crypto/dsa/dsa_ossl.c:91: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `dsa_sign_setup`.
Showing all 17 steps of the trace


crypto/dsa/dsa_ossl.c:59:1: Parameter `dsa->p->top`
57.   }
58.   
59. > static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
60.   {
61.       BIGNUM *kinv = NULL;

crypto/dsa/dsa_ossl.c:91:10: Call
89.           goto err;
90.    redo:
91.       if (!dsa_sign_setup(dsa, ctx, &kinv, &ret->r, dgst, dlen))
               ^
92.           goto err;
93.   

crypto/dsa/dsa_ossl.c:143:1: Parameter `dsa->p->top`
  141.   }
  142.   
  143. > static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in,
  144.                             BIGNUM **kinvp, BIGNUM **rp,
  145.                             const unsigned char *dgst, int dlen)

crypto/dsa/dsa_ossl.c:194:14: Call
  192.   
  193.       if (dsa->flags & DSA_FLAG_CACHE_MONT_P) {
  194.           if (!BN_MONT_CTX_set_locked(&dsa->method_mont_p,
                      ^
  195.                                       dsa->lock, dsa->p, ctx))
  196.               goto err;

crypto/bn/bn_mont.c:403:1: Parameter `mod->top`
    401.   }
    402.   
    403. > BN_MONT_CTX *BN_MONT_CTX_set_locked(BN_MONT_CTX **pmont, CRYPTO_RWLOCK *lock,
    404.                                       const BIGNUM *mod, BN_CTX *ctx)
    405.   {

crypto/bn/bn_mont.c:425:10: Call
    423.       if (ret == NULL)
    424.           return NULL;
    425.       if (!BN_MONT_CTX_set(ret, mod, ctx)) {
                    ^
    426.           BN_MONT_CTX_free(ret);
    427.           return NULL;

crypto/bn/bn_mont.c:247:1: Parameter `mod->top`
      245.   }
      246.   
      247. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
      248.   {
      249.       int ret = 0;

crypto/bn/bn_mont.c:252:9: Call
      250.       BIGNUM *Ri, *R;
      251.   
      252.       if (BN_is_zero(mod))
                     ^
      253.           return 0;
      254.   

crypto/bn/bn_lib.c:841:1: Parameter `a->top`
        839.   }
        840.   
        841. > int BN_is_zero(const BIGNUM *a)
        842.   {
        843.       return a->top == 0;

crypto/bn/bn_mont.c:259:10: Call
      257.           goto err;
      258.       R = &(mont->RR);            /* grab RR as a temp */
      259.       if (!BN_copy(&(mont->N), mod))
                      ^
      260.           goto err;               /* Set N */
      261.       if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0)

crypto/bn/bn_lib.c:312:1: <Offset trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `b->top`
        310.   }
        311.   
        312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        313.   {
        314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: <Length trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `*a->d`
        310.   }
        311.   
        312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        313.   {
        314.       bn_check_top(b);

crypto/bn/bn_lib.c:318:9: Call
        316.       if (a == b)
        317.           return a;
        318.       if (bn_wexpand(a, b->top) == NULL)
                       ^
        319.           return NULL;
        320.   

crypto/bn/bn_lib.c:937:1: Parameter `*a->d`
          935.   }
          936.   
          937. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
          938.   {
          939.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:322:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `dsa_sign_setup` 
        320.   
        321.       if (b->top > 0)
        322.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                       ^
        323.   
        324.       a->top = b->top;
