crypto/dsa/dsa_gen.c:302: error: BUFFER_OVERRUN_L3
  Offset: [4, +oo] (⇐ [0, +oo] + 4) Size: [0, 8388607] by call to `BN_mod_exp_mont`.
Showing all 17 steps of the trace


crypto/dsa/dsa_gen.c:145:10: Call
143.       BN_CTX_start(ctx);
144.   
145.       r0 = BN_CTX_get(ctx);
                ^
146.       g = BN_CTX_get(ctx);
147.       W = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:284:5: Call
  282.       }
  283.       /* OK, make sure the returned bignum is "zero" */
  284.       BN_zero(ret);
             ^
  285.       ctx->used++;
  286.       CTXDBG_RET(ctx, ret);

crypto/bn/bn_lib.c:530:1: Parameter `*a->d`
    528.   }
    529.   
    530. > int BN_set_word(BIGNUM *a, BN_ULONG w)
    531.   {
    532.       bn_check_top(a);

crypto/dsa/dsa_gen.c:302:14: Call
300.       for (;;) {
301.           /* g=test^r0%p */
302.           if (!BN_mod_exp_mont(g, test, r0, p, ctx, mont))
                    ^
303.               goto err;
304.           if (!BN_is_one(g))

crypto/bn/bn_exp.c:401:1: Parameter `*a->d`
  399.   }
  400.   
  401. > int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
  402.                       const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
  403.   {

crypto/bn/bn_exp.c:467:10: Call
  465.           goto err;
  466.       }
  467.       if (!BN_to_montgomery(val[0], aa, mont, ctx))
                  ^
  468.           goto err;               /* 1 */
  469.   

crypto/bn/bn_lib.c:924:1: Parameter `*a->d`
    922.   }
    923.   
    924. > int BN_to_montgomery(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont,
    925.                        BN_CTX *ctx)
    926.   {

crypto/bn/bn_lib.c:927:12: Call
    925.                        BN_CTX *ctx)
    926.   {
    927.       return BN_mod_mul_montgomery(r, a, &(mont->RR), mont, ctx);
                      ^
    928.   }
    929.   

crypto/bn/bn_mont.c:128:1: Parameter `*a->d`
      126.   #endif
      127.   
      128. > int BN_mod_mul_montgomery(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
      129.                             BN_MONT_CTX *mont, BN_CTX *ctx)
      130.   {

crypto/bn/bn_mont.c:158:14: Call
      156.               goto err;
      157.       } else {
      158.           if (!BN_mul(tmp, a, b, ctx))
                          ^
      159.               goto err;
      160.       }

crypto/bn/bn_mul.c:883:1: Parameter `*a->d`
        881.   #endif                          /* BN_RECURSION */
        882.   
        883. > int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
        884.   {
        885.       int ret = 0;

crypto/bn/bn_mul.c:964:17: Call
        962.                   if (bn_wexpand(rr, k * 4) == NULL)
        963.                       goto err;
        964.                   bn_mul_part_recursive(rr->d, a->d, b->d,
                               ^
        965.                                         j, al - j, bl - j, t->d);
        966.               } else {            /* al <= j || bl <= j */

crypto/bn/bn_mul.c:534:1: Parameter `*a`
          532.    */
          533.   /* tnX may not be negative but less than n */
          534. > void bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n,
          535.                              int tna, int tnb, BN_ULONG *t)
          536.   {

crypto/bn/bn_mul.c:542:9: Call
          540.   
          541.       if (n < 8) {
          542.           bn_mul_normal(r, a, n + tna, b, n + tnb);
                         ^
          543.           return;
          544.       }

crypto/bn/bn_mul.c:1037:1: <Length trace>
1035.   }
1036.   
1037. > void bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb)
1038.   {
1039.       BN_ULONG *rr;

crypto/bn/bn_mul.c:1037:1: Parameter `*b`
            1035.   }
            1036.   
            1037. > void bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb)
            1038.   {
            1039.       BN_ULONG *rr;

crypto/bn/bn_mul.c:1072:50: Array access: Offset: [4, +oo] (⇐ [0, +oo] + 4) Size: [0, 8388607] by call to `BN_mod_exp_mont` 
            1070.           if (--nb <= 0)
            1071.               return;
            1072.           rr[4] = bn_mul_add_words(&(r[4]), a, na, b[4]);
                                                                     ^
            1073.           rr += 4;
            1074.           r += 4;
