crypto/bn/bn_exp.c:351: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `BN_mod_mul_montgomery`.
Showing all 13 steps of the trace


crypto/bn/bn_exp.c:346:3: Call
344.   	if (BN_ucmp(a,m) >= 0)
345.   		{
346.   		BN_mod(&(val[0]),a,m,ctx);
         ^
347.   		aa= &(val[0]);
348.   		}

crypto/bn/bn_div.c:287:1: Parameter `*rem->d`
  285.   
  286.   /* rem != m */
  287. > int BN_mod(BIGNUM *rem, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
  288.   	{
  289.   #if 0 /* The old slow way */

crypto/bn/bn_div.c:313:9: Call
  311.   	return(1);
  312.   #else
  313.   	return(BN_div(NULL,rem,m,d,ctx));
                 ^
  314.   #endif
  315.   	}

crypto/bn/bn_div.c:121:1: Parameter `*rm->d`
    119.   #else
    120.   
    121. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
    122.   	   BN_CTX *ctx)
    123.   	{

crypto/bn/bn_exp.c:351:7: Call
349.   	else
350.   		aa=a;
351.   	if (!BN_to_montgomery(&(val[0]),aa,mont,ctx)) goto err; /* 1 */
             ^
352.   	if (!BN_mod_mul_montgomery(d,&(val[0]),&(val[0]),mont,ctx)) goto err; /* 2 */
353.   

crypto/bn/bn_mont.c:71:1: Parameter `*r->d`
  69.   #define MONT_WORD
  70.   
  71. > int BN_mod_mul_montgomery(BIGNUM *r, BIGNUM *a, BIGNUM *b,
  72.   			  BN_MONT_CTX *mont, BN_CTX *ctx)
  73.   	{

crypto/bn/bn_mont.c:101:7: Call
  99.   		}
  100.   	/* reduce from aRR to aR */
  101.   	if (!BN_from_montgomery(r,tmp,mont,ctx)) goto err;
               ^
  102.   	ctx->tos-=2;
  103.   	return(1);

crypto/bn/bn_mont.c:184:8: <Offset trace>
182.   		ret->top=al;
183.   		al-=4;
184.   		for (i=0; i<al; i+=4)
              ^
185.   			{
186.   			BN_ULONG t1,t2,t3,t4;

crypto/bn/bn_mont.c:184:8: Assignment
    182.   		ret->top=al;
    183.   		al-=4;
    184.   		for (i=0; i<al; i+=4)
                  ^
    185.   			{
    186.   			BN_ULONG t1,t2,t3,t4;

crypto/bn/bn_mont.c:108:1: <Length trace>
106.   	}
107.   
108. > int BN_from_montgomery(BIGNUM *ret, BIGNUM *a, BN_MONT_CTX *mont,
109.   	     BN_CTX *ctx)
110.   	{

crypto/bn/bn_mont.c:108:1: Parameter `*ret->d`
    106.   	}
    107.   
    108. > int BN_from_montgomery(BIGNUM *ret, BIGNUM *a, BN_MONT_CTX *mont,
    109.   	     BN_CTX *ctx)
    110.   	{

crypto/bn/bn_mont.c:176:3: Assignment
    174.   #else
    175.   		x=ri;
    176.   		rp=ret->d;
             ^
    177.   		ap= &(r->d[x]);
    178.   		if (r->top < x)

crypto/bn/bn_mont.c:193:4: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `BN_mod_mul_montgomery` 
    191.   			t4=ap[i+3];
    192.   			rp[i+0]=t1;
    193.   			rp[i+1]=t2;
              ^
    194.   			rp[i+2]=t3;
    195.   			rp[i+3]=t4;
