crypto/rsa/rsa_ossl.c:869: error: BUFFER_OVERRUN_L3
  Offset: [0, 191] Size: [0, 8388607] by call to `BN_div`.
Showing all 21 steps of the trace


crypto/rsa/rsa_ossl.c:755:21: Call
753.               if (!BN_MONT_CTX_set_locked
754.                   (&rsa->_method_mod_p, CRYPTO_LOCK_RSA, p, ctx)
755.                   || !BN_MONT_CTX_set_locked(&rsa->_method_mod_q,
                           ^
756.                                              CRYPTO_LOCK_RSA, q, ctx)) {
757.                   BN_free(local_p);

crypto/bn/bn_mont.c:522:10: Call
  520.       if (ret == NULL)
  521.           return NULL;
  522.       if (!BN_MONT_CTX_set(ret, mod, ctx)) {
                  ^
  523.           BN_MONT_CTX_free(ret);
  524.           return NULL;

crypto/bn/bn_mont.c:428:14: Call
    426.           tmod.top = buf[0] != 0 ? 1 : 0;
    427.           /* Ri = R^-1 mod N */
    428.           if ((BN_mod_inverse(Ri, R, &tmod, ctx)) == NULL)
                        ^
    429.               goto err;
    430.           if (!BN_lshift(Ri, Ri, BN_BITS2))

crypto/bn/bn_gcd.c:231:10: Call
      229.       BIGNUM *rv;
      230.       int noinv;
      231.       rv = int_bn_mod_inverse(in, a, n, ctx, &noinv);
                      ^
      232.       if (noinv)
      233.           BNerr(BN_F_BN_MOD_INVERSE, BN_R_NO_INVERSE);

crypto/bn/bn_gcd.c:282:14: Call
        280.       A->neg = 0;
        281.       if (B->neg || (BN_ucmp(B, A) >= 0)) {
        282.           if (!BN_nnmod(B, B, A, ctx))
                            ^
        283.               goto err;
        284.       }

crypto/bn/bn_mod.c:126:11: Call
          124.        */
          125.   
          126.       if (!(BN_mod(r, m, d, ctx)))
                           ^
          127.           return 0;
          128.       if (!r->neg)

crypto/bn/bn_div.c:189:1: Parameter `*dv->d`
            187.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
            188.    */
            189. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
            190.              BN_CTX *ctx)
            191.   {

crypto/rsa/rsa_ossl.c:788:14: Call
786.               c = I;
787.           }
788.           if (!BN_mod(r1, c, rsa->q, ctx)) {
                    ^
789.               BN_free(local_c);
790.               goto err;

crypto/bn/bn_div.c:189:1: Parameter `*dv->d`
  187.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
  188.    */
  189. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
  190.              BN_CTX *ctx)
  191.   {

crypto/rsa/rsa_ossl.c:817:14: Call
815.   
816.           /* compute I mod p */
817.           if (!BN_mod(r1, c, rsa->p, ctx)) {
                    ^
818.               BN_free(local_c);
819.               goto err;

crypto/bn/bn_div.c:189:1: Parameter `*dv->d`
  187.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
  188.    */
  189. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
  190.              BN_CTX *ctx)
  191.   {

crypto/rsa/rsa_ossl.c:869:14: Call
867.               pr1 = r1;
868.           }
869.           if (!BN_mod(r0, pr1, rsa->p, ctx)) {
                    ^
870.               BN_free(local_r1);
871.               goto err;

crypto/bn/bn_div.c:243:11: Call
  241.   
  242.       BN_CTX_start(ctx);
  243.       tmp = BN_CTX_get(ctx);
                   ^
  244.       snum = BN_CTX_get(ctx);
  245.       sdiv = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:284:5: Call
    282.       }
    283.       /* OK, make sure the returned bignum is "zero" */
    284.       BN_zero(ret);
               ^
    285.       ctx->used++;
    286.       CTXDBG_RET(ctx, ret);

crypto/bn/bn_lib.c:530:1: Parameter `*a->d`
      528.   }
      529.   
      530. > int BN_set_word(BIGNUM *a, BN_ULONG w)
      531.   {
      532.       bn_check_top(a);

crypto/bn/bn_div.c:462:9: Call
  460.            */
  461.           int neg = num->neg;
  462.           BN_rshift(rm, snum, norm_shift);
                 ^
  463.           if (!BN_is_zero(rm))
  464.               rm->neg = neg;

crypto/bn/bn_shift.c:169:1: <Offset trace>
167.   }
168.   
169. > int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
170.   {
171.       int i, j, nw, lb, rb;

crypto/bn/bn_shift.c:169:1: Parameter `a->top`
    167.   }
    168.   
    169. > int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
    170.   {
    171.       int i, j, nw, lb, rb;

crypto/bn/bn_shift.c:169:1: <Length trace>
167.   }
168.   
169. > int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
170.   {
171.       int i, j, nw, lb, rb;

crypto/bn/bn_shift.c:169:1: Parameter `*a->d`
    167.   }
    168.   
    169. > int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
    170.   {
    171.       int i, j, nw, lb, rb;

crypto/bn/bn_shift.c:200:5: Array access: Offset: [0, 191] Size: [0, 8388607] by call to `BN_div` 
    198.       }
    199.   
    200.       f = &(a->d[nw]);
               ^
    201.       t = r->d;
    202.       j = a->top - nw;
