crypto/bn/bntest.c:732: error: BUFFER_OVERRUN_L3
  Offset: [16, +oo] Size: [0, +oo] by call to `BN_mod_exp`.
Showing all 19 steps of the trace


crypto/bn/bntest.c:730:3: Call
728.   		{
729.   		BN_rand(a,20+i*5,0,0); /**/
730.   		BN_rand(b,2+i,0,0); /**/
         ^
731.   
732.   		if (!BN_mod_exp(d,a,b,c,ctx))

crypto/bn/bn_rand.c:65:1: Parameter `rnd->top`
  63.   #include <openssl/rand.h>
  64.   
  65. > int BN_rand(BIGNUM *rnd, int bits, int top, int bottom)
  66.   	{
  67.   	unsigned char *buf=NULL;

crypto/bn/bntest.c:732:8: Call
730.   		BN_rand(b,2+i,0,0); /**/
731.   
732.   		if (!BN_mod_exp(d,a,b,c,ctx))
              ^
733.   			return(00);
734.   

crypto/bn/bn_exp.c:157:1: Parameter `m->top`
  155.   	}
  156.   
  157. > int BN_mod_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m, BN_CTX *ctx)
  158.   	{
  159.   	int ret;

crypto/bn/bn_exp.c:177:9: Call
  175.   #endif
  176.   #ifdef RECP_MUL_MOD
  177.   		{ ret=BN_mod_exp_recp(r,a,p,m,ctx); }
                 ^
  178.   #else
  179.   		{ ret=BN_mod_exp_simple(r,a,p,m,ctx); }

crypto/bn/bn_exp.c:203:6: Call
    201.   		}
    202.   	BN_RECP_CTX_init(&recp);
    203.   	if (BN_RECP_CTX_set(&recp,m,ctx) <= 0) goto err;
                ^
    204.   
    205.   	BN_init(&(val[0]));

crypto/bn/bn_recp.c:96:2: Call
      94.   int BN_RECP_CTX_set(BN_RECP_CTX *recp, BIGNUM *d, BN_CTX *ctx)
      95.   	{
      96.   	BN_copy(&(recp->N),d);
             ^
      97.   	BN_zero(&(recp->Nr));
      98.   	recp->num_bits=BN_num_bits(d);

crypto/bn/bn_lib.c:499:1: Parameter `a->top`
        497.   	}
        498.   
        499. > BIGNUM *BN_copy(BIGNUM *a, BIGNUM *b)
        500.   	{
        501.   	int i;

crypto/bn/bn_exp.c:209:7: Call
    207.   
    208.   	if (!BN_mod(&(val[0]),a,m,ctx)) goto err;		/* 1 */
    209.   	if (!BN_mod_mul_reciprocal(aa,&(val[0]),&(val[0]),&recp,ctx))
                 ^
    210.   		goto err;				/* 2 */
    211.   

crypto/bn/bn_recp.c:103:1: Parameter `*recp->N.d`
      101.   	}
      102.   
      103. > int BN_mod_mul_reciprocal(BIGNUM *r, BIGNUM *x, BIGNUM *y, BN_RECP_CTX *recp,
      104.   	     BN_CTX *ctx)
      105.   	{

crypto/bn/bn_recp.c:120:2: Call
      118.   		a=x; /* Just do the mod */
      119.   
      120.   	BN_div_recp(NULL,r,a,recp,ctx);
              ^
      121.   	ret=1;
      122.   err:

crypto/bn/bn_recp.c:127:1: Parameter `*recp->N.d`
        125.   	}
        126.   
        127. > int BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BN_RECP_CTX *recp,
        128.   	     BN_CTX *ctx)
        129.   	{

crypto/bn/bn_recp.c:181:7: Call
        179.   	if (!BN_rshift(d,b,j+ex)) goto err;
        180.   	d->neg=0;
        181.   	if (!BN_mul(b,&(recp->N),d,ctx)) goto err;
                     ^
        182.   	if (!BN_usub(r,m,b)) goto err;
        183.   	r->neg=0;

crypto/bn/bn_mul.c:560:1: <Offset trace>
558.   #endif
559.   
560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
561.   	{
562.   	int top,al,bl;

crypto/bn/bn_mul.c:560:1: Parameter `a->top`
          558.   #endif
          559.   
          560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
          561.   	{
          562.   	int top,al,bl;

crypto/bn/bn_mul.c:577:2: Assignment
          575.   	bn_check_top(r);
          576.   
          577.   	al=a->top;
                  ^
          578.   	bl=b->top;
          579.   	r->neg=a->neg^b->neg;

crypto/bn/bn_mul.c:560:1: <Length trace>
558.   #endif
559.   
560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
561.   	{
562.   	int top,al,bl;

crypto/bn/bn_mul.c:560:1: Parameter `*a->d`
          558.   #endif
          559.   
          560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
          561.   	{
          562.   	int top,al,bl;

crypto/bn/bn_mul.c:648:4: Array access: Offset: [16, +oo] Size: [0, +oo] by call to `BN_mod_exp` 
          646.   			{
          647.   			bn_wexpand(a,bl);
          648.   			a->d[al]=0;
                    ^
          649.   			al++;
          650.   			goto symetric;
