crypto/dsa/dsa_ossl.c:142: error: BUFFER_OVERRUN_L3
  Offset: [4, +oo] (⇐ [0, +oo] + 4) Size: [0, +oo] by call to `BN_mod_mul`.
Showing all 17 steps of the trace


crypto/dsa/dsa_ossl.c:135:6: Call
133.   		}
134.   
135.   	if (BN_bin2bn(dgst,dlen,&m) == NULL) goto err;
            ^
136.   
137.   	/* Compute  s = inv(k) (m + xr) mod q */

crypto/bn/bn_lib.c:603:23: Call
  601.   	BN_ULONG l;
  602.   
  603.   	if (ret == NULL) ret=BN_new();
                               ^
  604.   	if (ret == NULL) return(NULL);
  605.   	l=0;

crypto/bn/bn_lib.c:303:2: Assignment
    301.   	ret->neg=0;
    302.   	ret->max=0;
    303.   	ret->d=NULL;
            ^
    304.   	return(ret);
    305.   	}

crypto/dsa/dsa_ossl.c:139:7: Call
137.   	/* Compute  s = inv(k) (m + xr) mod q */
138.   	if (!BN_mod_mul(&xr,dsa->priv_key,r,dsa->q,ctx)) goto err;/* s = xr */
139.   	if (!BN_add(s, &xr, &m)) goto err;		/* s = m + xr */
             ^
140.   	if (BN_cmp(s,dsa->q) > 0)
141.   		BN_sub(s,s,dsa->q);

crypto/bn/bn_add.c:64:1: Parameter `*r->d`
  62.   
  63.   /* r can == a or b */
  64. > int BN_add(BIGNUM *r, BIGNUM *a, BIGNUM *b)
  65.   	{
  66.   	BIGNUM *tmp;

crypto/bn/bn_add.c:86:9: Call
  84.   		if (BN_ucmp(a,b) < 0)
  85.   			{
  86.   			if (!BN_usub(r,b,a)) return(0);
                ^
  87.   			r->neg=1;
  88.   			}

crypto/bn/bn_add.c:167:1: Parameter `*r->d`
    165.   
    166.   /* unsigned subtraction of b from a, a must be larger than b. */
    167. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
    168.   	{
    169.   	int max,min;

crypto/dsa/dsa_ossl.c:142:7: Call
140.   	if (BN_cmp(s,dsa->q) > 0)
141.   		BN_sub(s,s,dsa->q);
142.   	if (!BN_mod_mul(s,s,kinv,dsa->q,ctx)) goto err;
             ^
143.   
144.   	ret=DSA_SIG_new();

crypto/bn/bn_exp.c:66:1: Parameter `*a->d`
  64.   
  65.   /* slow but works */
  66. > int BN_mod_mul(BIGNUM *ret, BIGNUM *a, BIGNUM *b, const BIGNUM *m, BN_CTX *ctx)
  67.   	{
  68.   	BIGNUM *t;

crypto/bn/bn_exp.c:79:10: Call
  77.   		{ if (!BN_sqr(t,a,ctx)) goto err; }
  78.   	else
  79.   		{ if (!BN_mul(t,a,b,ctx)) goto err; }
                 ^
  80.   	if (!BN_mod(ret,t,m,ctx)) goto err;
  81.   	r=1;

crypto/bn/bn_mul.c:560:1: Parameter `*a->d`
    558.   #endif
    559.   
    560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
    561.   	{
    562.   	int top,al,bl;

crypto/bn/bn_mul.c:686:4: Call
    684.   			for (i=b->top; i<k; i++)
    685.   				b->d[i]=0;
    686.   			bn_mul_part_recursive(rr->d,a->d,b->d,al-j,j,t->d);
              ^
    687.   			}
    688.   		rr->top=top;

crypto/bn/bn_mul.c:218:1: Parameter `*a`
      216.   /* n+tn is the word length
      217.    * t needs to be n*4 is size, as does r */
      218. > void bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int tn,
      219.   	     int n, BN_ULONG *t)
      220.   	{

crypto/bn/bn_mul.c:231:3: Call
      229.   		{
      230.   		i=tn+n;
      231.   		bn_mul_normal(r,a,i,b,i);
               ^
      232.   		return;
      233.   		}

crypto/bn/bn_mul.c:699:1: <Length trace>
697.   	}
698.   
699. > void bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb)
700.   	{
701.   	BN_ULONG *rr;

crypto/bn/bn_mul.c:699:1: Parameter `*b`
        697.   	}
        698.   
        699. > void bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb)
        700.   	{
        701.   	BN_ULONG *rr;

crypto/bn/bn_mul.c:728:39: Array access: Offset: [4, +oo] (⇐ [0, +oo] + 4) Size: [0, +oo] by call to `BN_mod_mul` 
        726.   		rr[3]=bn_mul_add_words(&(r[3]),a,na,b[3]);
        727.   		if (--nb <= 0) return;
        728.   		rr[4]=bn_mul_add_words(&(r[4]),a,na,b[4]);
                                                     ^
        729.   		rr+=4;
        730.   		r+=4;
