crypto/dsa/dsa_gen.c:542: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_MONT_CTX_set`.
Showing all 12 steps of the trace


crypto/dsa/dsa_gen.c:390:10: Call
388.       }
389.   
390.       if (!BN_lshift(test, BN_value_one(), L - 1))
                ^
391.           goto err;
392.       for (;;) {

crypto/bn/bn_shift.c:83:1: Parameter `r->top`
  81.   }
  82.   
  83. > int BN_lshift(BIGNUM *r, const BIGNUM *a, int n)
  84.   {
  85.       int i, nw, lb, rb;

crypto/dsa/dsa_gen.c:542:10: Call
540.       } else
541.           h = 1;
542.       if (!BN_MONT_CTX_set(mont, p, ctx))
                ^
543.           goto err;
544.   

crypto/bn/bn_mont.c:251:1: Parameter `*mont->N.d`
  249.   }
  250.   
  251. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
  252.   {
  253.       int i, ret = 0;

crypto/bn/bn_mont.c:263:10: Call
  261.           goto err;
  262.       R = &(mont->RR);            /* grab RR as a temp */
  263.       if (!BN_copy(&(mont->N), mod))
                  ^
  264.           goto err;               /* Set N */
  265.       if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0)

crypto/bn/bn_lib.c:281:1: <Offset trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `b->top`
    279.   }
    280.   
    281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    282.   {
    283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: <Length trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `*a->d`
    279.   }
    280.   
    281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    282.   {
    283.       bn_check_top(b);

crypto/bn/bn_lib.c:287:9: Call
    285.       if (a == b)
    286.           return a;
    287.       if (bn_wexpand(a, b->top) == NULL)
                   ^
    288.           return NULL;
    289.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
      946.   }
      947.   
      948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
      949.   {
      950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:291:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_MONT_CTX_set` 
    289.   
    290.       if (b->top > 0)
    291.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                   ^
    292.   
    293.       a->neg = b->neg;
