crypto/rsa/rsa_eay.c:463: error: BUFFER_OVERRUN_L3
  Offset: [-1, 11] Size: 12 by call to `BN_mul`.
Showing all 15 steps of the trace


crypto/rsa/rsa_eay.c:427:11: Call
425.   
426.   	meth = ENGINE_get_RSA(rsa->engine);
427.   	if ((ctx=BN_CTX_new()) == NULL) goto err;
                 ^
428.   	BN_init(&m1);
429.   	BN_init(&r1);

crypto/bn/bn_ctx.c:79:2: Call
  77.   		}
  78.   
  79.   	BN_CTX_init(ret);
         ^
  80.   	ret->flags=BN_FLG_MALLOCED;
  81.   	return(ret);

crypto/bn/bn_ctx.c:89:2: Assignment
    87.   	ctx->tos = 0;
    88.   	ctx->flags = 0;
    89.   	ctx->depth = 0;
           ^
    90.   	ctx->too_many = 0;
    91.   	for (i = 0; i < BN_CTX_NUM; i++)

crypto/rsa/rsa_eay.c:449:7: Call
447.   		}
448.   
449.   	if (!BN_mod(&r1,I,rsa->q,ctx)) goto err;
             ^
450.   	if (!meth->bn_mod_exp(&m1,&r1,rsa->dmq1,rsa->q,ctx,
451.   		rsa->_method_mod_q)) goto err;

crypto/bn/bn_div.c:164:1: Parameter `ctx->depth`
  162.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
  163.    */
  164. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
  165.   	   BN_CTX *ctx)
  166.   	{

crypto/rsa/rsa_eay.c:453:7: Call
451.   		rsa->_method_mod_q)) goto err;
452.   
453.   	if (!BN_mod(&r1,I,rsa->p,ctx)) goto err;
             ^
454.   	if (!meth->bn_mod_exp(r0,&r1,rsa->dmp1,rsa->p,ctx,
455.   		rsa->_method_mod_p)) goto err;

crypto/bn/bn_div.c:164:1: Parameter `ctx->depth`
  162.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
  163.    */
  164. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
  165.   	   BN_CTX *ctx)
  166.   	{

crypto/rsa/rsa_eay.c:463:7: Call
461.   		if (!BN_add(r0,r0,rsa->p)) goto err;
462.   
463.   	if (!BN_mul(&r1,r0,rsa->iqmp,ctx)) goto err;
             ^
464.   	if (!BN_mod(r0,&r1,rsa->p,ctx)) goto err;
465.   	/* If p < q it is occasionally possible for the correction of

crypto/bn/bn_mul.c:931:1: Parameter `ctx->depth`
  929.   #endif /* BN_RECURSION */
  930.   
  931. > int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
  932.   	{
  933.   	int top,al,bl;

crypto/bn/bn_mul.c:963:2: Call
  961.   	top=al+bl;
  962.   
  963.   	BN_CTX_start(ctx);
          ^
  964.   	if ((r == a) || (r == b))
  965.   		{

crypto/bn/bn_ctx.c:108:1: <Offset trace>
106.   	}
107.   
108. > void BN_CTX_start(BN_CTX *ctx)
109.   	{
110.   	if (ctx->depth < BN_CTX_NUM_POS)

crypto/bn/bn_ctx.c:108:1: Parameter `ctx->depth`
    106.   	}
    107.   
    108. > void BN_CTX_start(BN_CTX *ctx)
    109.   	{
    110.   	if (ctx->depth < BN_CTX_NUM_POS)

crypto/bn/bn_ctx.c:108:1: <Length trace>
106.   	}
107.   
108. > void BN_CTX_start(BN_CTX *ctx)
109.   	{
110.   	if (ctx->depth < BN_CTX_NUM_POS)

crypto/bn/bn_ctx.c:108:1: Parameter `ctx->pos[*]`
    106.   	}
    107.   
    108. > void BN_CTX_start(BN_CTX *ctx)
    109.   	{
    110.   	if (ctx->depth < BN_CTX_NUM_POS)

crypto/bn/bn_ctx.c:111:3: Array access: Offset: [-1, 11] Size: 12 by call to `BN_mul` 
    109.   	{
    110.   	if (ctx->depth < BN_CTX_NUM_POS)
    111.   		ctx->pos[ctx->depth] = ctx->tos;
             ^
    112.   	ctx->depth++;
    113.   	}
