crypto/srp/srp_lib.c:67: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `BN_mod_exp`.
Showing all 19 steps of the trace


crypto/srp/srp_lib.c:67:10: Call
65.       /* S = (A*v**u) ** b */
66.   
67.       if (!BN_mod_exp(tmp, v, u, N, bn_ctx))
               ^
68.           goto err;
69.       if (!BN_mod_mul(tmp, A, tmp, N, bn_ctx))

crypto/bn/bn_exp.c:88:1: Parameter `ctx->stack.depth`
  86.   }
  87.   
  88. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
  89.                  BN_CTX *ctx)
  90.   {

crypto/bn/bn_exp.c:146:15: Call
  144.   #ifdef RECP_MUL_MOD
  145.       {
  146.           ret = BN_mod_exp_recp(r, a, p, m, ctx);
                       ^
  147.       }
  148.   #else

crypto/bn/bn_exp.c:158:1: Parameter `ctx->stack.depth`
    156.   }
    157.   
    158. > int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
    159.                       const BIGNUM *m, BN_CTX *ctx)
    160.   {

crypto/bn/bn_exp.c:186:5: Call
    184.       }
    185.   
    186.       BN_CTX_start(ctx);
               ^
    187.       aa = BN_CTX_get(ctx);
    188.       val[0] = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:181:1: Parameter `ctx->stack.depth`
      179.   }
      180.   
      181. > void BN_CTX_start(BN_CTX *ctx)
      182.   {
      183.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_exp.c:205:10: Call
    203.       }
    204.   
    205.       if (!BN_nnmod(val[0], a, m, ctx))
                    ^
    206.           goto err;               /* 1 */
    207.       if (BN_is_zero(val[0])) {

crypto/bn/bn_mod.c:13:1: Parameter `ctx->stack.depth`
      11.   #include "bn_lcl.h"
      12.   
      13. > int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
      14.   {
      15.       /*

crypto/bn/bn_mod.c:20:11: Call
      18.        */
      19.   
      20.       if (!(BN_mod(r, m, d, ctx)))
                      ^
      21.           return 0;
      22.       if (!r->neg)

crypto/bn/bn_div.c:193:5: Call
        191.       }
        192.   
        193.       BN_CTX_start(ctx);
                   ^
        194.       res = (dv == NULL) ? BN_CTX_get(ctx) : dv;
        195.       tmp = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:181:1: Parameter `*ctx->stack.indexes`
          179.   }
          180.   
          181. > void BN_CTX_start(BN_CTX *ctx)
          182.   {
          183.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_div.c:413:5: Call
        411.       if (no_branch)
        412.           bn_correct_top(res);
        413.       BN_CTX_end(ctx);
                   ^
        414.       return 1;
        415.    err:

crypto/bn/bn_ctx.c:195:1: Parameter `*ctx->stack.indexes`
          193.   }
          194.   
          195. > void BN_CTX_end(BN_CTX *ctx)
          196.   {
          197.       CTXDBG_ENTRY("BN_CTX_end", ctx);

crypto/bn/bn_ctx.c:201:27: Call
          199.           ctx->err_stack--;
          200.       else {
          201.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                           ^
          202.           /* Does this stack frame have anything to release? */
          203.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:271:1: <Offset trace>
269.   }
270.   
271. > static unsigned int BN_STACK_pop(BN_STACK *st)
272.   {
273.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:271:1: Parameter `st->depth`
            269.   }
            270.   
            271. > static unsigned int BN_STACK_pop(BN_STACK *st)
            272.   {
            273.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:271:1: <Length trace>
269.   }
270.   
271. > static unsigned int BN_STACK_pop(BN_STACK *st)
272.   {
273.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:271:1: Parameter `*st->indexes`
            269.   }
            270.   
            271. > static unsigned int BN_STACK_pop(BN_STACK *st)
            272.   {
            273.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:273:12: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `BN_mod_exp` 
            271.   static unsigned int BN_STACK_pop(BN_STACK *st)
            272.   {
            273.       return st->indexes[--(st->depth)];
                              ^
            274.   }
            275.   
