crypto/pem/pvkfmt.c:284: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, 8388607] by call to `BN_mod_exp`.
Showing all 11 steps of the trace


crypto/pem/pvkfmt.c:261:10: Call
259.       if (dsa == NULL || ret == NULL)
260.           goto memerr;
261.       if (!read_lebn(&p, nbyte, &pbn))
                ^
262.           goto memerr;
263.   

crypto/pem/pvkfmt.c:47:10: Call
  45.   static int read_lebn(const unsigned char **in, unsigned int nbyte, BIGNUM **r)
  46.   {
  47.       *r = BN_lebin2bn(*in, nbyte, NULL);
                 ^
  48.       if (*r == NULL)
  49.           return 0;

crypto/bn/bn_lib.c:490:9: Assignment
    488.       n = len;
    489.       if (n == 0) {
    490.           ret->top = 0;
                   ^
    491.           return ret;
    492.       }

crypto/pem/pvkfmt.c:284:14: Call
282.               goto memerr;
283.   
284.           if (!BN_mod_exp(pub_key, gbn, priv_key, pbn, ctx))
                    ^
285.               goto memerr;
286.   

crypto/bn/bn_exp.c:89:1: Parameter `*m->d`
  87.   }
  88.   
  89. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
  90.                  BN_CTX *ctx)
  91.   {

crypto/bn/bn_exp.c:144:19: Call
  142.           } else
  143.   # endif
  144.               ret = BN_mod_exp_mont(r, a, p, m, ctx, NULL);
                           ^
  145.       } else
  146.   #endif

crypto/bn/bn_exp.c:388:14: <Offset trace>
386.           /* 2^(top*BN_BITS2) - m */
387.           r->d[0] = (0 - m->d[0]) & BN_MASK2;
388.           for (i = 1; i < j; i++)
                    ^
389.               r->d[i] = (~m->d[i]) & BN_MASK2;
390.           r->top = j;

crypto/bn/bn_exp.c:388:14: Assignment
    386.           /* 2^(top*BN_BITS2) - m */
    387.           r->d[0] = (0 - m->d[0]) & BN_MASK2;
    388.           for (i = 1; i < j; i++)
                        ^
    389.               r->d[i] = (~m->d[i]) & BN_MASK2;
    390.           r->top = j;

crypto/bn/bn_exp.c:296:1: <Length trace>
294.   }
295.   
296. > int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
297.                       const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
298.   {

crypto/bn/bn_exp.c:296:1: Parameter `*m->d`
    294.   }
    295.   
    296. > int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
    297.                       const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
    298.   {

crypto/bn/bn_exp.c:389:25: Array access: Offset: [1, +oo] Size: [0, 8388607] by call to `BN_mod_exp` 
    387.           r->d[0] = (0 - m->d[0]) & BN_MASK2;
    388.           for (i = 1; i < j; i++)
    389.               r->d[i] = (~m->d[i]) & BN_MASK2;
                                   ^
    390.           r->top = j;
    391.           r->flags |= BN_FLG_FIXED_TOP;
