crypto/dsa/dsa_ossl.c:391: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607] by call to `BN_mod_mul`.
Showing all 19 steps of the trace


crypto/dsa/dsa_ossl.c:387:9: Call
385.            */
386.           dgst_len = (i >> 3);
387.       if (BN_bin2bn(dgst, dgst_len, u1) == NULL)
               ^
388.           goto err;
389.   

crypto/bn/bn_lib.c:542:1: Parameter `*ret->d`
  540.   }
  541.   
  542. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
  543.   {
  544.       unsigned int i, m;

crypto/dsa/dsa_ossl.c:391:10: Call
389.   
390.       /* u1 = M * w mod q */
391.       if (!BN_mod_mul(u1, u1, u2, dsa->q, ctx))
                ^
392.           goto err;
393.   

crypto/bn/bn_mod.c:179:1: Parameter `*r->d`
  177.   
  178.   /* slow but works */
  179. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
  180.                  BN_CTX *ctx)
  181.   {

crypto/bn/bn_mod.c:199:10: Call
  197.               goto err;
  198.       }
  199.       if (!BN_nnmod(r, t, m, ctx))
                  ^
  200.           goto err;
  201.       bn_check_top(r);

crypto/bn/bn_mod.c:119:1: Parameter `*r->d`
    117.   #include "bn_lcl.h"
    118.   
    119. > int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
    120.   {
    121.       /*

crypto/bn/bn_mod.c:126:11: Call
    124.        */
    125.   
    126.       if (!(BN_mod(r, m, d, ctx)))
                     ^
    127.           return 0;
    128.       if (!r->neg)

crypto/bn/bn_div.c:189:1: Parameter `*rm->d`
      187.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
      188.    */
      189. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
      190.              BN_CTX *ctx)
      191.   {

crypto/bn/bn_div.c:234:17: Call
      232.       if (!no_branch && BN_ucmp(num, divisor) < 0) {
      233.           if (rm != NULL) {
      234.               if (BN_copy(rm, num) == NULL)
                             ^
      235.                   return (0);
      236.           }

crypto/bn/bn_lib.c:429:1: Parameter `*a->d`
        427.   }
        428.   
        429. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        430.   {
        431.       int i;

crypto/bn/bn_lib.c:439:9: Call
        437.       if (a == b)
        438.           return (a);
        439.       if (bn_wexpand(a, b->top) == NULL)
                       ^
        440.           return (NULL);
        441.   

crypto/bn/bn_lib.c:995:1: Parameter `*a->d`
          993.   }
          994.   
          995. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
          996.   {
          997.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:997:37: Call
          995.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
          996.   {
          997.       return (words <= a->dmax) ? a : bn_expand2(a, words);
                                                      ^
          998.   }
          999.   

crypto/bn/bn_lib.c:390:1: Parameter `*b->d`
            388.    */
            389.   
            390. > BIGNUM *bn_expand2(BIGNUM *b, int words)
            391.   {
            392.       bn_check_top(b);

crypto/bn/bn_lib.c:395:23: Call
            393.   
            394.       if (words > b->dmax) {
            395.           BN_ULONG *a = bn_expand_internal(b, words);
                                         ^
            396.           if (!a)
            397.               return NULL;

crypto/bn/bn_lib.c:300:1: <Length trace>
298.   /* This is used by bn_expand2() */
299.   /* The caller MUST check that words > b->dmax before calling this */
300. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
301.   {
302.       BN_ULONG *A, *a = NULL;

crypto/bn/bn_lib.c:300:1: Parameter `*b->d`
              298.   /* This is used by bn_expand2() */
              299.   /* The caller MUST check that words > b->dmax before calling this */
              300. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
              301.   {
              302.       BN_ULONG *A, *a = NULL;

crypto/bn/bn_lib.c:335:5: Assignment
              333.   
              334.   #if 1
              335.       B = b->d;
                         ^
              336.       /* Check if the previous number needs to be copied */
              337.       if (B != NULL) {

crypto/bn/bn_lib.c:352:18: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607] by call to `BN_mod_mul` 
              350.               a1 = B[1];
              351.               a2 = B[2];
              352.               a3 = B[3];
                                      ^
              353.               A[0] = a0;
              354.               A[1] = a1;
