apps/dsaparam.c:332: error: BUFFER_OVERRUN_L3
  Offset: [16, +oo] Size: [0, +oo] by call to `DSA_generate_key`.
Showing all 24 steps of the trace


apps/dsaparam.c:228:14: Call
226.   		BIO_printf(bio_err,"Generating DSA parameters, %d bit long prime\n",num);
227.   	        BIO_printf(bio_err,"This could take some time\n");
228.   	        dsa=DSA_generate_parameters(num,NULL,0,NULL,NULL,
                    ^
229.   			dsa_cb,(char *)bio_err);
230.   		}

crypto/dsa/dsa_gen.c:224:3: Call
  222.   		{
  223.   		/* g=test^r0%p */
  224.   		BN_mod_exp_mont(g,test,r0,p,ctx,mont);
           ^
  225.   		if (!BN_is_one(g)) break;
  226.   		BN_add(test,test,BN_value_one());

crypto/bn/bn_exp.c:346:3: Call
    344.   	if (BN_ucmp(a,m) >= 0)
    345.   		{
    346.   		BN_mod(&(val[0]),a,m,ctx);
             ^
    347.   		aa= &(val[0]);
    348.   		}

crypto/bn/bn_div.c:355:9: Call
      353.   	return(1);
      354.   #else
      355.   	return(BN_div(NULL,rem,m,d,ctx));
                     ^
      356.   #endif
      357.   	}

crypto/bn/bn_div.c:121:1: Parameter `dv->top`
        119.   #else
        120.   
        121. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
        122.   	   BN_CTX *ctx)
        123.   	{

apps/dsaparam.c:332:8: Call
330.   		assert(need_rand);
331.   		if ((dsakey=DSAparams_dup(dsa)) == NULL) goto end;
332.   		if (!DSA_generate_key(dsakey)) goto end;
              ^
333.   		if 	(outformat == FORMAT_ASN1)
334.   			i=i2d_DSAPrivateKey_bio(out,dsakey);

crypto/dsa/dsa_key.c:68:1: Parameter `dsa->p->top`
  66.   #include <openssl/rand.h>
  67.   
  68. > int DSA_generate_key(DSA *dsa)
  69.   	{
  70.   	int ok=0;

crypto/dsa/dsa_key.c:100:7: Call
  98.   		pub_key=dsa->pub_key;
  99.   
  100.   	if (!BN_mod_exp(pub_key,dsa->g,priv_key,dsa->p,ctx)) goto err;
               ^
  101.   
  102.   	dsa->priv_key=priv_key;

crypto/bn/bn_exp.c:157:1: Parameter `m->top`
    155.   	}
    156.   
    157. > int BN_mod_exp(BIGNUM *r, BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
    158.   	       BN_CTX *ctx)
    159.   	{

crypto/bn/bn_exp.c:178:9: Call
    176.   #endif
    177.   #ifdef RECP_MUL_MOD
    178.   		{ ret=BN_mod_exp_recp(r,a,p,m,ctx); }
                   ^
    179.   #else
    180.   		{ ret=BN_mod_exp_simple(r,a,p,m,ctx); }

crypto/bn/bn_exp.c:205:6: Call
      203.   		}
      204.   	BN_RECP_CTX_init(&recp);
      205.   	if (BN_RECP_CTX_set(&recp,m,ctx) <= 0) goto err;
                  ^
      206.   
      207.   	BN_init(&(val[0]));

crypto/bn/bn_recp.c:96:2: Call
        94.   int BN_RECP_CTX_set(BN_RECP_CTX *recp, const BIGNUM *d, BN_CTX *ctx)
        95.   	{
        96.   	BN_copy(&(recp->N),d);
               ^
        97.   	BN_zero(&(recp->Nr));
        98.   	recp->num_bits=BN_num_bits(d);

crypto/bn/bn_lib.c:501:1: Parameter `a->top`
          499.   	}
          500.   
          501. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
          502.   	{
          503.   	int i;

crypto/bn/bn_exp.c:211:7: Call
      209.   
      210.   	if (!BN_mod(&(val[0]),a,m,ctx)) goto err;		/* 1 */
      211.   	if (!BN_mod_mul_reciprocal(aa,&(val[0]),&(val[0]),&recp,ctx))
                   ^
      212.   		goto err;				/* 2 */
      213.   

crypto/bn/bn_recp.c:103:1: Parameter `*recp->N.d`
        101.   	}
        102.   
        103. > int BN_mod_mul_reciprocal(BIGNUM *r, BIGNUM *x, BIGNUM *y, BN_RECP_CTX *recp,
        104.   	     BN_CTX *ctx)
        105.   	{

crypto/bn/bn_recp.c:120:2: Call
        118.   		a=x; /* Just do the mod */
        119.   
        120.   	BN_div_recp(NULL,r,a,recp,ctx);
                ^
        121.   	ret=1;
        122.   err:

crypto/bn/bn_recp.c:127:1: Parameter `*recp->N.d`
          125.   	}
          126.   
          127. > int BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BN_RECP_CTX *recp,
          128.   	     BN_CTX *ctx)
          129.   	{

crypto/bn/bn_recp.c:181:7: Call
          179.   	if (!BN_rshift(d,b,j+ex)) goto err;
          180.   	d->neg=0;
          181.   	if (!BN_mul(b,&(recp->N),d,ctx)) goto err;
                       ^
          182.   	if (!BN_usub(r,m,b)) goto err;
          183.   	r->neg=0;

crypto/bn/bn_mul.c:560:1: <Offset trace>
558.   #endif
559.   
560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
561.   	{
562.   	int top,al,bl;

crypto/bn/bn_mul.c:560:1: Parameter `a->top`
            558.   #endif
            559.   
            560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
            561.   	{
            562.   	int top,al,bl;

crypto/bn/bn_mul.c:577:2: Assignment
            575.   	bn_check_top(r);
            576.   
            577.   	al=a->top;
                    ^
            578.   	bl=b->top;
            579.   	r->neg=a->neg^b->neg;

crypto/bn/bn_mul.c:560:1: <Length trace>
558.   #endif
559.   
560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
561.   	{
562.   	int top,al,bl;

crypto/bn/bn_mul.c:560:1: Parameter `*a->d`
            558.   #endif
            559.   
            560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
            561.   	{
            562.   	int top,al,bl;

crypto/bn/bn_mul.c:648:4: Array access: Offset: [16, +oo] Size: [0, +oo] by call to `DSA_generate_key` 
            646.   			{
            647.   			bn_wexpand(a,bl);
            648.   			a->d[al]=0;
                      ^
            649.   			al++;
            650.   			goto symetric;
