crypto/evp/evp_pkey.c:165: error: BUFFER_OVERRUN_L1
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: 4 by call to `BN_mod_exp`.
Showing all 13 steps of the trace


crypto/evp/evp_pkey.c:154:24: Call
152.   		}
153.   		/* Calculate public key (ouch!) */
154.   		if (!(dsa->pub_key = BN_new())) {
                              ^
155.   			EVPerr(EVP_F_EVP_PKCS82PKEY,ERR_R_MALLOC_FAILURE);
156.   			DSA_free (dsa);

crypto/bn/bn_lib.c:300:2: Assignment
  298.   		}
  299.   	ret->flags=BN_FLG_MALLOCED;
  300.   	ret->top=0;
          ^
  301.   	ret->neg=0;
  302.   	ret->max=0;

crypto/evp/evp_pkey.c:165:8: Call
163.   		}
164.   			
165.   		if (!BN_mod_exp(dsa->pub_key, dsa->g,
              ^
166.   						 dsa->priv_key, dsa->p, ctx)) {
167.   			

crypto/bn/bn_exp.c:157:1: Parameter `r->top`
  155.   	}
  156.   
  157. > int BN_mod_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m, BN_CTX *ctx)
  158.   	{
  159.   	int ret;

crypto/bn/bn_exp.c:177:9: Call
  175.   #endif
  176.   #ifdef RECP_MUL_MOD
  177.   		{ ret=BN_mod_exp_recp(r,a,p,m,ctx); }
                 ^
  178.   #else
  179.   		{ ret=BN_mod_exp_simple(r,a,p,m,ctx); }

crypto/bn/bn_exp.c:186:1: Parameter `r->top`
    184.   
    185.   /* #ifdef RECP_MUL_MOD */
    186. > int BN_mod_exp_recp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m, BN_CTX *ctx)
    187.   	{
    188.   	int i,j,bits,ret=0,wstart,wend,window,wvalue;

crypto/bn/bn_exp.c:199:3: Call
    197.   	if (bits == 0)
    198.   		{
    199.   		BN_one(r);
             ^
    200.   		return(1);
    201.   		}

crypto/bn/bn_lib.c:548:1: Parameter `a->top`
      546.   	}
      547.   
      548. > int BN_set_word(BIGNUM *a, BN_ULONG w)
      549.   	{
      550.   	int i,n;

crypto/bn/bn_lib.c:551:6: Call
      549.   	{
      550.   	int i,n;
      551.   	if (bn_expand(a,sizeof(BN_ULONG)*8) == NULL) return(0);
                  ^
      552.   
      553.   	n=sizeof(BN_ULONG)/BN_BYTES;

crypto/bn/bn_lib.c:344:1: <Length trace>
342.   	}
343.   
344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
345.   	{
346.   	BN_ULONG *A,*B,*a;

crypto/bn/bn_lib.c:344:1: Parameter `b->top`
        342.   	}
        343.   
        344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
        345.   	{
        346.   	BN_ULONG *A,*B,*a;

crypto/bn/bn_lib.c:418:3: Assignment
        416.   		/* Now need to zero any data between b->top and b->max */
        417.   
        418.   		B= &(b->d[b->top]);
                 ^
        419.   		j=(b->max - b->top) & ~7;
        420.   		for (i=0; i<j; i+=8)

crypto/bn/bn_lib.c:423:28: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: 4 by call to `BN_mod_exp` 
        421.   			{
        422.   			B[0]=0; B[1]=0; B[2]=0; B[3]=0;
        423.   			B[4]=0; B[5]=0; B[6]=0; B[7]=0;
                                          ^
        424.   			B+=8;
        425.   			}
