crypto/rsa/rsa_eay.c:428: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `BN_MONT_CTX_set`.
Showing all 15 steps of the trace


crypto/rsa/rsa_eay.c:421:10: Call
419.   			{
420.   			if ((rsa->_method_mod_p=BN_MONT_CTX_new()) != NULL)
421.   				if (!BN_MONT_CTX_set(rsa->_method_mod_p,rsa->p,
                ^
422.   						     ctx))
423.   					goto err;

crypto/bn/bn_mont.c:301:1: Parameter `*mont->RR.d`
  299.   	}
  300.   
  301. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, BIGNUM *mod, BN_CTX *ctx)
  302.   	{
  303.   	BIGNUM Ri,*R;

crypto/bn/bn_mont.c:319:3: Call
  317.   
  318.   		mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2;
  319.   		BN_zero(R);
           ^
  320.   		BN_set_bit(R,BN_BITS2);
  321.   		/* I was bad, this modification of a passed variable was

crypto/bn/bn_lib.c:567:1: Parameter `*a->d`
    565.   	}
    566.   
    567. > int BN_set_word(BIGNUM *a, BN_ULONG w)
    568.   	{
    569.   	int i,n;

crypto/bn/bn_mont.c:320:3: Call
  318.   		mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2;
  319.   		BN_zero(R);
  320.   		BN_set_bit(R,BN_BITS2);
           ^
  321.   		/* I was bad, this modification of a passed variable was
  322.   		 * breaking the multithreaded stuff :-(

crypto/bn/bn_lib.c:709:1: Parameter `*a->d`
    707.   	}
    708.   
    709. > int BN_set_bit(BIGNUM *a, int n)
    710.   	{
    711.   	int i,j,k;

crypto/rsa/rsa_eay.c:428:10: Call
426.   			{
427.   			if ((rsa->_method_mod_q=BN_MONT_CTX_new()) != NULL)
428.   				if (!BN_MONT_CTX_set(rsa->_method_mod_q,rsa->q,
                ^
429.   						     ctx))
430.   					goto err;

crypto/bn/bn_mont.c:301:1: Parameter `*mont->RR.d`
  299.   	}
  300.   
  301. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, BIGNUM *mod, BN_CTX *ctx)
  302.   	{
  303.   	BIGNUM Ri,*R;

crypto/bn/bn_mont.c:319:3: Call
  317.   
  318.   		mont->ri=(BN_num_bits(mod)+(BN_BITS2-1))/BN_BITS2*BN_BITS2;
  319.   		BN_zero(R);
           ^
  320.   		BN_set_bit(R,BN_BITS2);
  321.   		/* I was bad, this modification of a passed variable was

crypto/bn/bn_lib.c:567:1: Parameter `*a->d`
    565.   	}
    566.   
    567. > int BN_set_word(BIGNUM *a, BN_ULONG w)
    568.   	{
    569.   	int i,n;

crypto/bn/bn_lib.c:570:6: Call
    568.   	{
    569.   	int i,n;
    570.   	if (bn_expand(a,sizeof(BN_ULONG)*8) == NULL) return(0);
                ^
    571.   
    572.   	n=sizeof(BN_ULONG)/BN_BYTES;

crypto/bn/bn_lib.c:344:1: <Length trace>
342.   	}
343.   
344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
345.   	{
346.   	BN_ULONG *A,*a;

crypto/bn/bn_lib.c:344:1: Parameter `*b->d`
      342.   	}
      343.   
      344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
      345.   	{
      346.   	BN_ULONG *A,*a;

crypto/bn/bn_lib.c:367:3: Assignment
      365.   			}
      366.   #if 1
      367.   		B=b->d;
               ^
      368.   		/* Check if the previous number needs to be copied */
      369.   		if (B != NULL)

crypto/bn/bn_lib.c:447:35: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, +oo] by call to `BN_MONT_CTX_set` 
      445.   				 */
      446.   				BN_ULONG a0,a1,a2,a3;
      447.   				a0=B[0]; a1=B[1]; a2=B[2]; a3=B[3];
                                               ^
      448.   				A[0]=a0; A[1]=a1; A[2]=a2; A[3]=a3;
      449.   				}
