crypto/bn/bn_exp2.c:74: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `BN_mod`.
Showing all 15 steps of the trace


crypto/bn/bn_exp2.c:67:3: Call
65.   	if (BN_ucmp(a1,m) >= 0)
66.   		{
67.   		BN_mod(&(val[1][0]),a1,m,ctx);
        ^
68.   		aa1= &(val[1][0]);
69.   		}

crypto/bn/bn_div.c:287:1: Parameter `*rem->d`
  285.   
  286.   /* rem != m */
  287. > int BN_mod(BIGNUM *rem, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
  288.   	{
  289.   #if 0 /* The old slow way */

crypto/bn/bn_div.c:313:9: Call
  311.   	return(1);
  312.   #else
  313.   	return(BN_div(NULL,rem,m,d,ctx));
                 ^
  314.   #endif
  315.   	}

crypto/bn/bn_div.c:121:1: Parameter `*rm->d`
    119.   #else
    120.   
    121. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
    122.   	   BN_CTX *ctx)
    123.   	{

crypto/bn/bn_exp2.c:74:3: Call
72.   	if (BN_ucmp(a2,m) >= 0)
73.   		{
74.   		BN_mod(&(val[0][1]),a2,m,ctx);
        ^
75.   		aa2= &(val[0][1]);
76.   		}

crypto/bn/bn_div.c:287:1: Parameter `*rem->d`
  285.   
  286.   /* rem != m */
  287. > int BN_mod(BIGNUM *rem, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
  288.   	{
  289.   #if 0 /* The old slow way */

crypto/bn/bn_div.c:313:9: Call
  311.   	return(1);
  312.   #else
  313.   	return(BN_div(NULL,rem,m,d,ctx));
                 ^
  314.   #endif
  315.   	}

crypto/bn/bn_div.c:121:1: Parameter `*rm->d`
    119.   #else
    120.   
    121. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
    122.   	   BN_CTX *ctx)
    123.   	{

crypto/bn/bn_div.c:142:10: Call
    140.   		{
    141.   		if (rm != NULL)
    142.   			{ if (BN_copy(rm,num) == NULL) return(0); }
                    ^
    143.   		if (dv != NULL) BN_zero(dv);
    144.   		return(1);

crypto/bn/bn_lib.c:499:1: Parameter `*a->d`
      497.   	}
      498.   
      499. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      500.   	{
      501.   	int i;

crypto/bn/bn_lib.c:508:6: Call
      506.   
      507.   	if (a == b) return(a);
      508.   	if (bn_wexpand(a,b->top) == NULL) return(NULL);
                  ^
      509.   
      510.   #if 1

crypto/bn/bn_lib.c:344:1: <Length trace>
342.   	}
343.   
344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
345.   	{
346.   	BN_ULONG *A,*a;

crypto/bn/bn_lib.c:344:1: Parameter `*b->d`
        342.   	}
        343.   
        344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
        345.   	{
        346.   	BN_ULONG *A,*a;

crypto/bn/bn_lib.c:367:3: Assignment
        365.   			}
        366.   #if 1
        367.   		B=b->d;
                 ^
        368.   		/* Check if the previous number needs to be copied */
        369.   		if (B != NULL)

crypto/bn/bn_lib.c:447:35: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `BN_mod` 
        445.   				 */
        446.   				BN_ULONG a0,a1,a2,a3;
        447.   				a0=B[0]; a1=B[1]; a2=B[2]; a3=B[3];
                                                 ^
        448.   				A[0]=a0; A[1]=a1; A[2]=a2; A[3]=a3;
        449.   				}
