crypto/dsa/dsa_ossl.c:92: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `dsa_sign_setup`.
Showing all 17 steps of the trace


crypto/dsa/dsa_ossl.c:59:1: Parameter `dsa->p->top`
57.   }
58.   
59. > static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa)
60.   {
61.       BIGNUM *kinv = NULL;

crypto/dsa/dsa_ossl.c:92:10: Call
90.   
91.    redo:
92.       if (!dsa_sign_setup(dsa, ctx, &kinv, &ret->r, dgst, dlen))
               ^
93.           goto err;
94.   

crypto/dsa/dsa_ossl.c:175:1: Parameter `dsa->p->top`
  173.   }
  174.   
  175. > static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in,
  176.                             BIGNUM **kinvp, BIGNUM **rp,
  177.                             const unsigned char *dgst, int dlen)

crypto/dsa/dsa_ossl.c:226:14: Call
  224.   
  225.       if (dsa->flags & DSA_FLAG_CACHE_MONT_P) {
  226.           if (!BN_MONT_CTX_set_locked(&dsa->method_mont_p,
                      ^
  227.                                       dsa->lock, dsa->p, ctx))
  228.               goto err;

crypto/bn/bn_mont.c:416:1: Parameter `mod->top`
    414.   }
    415.   
    416. > BN_MONT_CTX *BN_MONT_CTX_set_locked(BN_MONT_CTX **pmont, CRYPTO_RWLOCK *lock,
    417.                                       const BIGNUM *mod, BN_CTX *ctx)
    418.   {

crypto/bn/bn_mont.c:438:10: Call
    436.       if (ret == NULL)
    437.           return NULL;
    438.       if (!BN_MONT_CTX_set(ret, mod, ctx)) {
                    ^
    439.           BN_MONT_CTX_free(ret);
    440.           return NULL;

crypto/bn/bn_mont.c:251:1: Parameter `mod->top`
      249.   }
      250.   
      251. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
      252.   {
      253.       int i, ret = 0;

crypto/bn/bn_mont.c:256:9: Call
      254.       BIGNUM *Ri, *R;
      255.   
      256.       if (BN_is_zero(mod))
                     ^
      257.           return 0;
      258.   

crypto/bn/bn_lib.c:853:1: Parameter `a->top`
        851.   }
        852.   
        853. > int BN_is_zero(const BIGNUM *a)
        854.   {
        855.       return a->top == 0;

crypto/bn/bn_mont.c:263:10: Call
      261.           goto err;
      262.       R = &(mont->RR);            /* grab RR as a temp */
      263.       if (!BN_copy(&(mont->N), mod))
                      ^
      264.           goto err;               /* Set N */
      265.       if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0)

crypto/bn/bn_lib.c:281:1: <Offset trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `b->top`
        279.   }
        280.   
        281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        282.   {
        283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: <Length trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `*a->d`
        279.   }
        280.   
        281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        282.   {
        283.       bn_check_top(b);

crypto/bn/bn_lib.c:287:9: Call
        285.       if (a == b)
        286.           return a;
        287.       if (bn_wexpand(a, b->top) == NULL)
                       ^
        288.           return NULL;
        289.   

crypto/bn/bn_lib.c:949:1: Parameter `*a->d`
          947.   }
          948.   
          949. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
          950.   {
          951.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:291:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `dsa_sign_setup` 
        289.   
        290.       if (b->top > 0)
        291.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                       ^
        292.   
        293.       a->neg = b->neg;
