crypto/dsa/dsa_ossl.c:129: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `BN_mod_mul`.
Showing all 13 steps of the trace


crypto/dsa/dsa_ossl.c:95:10: Call
93.   
94.    redo:
95.       if (!dsa_sign_setup(dsa, ctx, &kinv, &ret->r, dgst, dlen))
               ^
96.           goto err;
97.   

crypto/dsa/dsa_ossl.c:178:1: Parameter `ctx_in->stack.depth`
  176.   }
  177.   
  178. > static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in,
  179.                             BIGNUM **kinvp, BIGNUM **rp,
  180.                             const unsigned char *dgst, int dlen)

crypto/dsa/dsa_ossl.c:129:10: Call
127.   
128.       /* tmp := blind * priv_key * r mod q */
129.       if (!BN_mod_mul(tmp, blind, dsa->priv_key, dsa->q, ctx))
                ^
130.           goto err;
131.       if (!BN_mod_mul(tmp, tmp, ret->r, dsa->q, ctx))

crypto/bn/bn_mod.c:203:5: Call
  201.       bn_check_top(m);
  202.   
  203.       BN_CTX_start(ctx);
             ^
  204.       if ((t = BN_CTX_get(ctx)) == NULL)
  205.           goto err;

crypto/bn/bn_ctx.c:188:1: Parameter `*ctx->stack.indexes`
    186.   }
    187.   
    188. > void BN_CTX_start(BN_CTX *ctx)
    189.   {
    190.       CTXDBG("ENTER BN_CTX_start()", ctx);

crypto/bn/bn_mod.c:218:5: Call
  216.       ret = 1;
  217.    err:
  218.       BN_CTX_end(ctx);
             ^
  219.       return ret;
  220.   }

crypto/bn/bn_ctx.c:202:1: Parameter `*ctx->stack.indexes`
    200.   }
    201.   
    202. > void BN_CTX_end(BN_CTX *ctx)
    203.   {
    204.       if (ctx == NULL)

crypto/bn/bn_ctx.c:210:27: Call
    208.           ctx->err_stack--;
    209.       else {
    210.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                     ^
    211.           /* Does this stack frame have anything to release? */
    212.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:290:1: <Offset trace>
288.   }
289.   
290. > static unsigned int BN_STACK_pop(BN_STACK *st)
291.   {
292.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:290:1: Parameter `st->depth`
      288.   }
      289.   
      290. > static unsigned int BN_STACK_pop(BN_STACK *st)
      291.   {
      292.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:290:1: <Length trace>
288.   }
289.   
290. > static unsigned int BN_STACK_pop(BN_STACK *st)
291.   {
292.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:290:1: Parameter `*st->indexes`
      288.   }
      289.   
      290. > static unsigned int BN_STACK_pop(BN_STACK *st)
      291.   {
      292.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:292:12: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `BN_mod_mul` 
      290.   static unsigned int BN_STACK_pop(BN_STACK *st)
      291.   {
      292.       return st->indexes[--(st->depth)];
                        ^
      293.   }
      294.   
