crypto/bn/bn_mont.c:333: error: BUFFER_OVERRUN_L1
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: 2 by call to `BN_mod_inverse`.
Showing all 11 steps of the trace


crypto/bn/bn_mont.c:329:3: Assignment
327.   		buf[1]=0;
328.   		tmod.d=buf;
329.   		tmod.top=1;
         ^
330.   		tmod.max=mod->max;
331.   		tmod.neg=mod->neg;

crypto/bn/bn_mont.c:333:8: Call
331.   		tmod.neg=mod->neg;
332.   
333.   		if ((BN_mod_inverse(&Ri,R,&tmod,ctx)) == NULL)
              ^
334.   			goto err;
335.   		BN_lshift(&Ri,&Ri,BN_BITS2);			/* R*Ri */

crypto/bn/bn_gcd.c:148:1: Parameter `n->top`
  146.   
  147.   /* solves ax == 1 (mod n) */
  148. > BIGNUM *BN_mod_inverse(BIGNUM *in, BIGNUM *a, BIGNUM *n, BN_CTX *ctx)
  149.   	{
  150.   	BIGNUM *A,*B,*X,*Y,*M,*D,*R;

crypto/bn/bn_gcd.c:173:6: Call
  171.   	BN_one(Y);
  172.   	if (BN_copy(A,a) == NULL) goto err;
  173.   	if (BN_copy(B,n) == NULL) goto err;
              ^
  174.   	sign=1;
  175.   

crypto/bn/bn_lib.c:454:1: Parameter `a->max`
    452.   	}
    453.   
    454. > BIGNUM *BN_copy(BIGNUM *a, BIGNUM *b)
    455.   	{
    456.   	int i;

crypto/bn/bn_lib.c:462:6: Call
    460.   
    461.   	if (a == b) return(a);
    462.   	if (bn_wexpand(a,b->top) == NULL) return(NULL);
                ^
    463.   
    464.   #if 1

crypto/bn/bn_lib.c:344:1: <Length trace>
342.   	}
343.   
344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
345.   	{
346.   	BN_ULONG *A,*B,*a;

crypto/bn/bn_lib.c:344:1: Parameter `words`
      342.   	}
      343.   
      344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
      345.   	{
      346.   	BN_ULONG *A,*B,*a;

crypto/bn/bn_lib.c:359:19: Array declaration
      357.   			return(NULL);
      358.   			}
      359.   		a=A=(BN_ULONG *)Malloc(sizeof(BN_ULONG)*(words+1));
                               ^
      360.   		if (A == NULL)
      361.   			{

crypto/bn/bn_lib.c:359:5: Assignment
      357.   			return(NULL);
      358.   			}
      359.   		a=A=(BN_ULONG *)Malloc(sizeof(BN_ULONG)*(words+1));
                 ^
      360.   		if (A == NULL)
      361.   			{

crypto/bn/bn_lib.c:377:38: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: 2 by call to `BN_mod_inverse` 
      375.   				{
      376.   				A[0]=B[0]; A[1]=B[1]; A[2]=B[2]; A[3]=B[3];
      377.   				A[4]=B[4]; A[5]=B[5]; A[6]=B[6]; A[7]=B[7];
                                                  ^
      378.   				A+=8;
      379.   				B+=8;
