crypto/dsa/dsa_sign.c:184: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] Size: [2, +oo] by call to `BN_mod_exp_mont`.
Showing all 11 steps of the trace


crypto/dsa/dsa_sign.c:164:9: Call
162.   
163.   	BN_init(&k);
164.   	if ((r=BN_new()) == NULL) goto err;
               ^
165.   	kinv=NULL;
166.   

crypto/bn/bn_lib.c:302:2: Assignment
  300.   	ret->top=0;
  301.   	ret->neg=0;
  302.   	ret->max=0;
          ^
  303.   	ret->d=NULL;
  304.   	return(ret);

crypto/dsa/dsa_sign.c:184:7: Call
182.   
183.   	/* Compute r = (g^k mod p) mod q */
184.   	if (!BN_mod_exp_mont(r,dsa->g,&k,dsa->p,ctx,
             ^
185.   		(BN_MONT_CTX *)dsa->method_mont_p)) goto err;
186.   	if (!BN_mod(r,r,dsa->q,ctx)) goto err;

crypto/bn/bn_exp.c:301:1: Parameter `rr->max`
  299.   
  300.   /* #ifdef MONT_MUL_MOD */
  301. > int BN_mod_exp_mont(BIGNUM *rr, BIGNUM *a, const BIGNUM *p,
  302.   		    const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
  303.   	{

crypto/bn/bn_exp.c:431:2: Call
  429.   		if (wstart < 0) break;
  430.   		}
  431.   	BN_from_montgomery(rr,r,mont,ctx);
          ^
  432.   	ret=1;
  433.   err:

crypto/bn/bn_mont.c:184:8: <Offset trace>
182.   		ret->top=al;
183.   		al-=4;
184.   		for (i=0; i<al; i+=4)
              ^
185.   			{
186.   			BN_ULONG t1,t2,t3,t4;

crypto/bn/bn_mont.c:184:8: Assignment
    182.   		ret->top=al;
    183.   		al-=4;
    184.   		for (i=0; i<al; i+=4)
                  ^
    185.   			{
    186.   			BN_ULONG t1,t2,t3,t4;

crypto/bn/bn_mont.c:108:1: <Length trace>
106.   	}
107.   
108. > int BN_from_montgomery(BIGNUM *ret, BIGNUM *a, BN_MONT_CTX *mont,
109.   	     BN_CTX *ctx)
110.   	{

crypto/bn/bn_mont.c:108:1: Parameter `*ret->d`
    106.   	}
    107.   
    108. > int BN_from_montgomery(BIGNUM *ret, BIGNUM *a, BN_MONT_CTX *mont,
    109.   	     BN_CTX *ctx)
    110.   	{

crypto/bn/bn_mont.c:176:3: Assignment
    174.   #else
    175.   		x=ri;
    176.   		rp=ret->d;
             ^
    177.   		ap= &(r->d[x]);
    178.   		if (r->top < x)

crypto/bn/bn_mont.c:195:4: Array access: Offset: [3, +oo] Size: [2, +oo] by call to `BN_mod_exp_mont` 
    193.   			rp[i+1]=t2;
    194.   			rp[i+2]=t3;
    195.   			rp[i+3]=t4;
              ^
    196.   			}
    197.   		al+=4;
