked`.
Showing all 12 steps of the trace


crypto/rsa/rsa_ossl.c:610:9: Call
608.               goto err;
609.           }
610.           BN_with_flags(p, rsa->p, BN_FLG_CONSTTIME);
               ^
611.           BN_with_flags(q, rsa->q, BN_FLG_CONSTTIME);
612.   

crypto/bn/bn_lib.c:949:1: Parameter `*b->d`
  947.   }
  948.   
  949. > void BN_with_flags(BIGNUM *dest, const BIGNUM *b, int flags)
  950.   {
  951.       dest->d = b->d;

crypto/bn/bn_lib.c:951:5: Assignment
  949.   void BN_with_flags(BIGNUM *dest, const BIGNUM *b, int flags)
  950.   {
  951.       dest->d = b->d;
             ^
  952.       dest->top = b->top;
  953.       dest->dmax = b->dmax;

crypto/rsa/rsa_ossl.c:616:21: Call
614.               if (!BN_MONT_CTX_set_locked
615.                   (&rsa->_method_mod_p, rsa->lock, p, ctx)
616.                   || !BN_MONT_CTX_set_locked(&rsa->_method_mod_q,
                           ^
617.                                              rsa->lock, q, ctx)) {
618.                   BN_free(p);

crypto/bn/bn_mont.c:398:1: Parameter `*mod->d`
  396.   }
  397.   
  398. > BN_MONT_CTX *BN_MONT_CTX_set_locked(BN_MONT_CTX **pmont, CRYPTO_RWLOCK *lock,
  399.                                       const BIGNUM *mod, BN_CTX *ctx)
  400.   {

crypto/bn/bn_mont.c:420:10: Call
  418.       if (ret == NULL)
  419.           return NULL;
  420.       if (!BN_MONT_CTX_set(ret, mod, ctx)) {
                  ^
  421.           BN_MONT_CTX_free(ret);
  422.           return NULL;

crypto/bn/bn_mont.c:247:1: Parameter `*mod->d`
    245.   }
    246.   
    247. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
    248.   {
    249.       int ret = 0;

crypto/bn/bn_mont.c:259:10: Call
    257.           goto err;
    258.       R = &(mont->RR);            /* grab RR as a temp */
    259.       if (!BN_copy(&(mont->N), mod))
                    ^
    260.           goto err;               /* Set N */
    261.       mont->N.neg = 0;

crypto/bn/bn_lib.c:362:1: <Length trace>
360.   }
361.   
362. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
363.   {
364.       int i;

crypto/bn/bn_lib.c:362:1: Parameter `*b->d`
      360.   }
      361.   
      362. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      363.   {
      364.       int i;

crypto/bn/bn_lib.c:377:5: Assignment
      375.   #if 1
      376.       A = a->d;
      377.       B = b->d;
                 ^
      378.       for (i = b->top >> 2; i > 0; i--, A += 4, B += 4) {
      379.           BN_ULONG a0, a1, a2, a3;

crypto/bn/bn_lib.c:383:14: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607] by call to `BN_MONT_CTX_set_locked` 
      381.           a1 = B[1];
      382.           a2 = B[2];
      383.           a3 = B[3];
                          ^
      384.           A[0] = a0;
      385.           A[1] = a1;
