crypto/dsa/dsa_ossl.c:200: error: BUFFER_OVERRUN_L1
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: 1 by call to `BN_mod`.
Showing all 11 steps of the trace


crypto/dsa/dsa_ossl.c:178:9: Call
176.   
177.   	BN_init(&k);
178.   	if ((r=BN_new()) == NULL) goto err;
               ^
179.   	kinv=NULL;
180.   

crypto/bn/bn_lib.c:300:2: Assignment
  298.   		}
  299.   	ret->flags=BN_FLG_MALLOCED;
  300.   	ret->top=0;
          ^
  301.   	ret->neg=0;
  302.   	ret->max=0;

crypto/dsa/dsa_ossl.c:200:7: Call
198.   	if (!dsa->meth->bn_mod_exp(dsa, r,dsa->g,&k,dsa->p,ctx,
199.   		(BN_MONT_CTX *)dsa->method_mont_p)) goto err;
200.   	if (!BN_mod(r,r,dsa->q,ctx)) goto err;
             ^
201.   
202.   	/* Compute  part of 's = inv(k) (m + xr) mod q' */

crypto/bn/bn_div.c:329:1: Parameter `m->top`
  327.   
  328.   /* rem != m */
  329. > int BN_mod(BIGNUM *rem, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
  330.   	{
  331.   #if 0 /* The old slow way */

crypto/bn/bn_div.c:355:9: Call
  353.   	return(1);
  354.   #else
  355.   	return(BN_div(NULL,rem,m,d,ctx));
                 ^
  356.   #endif
  357.   	}

crypto/bn/bn_div.c:121:1: Parameter `num->top`
    119.   #else
    120.   
    121. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
    122.   	   BN_CTX *ctx)
    123.   	{

crypto/bn/bn_div.c:142:10: Call
    140.   		{
    141.   		if (rm != NULL)
    142.   			{ if (BN_copy(rm,num) == NULL) return(0); }
                    ^
    143.   		if (dv != NULL) BN_zero(dv);
    144.   		return(1);

crypto/bn/bn_lib.c:501:1: <Length trace>
499.   	}
500.   
501. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
502.   	{
503.   	int i;

crypto/bn/bn_lib.c:501:1: Parameter `*a->d`
      499.   	}
      500.   
      501. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      502.   	{
      503.   	int i;

crypto/bn/bn_lib.c:513:2: Assignment
      511.   
      512.   #if 1
      513.   	A=a->d;
              ^
      514.   	B=b->d;
      515.   	for (i=b->top>>2; i>0; i--,A+=4,B+=4)

crypto/bn/bn_lib.c:519:30: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: 1 by call to `BN_mod` 
      517.   		BN_ULONG a0,a1,a2,a3;
      518.   		a0=B[0]; a1=B[1]; a2=B[2]; a3=B[3];
      519.   		A[0]=a0; A[1]=a1; A[2]=a2; A[3]=a3;
                                          ^
      520.   		}
      521.   	switch (b->top&3)
