apps/speed.c:1024: error: BUFFER_OVERRUN_L3
  Offset: [4, +oo] (⇐ [0, +oo] + 4) Size: [0, +oo] by call to `DSA_generate_key`.
Showing all 22 steps of the trace


apps/speed.c:1056:13: Call
1054.   		for (count=0,run=1; COND(dsa_c[j][1]); count++)
1055.   			{
1056.   			rsa_num2=DSA_verify(EVP_PKEY_DSA,buf,20,buf2,
                    ^
1057.   				kk,dsa_key[j]);
1058.   			if (rsa_num2 <= 0)

crypto/dsa/dsa_vrf.c:147:1: Parameter `dsa->q->top`
  145.    *     -1: error
  146.    */
  147. > int DSA_verify(int type, const unsigned char *dgst, int dgst_len,
  148.   	     unsigned char *sigbuf, int siglen, DSA *dsa)
  149.   	{

apps/speed.c:1024:3: Call
1022.   
1023.   		if (!dsa_doit[j]) continue;
1024.   		DSA_generate_key(dsa_key[j]);
          ^
1025.   /*		DSA_sign_setup(dsa_key[j],NULL); */
1026.   		rsa_num=DSA_sign(EVP_PKEY_DSA,buf,20,buf2,

crypto/dsa/dsa_key.c:68:1: Parameter `dsa->p->top`
  66.   #include <openssl/rand.h>
  67.   
  68. > int DSA_generate_key(DSA *dsa)
  69.   	{
  70.   	int ok=0;

crypto/dsa/dsa_key.c:100:7: Call
  98.   		pub_key=dsa->pub_key;
  99.   
  100.   	if (!BN_mod_exp(pub_key,dsa->g,priv_key,dsa->p,ctx)) goto err;
               ^
  101.   
  102.   	dsa->priv_key=priv_key;

crypto/bn/bn_exp.c:157:1: Parameter `m->top`
    155.   	}
    156.   
    157. > int BN_mod_exp(BIGNUM *r, BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
    158.   	       BN_CTX *ctx)
    159.   	{

crypto/bn/bn_exp.c:178:9: Call
    176.   #endif
    177.   #ifdef RECP_MUL_MOD
    178.   		{ ret=BN_mod_exp_recp(r,a,p,m,ctx); }
                   ^
    179.   #else
    180.   		{ ret=BN_mod_exp_simple(r,a,p,m,ctx); }

crypto/bn/bn_exp.c:187:1: Parameter `m->top`
      185.   
      186.   /* #ifdef RECP_MUL_MOD */
      187. > int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
      188.   		    const BIGNUM *m, BN_CTX *ctx)
      189.   	{

crypto/bn/bn_exp.c:205:6: Call
      203.   		}
      204.   	BN_RECP_CTX_init(&recp);
      205.   	if (BN_RECP_CTX_set(&recp,m,ctx) <= 0) goto err;
                  ^
      206.   
      207.   	BN_init(&(val[0]));

crypto/bn/bn_recp.c:94:1: Parameter `*recp->N.d`
        92.   	}
        93.   
        94. > int BN_RECP_CTX_set(BN_RECP_CTX *recp, const BIGNUM *d, BN_CTX *ctx)
        95.   	{
        96.   	BN_copy(&(recp->N),d);

crypto/bn/bn_recp.c:96:2: Call
        94.   int BN_RECP_CTX_set(BN_RECP_CTX *recp, const BIGNUM *d, BN_CTX *ctx)
        95.   	{
        96.   	BN_copy(&(recp->N),d);
               ^
        97.   	BN_zero(&(recp->Nr));
        98.   	recp->num_bits=BN_num_bits(d);

crypto/bn/bn_lib.c:499:1: Parameter `*a->d`
          497.   	}
          498.   
          499. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
          500.   	{
          501.   	int i;

crypto/bn/bn_exp.c:211:7: Call
      209.   
      210.   	if (!BN_mod(&(val[0]),a,m,ctx)) goto err;		/* 1 */
      211.   	if (!BN_mod_mul_reciprocal(aa,&(val[0]),&(val[0]),&recp,ctx))
                   ^
      212.   		goto err;				/* 2 */
      213.   

crypto/bn/bn_recp.c:103:1: Parameter `*recp->N.d`
        101.   	}
        102.   
        103. > int BN_mod_mul_reciprocal(BIGNUM *r, BIGNUM *x, BIGNUM *y, BN_RECP_CTX *recp,
        104.   	     BN_CTX *ctx)
        105.   	{

crypto/bn/bn_recp.c:120:2: Call
        118.   		a=x; /* Just do the mod */
        119.   
        120.   	BN_div_recp(NULL,r,a,recp,ctx);
                ^
        121.   	ret=1;
        122.   err:

crypto/bn/bn_recp.c:127:1: Parameter `*recp->N.d`
          125.   	}
          126.   
          127. > int BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BN_RECP_CTX *recp,
          128.   	     BN_CTX *ctx)
          129.   	{

crypto/bn/bn_recp.c:181:7: Call
          179.   	if (!BN_rshift(d,b,j+ex)) goto err;
          180.   	d->neg=0;
          181.   	if (!BN_mul(b,&(recp->N),d,ctx)) goto err;
                       ^
          182.   	if (!BN_usub(r,m,b)) goto err;
          183.   	r->neg=0;

crypto/bn/bn_mul.c:560:1: Parameter `*a->d`
            558.   #endif
            559.   
            560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
            561.   	{
            562.   	int top,al,bl;

crypto/bn/bn_mul.c:619:4: Call
            617.   			if (bn_wexpand(rr,top) == NULL) return(0);
            618.   			rr->top=top;
            619.   			bn_mul_normal(rr->d,a->d,al,b->d,bl);
                      ^
            620.   			goto end;
            621.   			}

crypto/bn/bn_mul.c:699:1: <Length trace>
697.   	}
698.   
699. > void bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb)
700.   	{
701.   	BN_ULONG *rr;

crypto/bn/bn_mul.c:699:1: Parameter `*b`
              697.   	}
              698.   
              699. > void bn_mul_normal(BN_ULONG *r, BN_ULONG *a, int na, BN_ULONG *b, int nb)
              700.   	{
              701.   	BN_ULONG *rr;

crypto/bn/bn_mul.c:728:39: Array access: Offset: [4, +oo] (⇐ [0, +oo] + 4) Size: [0, +oo] by call to `DSA_generate_key` 
              726.   		rr[3]=bn_mul_add_words(&(r[3]),a,na,b[3]);
              727.   		if (--nb <= 0) return;
              728.   		rr[4]=bn_mul_add_words(&(r[4]),a,na,b[4]);
                                                           ^
              729.   		rr+=4;
              730.   		r+=4;
