crypto/dsa/dsa_ossl.c:390: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607] by call to `BN_mod_mul`.
Showing all 19 steps of the trace


crypto/dsa/dsa_ossl.c:386:9: Call
384.            */
385.           dgst_len = (i >> 3);
386.       if (BN_bin2bn(dgst, dgst_len, u1) == NULL)
               ^
387.           goto err;
388.   

crypto/bn/bn_lib.c:541:1: Parameter `*ret->d`
  539.   }
  540.   
  541. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
  542.   {
  543.       unsigned int i, m;

crypto/dsa/dsa_ossl.c:390:10: Call
388.   
389.       /* u1 = M * w mod q */
390.       if (!BN_mod_mul(u1, u1, u2, dsa->q, ctx))
                ^
391.           goto err;
392.   

crypto/bn/bn_mod.c:178:1: Parameter `*r->d`
  176.   
  177.   /* slow but works */
  178. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
  179.                  BN_CTX *ctx)
  180.   {

crypto/bn/bn_mod.c:198:10: Call
  196.               goto err;
  197.       }
  198.       if (!BN_nnmod(r, t, m, ctx))
                  ^
  199.           goto err;
  200.       bn_check_top(r);

crypto/bn/bn_mod.c:118:1: Parameter `*r->d`
    116.   #include "bn_lcl.h"
    117.   
    118. > int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
    119.   {
    120.       /*

crypto/bn/bn_mod.c:125:11: Call
    123.        */
    124.   
    125.       if (!(BN_mod(r, m, d, ctx)))
                     ^
    126.           return 0;
    127.       if (!r->neg)

crypto/bn/bn_div.c:188:1: Parameter `*rm->d`
      186.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
      187.    */
      188. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
      189.              BN_CTX *ctx)
      190.   {

crypto/bn/bn_div.c:233:17: Call
      231.       if (!no_branch && BN_ucmp(num, divisor) < 0) {
      232.           if (rm != NULL) {
      233.               if (BN_copy(rm, num) == NULL)
                             ^
      234.                   return (0);
      235.           }

crypto/bn/bn_lib.c:428:1: Parameter `*a->d`
        426.   }
        427.   
        428. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        429.   {
        430.       int i;

crypto/bn/bn_lib.c:438:9: Call
        436.       if (a == b)
        437.           return (a);
        438.       if (bn_wexpand(a, b->top) == NULL)
                       ^
        439.           return (NULL);
        440.   

crypto/bn/bn_lib.c:994:1: Parameter `*a->d`
          992.   }
          993.   
          994. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
          995.   {
          996.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:996:37: Call
          994.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
          995.   {
          996.       return (words <= a->dmax) ? a : bn_expand2(a, words);
                                                     ^
          997.   }
          998.   

crypto/bn/bn_lib.c:389:1: Parameter `*b->d`
            387.    */
            388.   
            389. > BIGNUM *bn_expand2(BIGNUM *b, int words)
            390.   {
            391.       bn_check_top(b);

crypto/bn/bn_lib.c:394:23: Call
            392.   
            393.       if (words > b->dmax) {
            394.           BN_ULONG *a = bn_expand_internal(b, words);
                                         ^
            395.           if (!a)
            396.               return NULL;

crypto/bn/bn_lib.c:299:1: <Length trace>
297.   /* This is used by bn_expand2() */
298.   /* The caller MUST check that words > b->dmax before calling this */
299. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
300.   {
301.       BN_ULONG *A, *a = NULL;

crypto/bn/bn_lib.c:299:1: Parameter `*b->d`
              297.   /* This is used by bn_expand2() */
              298.   /* The caller MUST check that words > b->dmax before calling this */
              299. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
              300.   {
              301.       BN_ULONG *A, *a = NULL;

crypto/bn/bn_lib.c:334:5: Assignment
              332.   
              333.   #if 1
              334.       B = b->d;
                         ^
              335.       /* Check if the previous number needs to be copied */
              336.       if (B != NULL) {

crypto/bn/bn_lib.c:351:18: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607] by call to `BN_mod_mul` 
              349.               a1 = B[1];
              350.               a2 = B[2];
              351.               a3 = B[3];
                                      ^
              352.               A[0] = a0;
              353.               A[1] = a1;
