crypto/dsa/dsa_ossl.c:139: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `BN_add`.
Showing all 10 steps of the trace


crypto/dsa/dsa_ossl.c:135:6: Call
133.   		}
134.   
135.   	if (BN_bin2bn(dgst,dlen,&m) == NULL) goto err;
            ^
136.   
137.   	/* Compute  s = inv(k) (m + xr) mod q */

crypto/bn/bn_lib.c:603:23: Call
  601.   	BN_ULONG l;
  602.   
  603.   	if (ret == NULL) ret=BN_new();
                               ^
  604.   	if (ret == NULL) return(NULL);
  605.   	l=0;

crypto/bn/bn_lib.c:303:2: Assignment
    301.   	ret->neg=0;
    302.   	ret->max=0;
    303.   	ret->d=NULL;
            ^
    304.   	return(ret);
    305.   	}

crypto/dsa/dsa_ossl.c:139:7: Call
137.   	/* Compute  s = inv(k) (m + xr) mod q */
138.   	if (!BN_mod_mul(&xr,dsa->priv_key,r,dsa->q,ctx)) goto err;/* s = xr */
139.   	if (!BN_add(s, &xr, &m)) goto err;		/* s = m + xr */
             ^
140.   	if (BN_cmp(s,dsa->q) > 0)
141.   		BN_sub(s,s,dsa->q);

crypto/bn/bn_add.c:64:1: Parameter `*r->d`
  62.   
  63.   /* r can == a or b */
  64. > int BN_add(BIGNUM *r, BIGNUM *a, BIGNUM *b)
  65.   	{
  66.   	BIGNUM *tmp;

crypto/bn/bn_add.c:86:9: Call
  84.   		if (BN_ucmp(a,b) < 0)
  85.   			{
  86.   			if (!BN_usub(r,b,a)) return(0);
                ^
  87.   			r->neg=1;
  88.   			}

crypto/bn/bn_add.c:167:1: <Length trace>
165.   
166.   /* unsigned subtraction of b from a, a must be larger than b. */
167. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
168.   	{
169.   	int max,min;

crypto/bn/bn_add.c:167:1: Parameter `*r->d`
    165.   
    166.   /* unsigned subtraction of b from a, a must be larger than b. */
    167. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
    168.   	{
    169.   	int max,min;

crypto/bn/bn_add.c:191:2: Assignment
    189.   	ap=a->d;
    190.   	bp=b->d;
    191.   	rp=r->d;
            ^
    192.   
    193.   #if 1

crypto/bn/bn_add.c:246:4: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `BN_add` 
    244.   			rp[2]=ap[2];
    245.   			if (i++ >= max) break;
    246.   			rp[3]=ap[3];
              ^
    247.   			rp+=4;
    248.   			ap+=4;
