crypto/dsa/dsa_ameth.c:264: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607] by call to `BN_mod_exp`.
Showing all 12 steps of the trace


crypto/dsa/dsa_ameth.c:250:13: Call
248.       /* We have parameters now set private key */
249.       if ((dsa->priv_key = BN_secure_new()) == NULL
250.           || !ASN1_INTEGER_to_BN(privkey, dsa->priv_key)) {
                   ^
251.           DSAerr(DSA_F_DSA_PRIV_DECODE, DSA_R_BN_ERROR);
252.           goto dsaerr;

crypto/asn1/a_int.c:628:12: Call
  626.   BIGNUM *ASN1_INTEGER_to_BN(const ASN1_INTEGER *ai, BIGNUM *bn)
  627.   {
  628.       return asn1_string_to_bn(ai, bn, V_ASN1_INTEGER);
                    ^
  629.   }
  630.   

crypto/asn1/a_int.c:562:1: Parameter `bn->d`
    560.   }
    561.   
    562. > static BIGNUM *asn1_string_to_bn(const ASN1_INTEGER *ai, BIGNUM *bn,
    563.                                    int itype)
    564.   {

crypto/dsa/dsa_ameth.c:264:10: Call
262.       }
263.   
264.       if (!BN_mod_exp(dsa->pub_key, dsa->g, dsa->priv_key, dsa->p, ctx)) {
                ^
265.           DSAerr(DSA_F_DSA_PRIV_DECODE, DSA_R_BN_ERROR);
266.           goto dsaerr;

crypto/bn/bn_exp.c:190:1: Parameter `*m->d`
  188.   }
  189.   
  190. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
  191.                  BN_CTX *ctx)
  192.   {

crypto/bn/bn_exp.c:255:15: Call
  253.   #ifdef RECP_MUL_MOD
  254.       {
  255.           ret = BN_mod_exp_recp(r, a, p, m, ctx);
                       ^
  256.       }
  257.   #else

crypto/bn/bn_exp.c:267:1: Parameter `*m->d`
    265.   }
    266.   
    267. > int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
    268.                       const BIGNUM *m, BN_CTX *ctx)
    269.   {

crypto/bn/bn_exp.c:304:14: Call
    302.       if (m->neg) {
    303.           /* ignore sign of 'm' */
    304.           if (!BN_copy(aa, m))
                        ^
    305.               goto err;
    306.           aa->neg = 0;

crypto/bn/bn_lib.c:419:1: <Length trace>
417.   }
418.   
419. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
420.   {
421.       int i;

crypto/bn/bn_lib.c:419:1: Parameter `*b->d`
      417.   }
      418.   
      419. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      420.   {
      421.       int i;

crypto/bn/bn_lib.c:434:5: Assignment
      432.   #if 1
      433.       A = a->d;
      434.       B = b->d;
                 ^
      435.       for (i = b->top >> 2; i > 0; i--, A += 4, B += 4) {
      436.           BN_ULONG a0, a1, a2, a3;

crypto/bn/bn_lib.c:440:14: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607] by call to `BN_mod_exp` 
      438.           a1 = B[1];
      439.           a2 = B[2];
      440.           a3 = B[3];
                          ^
      441.           A[0] = a0;
      442.           A[1] = a1;
