crypto/bn/bn_exp.c:330: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `BN_mod_mul_reciprocal`.
Showing all 28 steps of the trace


crypto/bn/bn_exp.c:268:1: Parameter `ctx->stack.depth`
266.   }
267.   
268. > int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
269.                       const BIGNUM *m, BN_CTX *ctx)
270.   {

crypto/bn/bn_exp.c:296:5: Call
294.       }
295.   
296.       BN_CTX_start(ctx);
           ^
297.       aa = BN_CTX_get(ctx);
298.       val[0] = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:236:1: Parameter `ctx->stack.depth`
  234.   }
  235.   
  236. > void BN_CTX_start(BN_CTX *ctx)
  237.   {
  238.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_exp.c:315:10: Call
313.       }
314.   
315.       if (!BN_nnmod(val[0], a, m, ctx))
                ^
316.           goto err;               /* 1 */
317.       if (BN_is_zero(val[0])) {

crypto/bn/bn_mod.c:119:1: Parameter `ctx->stack.depth`
  117.   #include "bn_lcl.h"
  118.   
  119. > int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
  120.   {
  121.       /*

crypto/bn/bn_mod.c:126:11: Call
  124.        */
  125.   
  126.       if (!(BN_mod(r, m, d, ctx)))
                   ^
  127.           return 0;
  128.       if (!r->neg)

crypto/bn/bn_div.c:189:1: Parameter `ctx->stack.depth`
    187.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
    188.    */
    189. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
    190.              BN_CTX *ctx)
    191.   {

crypto/bn/bn_exp.c:325:14: Call
323.       window = BN_window_bits_for_exponent_size(bits);
324.       if (window > 1) {
325.           if (!BN_mod_mul_reciprocal(aa, val[0], val[0], &recp, ctx))
                    ^
326.               goto err;           /* 2 */
327.           j = 1 << (window - 1);

crypto/bn/bn_recp.c:103:1: Parameter `ctx->stack.depth`
  101.   }
  102.   
  103. > int BN_mod_mul_reciprocal(BIGNUM *r, const BIGNUM *x, const BIGNUM *y,
  104.                             BN_RECP_CTX *recp, BN_CTX *ctx)
  105.   {

crypto/bn/bn_recp.c:110:5: Call
  108.       const BIGNUM *ca;
  109.   
  110.       BN_CTX_start(ctx);
             ^
  111.       if ((a = BN_CTX_get(ctx)) == NULL)
  112.           goto err;

crypto/bn/bn_ctx.c:236:1: Parameter `ctx->stack.depth`
    234.   }
    235.   
    236. > void BN_CTX_start(BN_CTX *ctx)
    237.   {
    238.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_recp.c:127:5: Call
  125.       ret = BN_div_recp(NULL, r, ca, recp, ctx);
  126.    err:
  127.       BN_CTX_end(ctx);
             ^
  128.       bn_check_top(r);
  129.       return (ret);

crypto/bn/bn_ctx.c:250:1: Parameter `ctx->stack.depth`
    248.   }
    249.   
    250. > void BN_CTX_end(BN_CTX *ctx)
    251.   {
    252.       CTXDBG_ENTRY("BN_CTX_end", ctx);

crypto/bn/bn_exp.c:330:18: Call
328.           for (i = 1; i < j; i++) {
329.               if (((val[i] = BN_CTX_get(ctx)) == NULL) ||
330.                   !BN_mod_mul_reciprocal(val[i], val[i - 1], aa, &recp, ctx))
                        ^
331.                   goto err;
332.           }

crypto/bn/bn_recp.c:103:1: Parameter `ctx->stack.depth`
  101.   }
  102.   
  103. > int BN_mod_mul_reciprocal(BIGNUM *r, const BIGNUM *x, const BIGNUM *y,
  104.                             BN_RECP_CTX *recp, BN_CTX *ctx)
  105.   {

crypto/bn/bn_recp.c:110:5: Call
  108.       const BIGNUM *ca;
  109.   
  110.       BN_CTX_start(ctx);
             ^
  111.       if ((a = BN_CTX_get(ctx)) == NULL)
  112.           goto err;

crypto/bn/bn_ctx.c:236:1: Parameter `ctx->stack.depth`
    234.   }
    235.   
    236. > void BN_CTX_start(BN_CTX *ctx)
    237.   {
    238.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_recp.c:115:18: Call
  113.       if (y != NULL) {
  114.           if (x == y) {
  115.               if (!BN_sqr(a, x, ctx))
                          ^
  116.                   goto err;
  117.           } else {

crypto/bn/bn_sqr.c:81:5: Call
    79.       }
    80.   
    81.       BN_CTX_start(ctx);
              ^
    82.       rr = (a != r) ? r : BN_CTX_get(ctx);
    83.       tmp = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:236:1: Parameter `*ctx->stack.indexes`
      234.   }
      235.   
      236. > void BN_CTX_start(BN_CTX *ctx)
      237.   {
      238.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_sqr.c:148:5: Call
    146.       bn_check_top(rr);
    147.       bn_check_top(tmp);
    148.       BN_CTX_end(ctx);
               ^
    149.       return (ret);
    150.   }

crypto/bn/bn_ctx.c:250:1: Parameter `*ctx->stack.indexes`
      248.   }
      249.   
      250. > void BN_CTX_end(BN_CTX *ctx)
      251.   {
      252.       CTXDBG_ENTRY("BN_CTX_end", ctx);

crypto/bn/bn_ctx.c:256:27: Call
      254.           ctx->err_stack--;
      255.       else {
      256.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                       ^
      257.           /* Does this stack frame have anything to release? */
      258.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:326:1: <Offset trace>
324.   }
325.   
326. > static unsigned int BN_STACK_pop(BN_STACK *st)
327.   {
328.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:326:1: Parameter `st->depth`
        324.   }
        325.   
        326. > static unsigned int BN_STACK_pop(BN_STACK *st)
        327.   {
        328.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:326:1: <Length trace>
324.   }
325.   
326. > static unsigned int BN_STACK_pop(BN_STACK *st)
327.   {
328.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:326:1: Parameter `*st->indexes`
        324.   }
        325.   
        326. > static unsigned int BN_STACK_pop(BN_STACK *st)
        327.   {
        328.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:328:12: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `BN_mod_mul_reciprocal` 
        326.   static unsigned int BN_STACK_pop(BN_STACK *st)
        327.   {
        328.       return st->indexes[--(st->depth)];
                          ^
        329.   }
        330.   
