crypto/bn/bn_prime.c:482: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `BN_mod_mul`.
Showing all 18 steps of the trace


crypto/bn/bn_prime.c:471:1: Parameter `ctx->stack.depth`
469.   }
470.   
471. > static int witness(BIGNUM *w, const BIGNUM *a, const BIGNUM *a1,
472.                      const BIGNUM *a1_odd, int k, BN_CTX *ctx,
473.                      BN_MONT_CTX *mont)

crypto/bn/bn_prime.c:475:10: Call
473.                      BN_MONT_CTX *mont)
474.   {
475.       if (!BN_mod_exp_mont(w, w, a1_odd, a, ctx, mont)) /* w := w^a1_odd mod a */
                ^
476.           return -1;
477.       if (BN_is_one(w))

crypto/bn/bn_exp.c:401:1: Parameter `ctx->stack.depth`
  399.   }
  400.   
  401. > int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
  402.                       const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
  403.   {

crypto/bn/bn_prime.c:482:14: Call
480.           return 0;               /* w == -1 (mod a), 'a' is probably prime */
481.       while (--k) {
482.           if (!BN_mod_mul(w, w, w, a, ctx)) /* w := w^2 mod a */
                    ^
483.               return -1;
484.           if (BN_is_one(w))

crypto/bn/bn_mod.c:178:1: Parameter `ctx->stack.depth`
  176.   
  177.   /* slow but works */
  178. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
  179.                  BN_CTX *ctx)
  180.   {

crypto/bn/bn_mod.c:188:5: Call
  186.       bn_check_top(m);
  187.   
  188.       BN_CTX_start(ctx);
             ^
  189.       if ((t = BN_CTX_get(ctx)) == NULL)
  190.           goto err;

crypto/bn/bn_ctx.c:227:1: Parameter `ctx->stack.depth`
    225.   }
    226.   
    227. > void BN_CTX_start(BN_CTX *ctx)
    228.   {
    229.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_mod.c:192:14: Call
  190.           goto err;
  191.       if (a == b) {
  192.           if (!BN_sqr(t, a, ctx))
                      ^
  193.               goto err;
  194.       } else {

crypto/bn/bn_sqr.c:80:5: Call
    78.       }
    79.   
    80.       BN_CTX_start(ctx);
              ^
    81.       rr = (a != r) ? r : BN_CTX_get(ctx);
    82.       tmp = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:227:1: Parameter `*ctx->stack.indexes`
      225.   }
      226.   
      227. > void BN_CTX_start(BN_CTX *ctx)
      228.   {
      229.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_sqr.c:147:5: Call
    145.       bn_check_top(rr);
    146.       bn_check_top(tmp);
    147.       BN_CTX_end(ctx);
               ^
    148.       return (ret);
    149.   }

crypto/bn/bn_ctx.c:241:1: Parameter `*ctx->stack.indexes`
      239.   }
      240.   
      241. > void BN_CTX_end(BN_CTX *ctx)
      242.   {
      243.       CTXDBG_ENTRY("BN_CTX_end", ctx);

crypto/bn/bn_ctx.c:247:27: Call
      245.           ctx->err_stack--;
      246.       else {
      247.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                       ^
      248.           /* Does this stack frame have anything to release? */
      249.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:317:1: <Offset trace>
315.   }
316.   
317. > static unsigned int BN_STACK_pop(BN_STACK *st)
318.   {
319.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:317:1: Parameter `st->depth`
        315.   }
        316.   
        317. > static unsigned int BN_STACK_pop(BN_STACK *st)
        318.   {
        319.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:317:1: <Length trace>
315.   }
316.   
317. > static unsigned int BN_STACK_pop(BN_STACK *st)
318.   {
319.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:317:1: Parameter `*st->indexes`
        315.   }
        316.   
        317. > static unsigned int BN_STACK_pop(BN_STACK *st)
        318.   {
        319.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:319:12: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `BN_mod_mul` 
        317.   static unsigned int BN_STACK_pop(BN_STACK *st)
        318.   {
        319.       return st->indexes[--(st->depth)];
                          ^
        320.   }
        321.   
