crypto/pem/pvkfmt.c:282: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_mod_exp`.
Showing all 17 steps of the trace


crypto/pem/pvkfmt.c:259:10: Call
257.       if (dsa == NULL || ret == NULL)
258.           goto memerr;
259.       if (!read_lebn(&p, nbyte, &pbn))
                ^
260.           goto memerr;
261.   

crypto/pem/pvkfmt.c:47:10: Call
  45.   static int read_lebn(const unsigned char **in, unsigned int nbyte, BIGNUM **r)
  46.   {
  47.       *r = BN_lebin2bn(*in, nbyte, NULL);
                 ^
  48.       if (*r == NULL)
  49.           return 0;

crypto/bn/bn_lib.c:506:9: Assignment
    504.       n = len;
    505.       if (n == 0) {
    506.           ret->top = 0;
                   ^
    507.           return ret;
    508.       }

crypto/pem/pvkfmt.c:282:14: Call
280.               goto memerr;
281.   
282.           if (!BN_mod_exp(pub_key, gbn, priv_key, pbn, ctx))
                    ^
283.               goto memerr;
284.   

crypto/bn/bn_exp.c:91:1: Parameter `m->top`
  89.   }
  90.   
  91. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
  92.                  BN_CTX *ctx)
  93.   {

crypto/bn/bn_exp.c:136:9: Call
  134.   
  135.   #ifdef MONT_MUL_MOD
  136.       if (BN_is_odd(m)) {
                 ^
  137.   # ifdef MONT_EXP_WORD
  138.           if (a->top == 1 && !a->neg

crypto/bn/bn_lib.c:867:1: Parameter `a->top`
    865.   }
    866.   
    867. > int BN_is_odd(const BIGNUM *a)
    868.   {
    869.       return (a->top > 0) && (a->d[0] & 1);

crypto/bn/bn_exp.c:149:15: Call
  147.   #ifdef RECP_MUL_MOD
  148.       {
  149.           ret = BN_mod_exp_recp(r, a, p, m, ctx);
                       ^
  150.       }
  151.   #else

crypto/bn/bn_exp.c:161:1: Parameter `m->top`
    159.   }
    160.   
    161. > int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
    162.                       const BIGNUM *m, BN_CTX *ctx)
    163.   {

crypto/bn/bn_exp.c:198:14: Call
    196.       if (m->neg) {
    197.           /* ignore sign of 'm' */
    198.           if (!BN_copy(aa, m))
                        ^
    199.               goto err;
    200.           aa->neg = 0;

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
      321.   }
      322.   
      323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      324.   {
      325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
      321.   }
      322.   
      323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      324.   {
      325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
      327.       if (a == b)
      328.           return a;
      329.       if (bn_wexpand(a, b->top) == NULL)
                     ^
      330.           return NULL;
      331.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
        946.   }
        947.   
        948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
        949.   {
        950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_mod_exp` 
      331.   
      332.       if (b->top > 0)
      333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      334.   
      335.       a->top = b->top;
