crypto/rsa/rsa_chk.c:103: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `BN_mul`.
Showing all 19 steps of the trace


crypto/rsa/rsa_chk.c:85:9: Call
83.   
84.       /* p prime? */
85.       r = BN_is_prime_ex(key->p, BN_prime_checks, NULL, cb);
              ^
86.       if (r != 1) {
87.           ret = r;

crypto/bn/bn_prime.c:293:1: Parameter `ctx_passed->stack.depth`
  291.   }
  292.   
  293. > int BN_is_prime_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed,
  294.                      BN_GENCB *cb)
  295.   {

crypto/bn/bn_prime.c:296:12: Call
  294.                      BN_GENCB *cb)
  295.   {
  296.       return BN_is_prime_fasttest_ex(a, checks, ctx_passed, 0, cb);
                    ^
  297.   }
  298.   

crypto/bn/bn_prime.c:299:1: Parameter `ctx_passed->stack.depth`
    297.   }
    298.   
    299. > int BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed,
    300.                               int do_trial_division, BN_GENCB *cb)
    301.   {

crypto/rsa/rsa_chk.c:94:9: Call
92.   
93.       /* q prime? */
94.       r = BN_is_prime_ex(key->q, BN_prime_checks, NULL, cb);
              ^
95.       if (r != 1) {
96.           ret = r;

crypto/bn/bn_prime.c:293:1: Parameter `ctx_passed->stack.depth`
  291.   }
  292.   
  293. > int BN_is_prime_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed,
  294.                      BN_GENCB *cb)
  295.   {

crypto/bn/bn_prime.c:296:12: Call
  294.                      BN_GENCB *cb)
  295.   {
  296.       return BN_is_prime_fasttest_ex(a, checks, ctx_passed, 0, cb);
                    ^
  297.   }
  298.   

crypto/bn/bn_prime.c:299:1: Parameter `ctx_passed->stack.depth`
    297.   }
    298.   
    299. > int BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx_passed,
    300.                               int do_trial_division, BN_GENCB *cb)
    301.   {

crypto/rsa/rsa_chk.c:103:9: Call
101.   
102.       /* n = p*q? */
103.       r = BN_mul(i, key->p, key->q, ctx);
               ^
104.       if (!r) {
105.           ret = -1;

crypto/bn/bn_mul.c:908:5: Call
  906.       top = al + bl;
  907.   
  908.       BN_CTX_start(ctx);
             ^
  909.       if ((r == a) || (r == b)) {
  910.           if ((rr = BN_CTX_get(ctx)) == NULL)

crypto/bn/bn_ctx.c:235:1: Parameter `*ctx->stack.indexes`
    233.   }
    234.   
    235. > void BN_CTX_start(BN_CTX *ctx)
    236.   {
    237.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_mul.c:1032:5: Call
  1030.    err:
  1031.       bn_check_top(r);
  1032.       BN_CTX_end(ctx);
              ^
  1033.       return (ret);
  1034.   }

crypto/bn/bn_ctx.c:249:1: Parameter `*ctx->stack.indexes`
    247.   }
    248.   
    249. > void BN_CTX_end(BN_CTX *ctx)
    250.   {
    251.       CTXDBG_ENTRY("BN_CTX_end", ctx);

crypto/bn/bn_ctx.c:255:27: Call
    253.           ctx->err_stack--;
    254.       else {
    255.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                     ^
    256.           /* Does this stack frame have anything to release? */
    257.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:325:1: <Offset trace>
323.   }
324.   
325. > static unsigned int BN_STACK_pop(BN_STACK *st)
326.   {
327.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:325:1: Parameter `st->depth`
      323.   }
      324.   
      325. > static unsigned int BN_STACK_pop(BN_STACK *st)
      326.   {
      327.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:325:1: <Length trace>
323.   }
324.   
325. > static unsigned int BN_STACK_pop(BN_STACK *st)
326.   {
327.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:325:1: Parameter `*st->indexes`
      323.   }
      324.   
      325. > static unsigned int BN_STACK_pop(BN_STACK *st)
      326.   {
      327.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:327:12: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `BN_mul` 
      325.   static unsigned int BN_STACK_pop(BN_STACK *st)
      326.   {
      327.       return st->indexes[--(st->depth)];
                        ^
      328.   }
      329.   
