crypto/rsa/rsa_eay.c:428: error: BUFFER_OVERRUN_L3
  Offset: 1 Size: [0, +oo] by call to `BN_MONT_CTX_set`.
Showing all 14 steps of the trace


crypto/rsa/rsa_eay.c:421:10: Call
419.   			{
420.   			if ((rsa->_method_mod_p=BN_MONT_CTX_new()) != NULL)
421.   				if (!BN_MONT_CTX_set(rsa->_method_mod_p,rsa->p,
                ^
422.   						     ctx))
423.   					goto err;

crypto/bn/bn_mont.c:301:1: Parameter `*mont->RR.d`
  299.   	}
  300.   
  301. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
  302.   	{
  303.   	BIGNUM Ri,*R;

crypto/bn/bn_mont.c:319:3: Call
  317.   
  318.   		mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2;
  319.   		BN_zero(R);
           ^
  320.   		BN_set_bit(R,BN_BITS2);
  321.   		/* I was bad, this modification of a passed variable was

crypto/bn/bn_lib.c:567:1: Parameter `*a->d`
    565.   	}
    566.   
    567. > int BN_set_word(BIGNUM *a, BN_ULONG w)
    568.   	{
    569.   	int i,n;

crypto/bn/bn_mont.c:320:3: Call
  318.   		mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2;
  319.   		BN_zero(R);
  320.   		BN_set_bit(R,BN_BITS2);
           ^
  321.   		/* I was bad, this modification of a passed variable was
  322.   		 * breaking the multithreaded stuff :-(

crypto/bn/bn_lib.c:709:1: Parameter `*a->d`
    707.   	}
    708.   
    709. > int BN_set_bit(BIGNUM *a, int n)
    710.   	{
    711.   	int i,j,k;

crypto/rsa/rsa_eay.c:428:10: Call
426.   			{
427.   			if ((rsa->_method_mod_q=BN_MONT_CTX_new()) != NULL)
428.   				if (!BN_MONT_CTX_set(rsa->_method_mod_q,rsa->q,
                ^
429.   						     ctx))
430.   					goto err;

crypto/bn/bn_mont.c:301:1: Parameter `*mont->RR.d`
  299.   	}
  300.   
  301. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
  302.   	{
  303.   	BIGNUM Ri,*R;

crypto/bn/bn_mont.c:319:3: Call
  317.   
  318.   		mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2;
  319.   		BN_zero(R);
           ^
  320.   		BN_set_bit(R,BN_BITS2);
  321.   		/* I was bad, this modification of a passed variable was

crypto/bn/bn_lib.c:572:2: <Offset trace>
570.   	if (bn_expand(a,sizeof(BN_ULONG)*8) == NULL) return(0);
571.   
572.   	n=sizeof(BN_ULONG)/BN_BYTES;
        ^
573.   	a->neg=0;
574.   	a->top=0;

crypto/bn/bn_lib.c:572:2: Assignment
    570.   	if (bn_expand(a,sizeof(BN_ULONG)*8) == NULL) return(0);
    571.   
    572.   	n=sizeof(BN_ULONG)/BN_BYTES;
            ^
    573.   	a->neg=0;
    574.   	a->top=0;

crypto/bn/bn_lib.c:567:1: <Length trace>
565.   	}
566.   
567. > int BN_set_word(BIGNUM *a, BN_ULONG w)
568.   	{
569.   	int i,n;

crypto/bn/bn_lib.c:567:1: Parameter `*a->d`
    565.   	}
    566.   
    567. > int BN_set_word(BIGNUM *a, BN_ULONG w)
    568.   	{
    569.   	int i,n;

crypto/bn/bn_lib.c:588:3: Array access: Offset: 1 Size: [0, +oo] by call to `BN_MONT_CTX_set` 
    586.   		w=0;
    587.   #endif
    588.   		a->d[i]=(BN_ULONG)w&BN_MASK2;
             ^
    589.   		if (a->d[i] != 0) a->top=i+1;
    590.   		}
