crypto/bn/bn_prime.c:256: error: BUFFER_OVERRUN_L3
  Offset: [31, +oo] Size: [0, 8388607] by call to `BN_mod_mul`.
Showing all 23 steps of the trace


crypto/bn/bn_prime.c:249:10: Call
247.                      BN_MONT_CTX *mont)
248.   {
249.       if (!BN_mod_exp_mont(w, w, a1_odd, a, ctx, mont)) /* w := w^a1_odd mod a */
                ^
250.           return -1;
251.       if (BN_is_one(w))

crypto/bn/bn_exp.c:296:1: Parameter `a->top`
  294.   }
  295.   
  296. > int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
  297.                       const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
  298.   {

crypto/bn/bn_prime.c:251:9: Call
249.       if (!BN_mod_exp_mont(w, w, a1_odd, a, ctx, mont)) /* w := w^a1_odd mod a */
250.           return -1;
251.       if (BN_is_one(w))
               ^
252.           return 0;               /* probably prime */
253.       if (BN_cmp(w, a1) == 0)

crypto/bn/bn_lib.c:857:1: Parameter `a->top`
  855.   }
  856.   
  857. > int BN_is_one(const BIGNUM *a)
  858.   {
  859.       return BN_abs_is_word(a, 1) && !a->neg;

crypto/bn/bn_lib.c:859:12: Call
  857.   int BN_is_one(const BIGNUM *a)
  858.   {
  859.       return BN_abs_is_word(a, 1) && !a->neg;
                    ^
  860.   }
  861.   

crypto/bn/bn_lib.c:847:1: Parameter `a->top`
    845.   }
    846.   
    847. > int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
    848.   {
    849.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));

crypto/bn/bn_prime.c:253:9: Call
251.       if (BN_is_one(w))
252.           return 0;               /* probably prime */
253.       if (BN_cmp(w, a1) == 0)
               ^
254.           return 0;               /* w == -1 (mod a), 'a' is probably prime */
255.       while (--k) {

crypto/bn/bn_lib.c:547:1: Parameter `a->top`
  545.   }
  546.   
  547. > int BN_cmp(const BIGNUM *a, const BIGNUM *b)
  548.   {
  549.       int i;

crypto/bn/bn_prime.c:256:14: Call
254.           return 0;               /* w == -1 (mod a), 'a' is probably prime */
255.       while (--k) {
256.           if (!BN_mod_mul(w, w, w, a, ctx)) /* w := w^2 mod a */
                    ^
257.               return -1;
258.           if (BN_is_one(w))

crypto/bn/bn_mod.c:193:1: Parameter `a->top`
  191.   
  192.   /* slow but works */
  193. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
  194.                  BN_CTX *ctx)
  195.   {

crypto/bn/bn_mod.c:207:14: Call
  205.           goto err;
  206.       if (a == b) {
  207.           if (!BN_sqr(t, a, ctx))
                      ^
  208.               goto err;
  209.       } else {

crypto/bn/bn_sqr.c:17:1: Parameter `*r->d`
    15.    * I've just gone over this and it is now %20 faster on x86 - eay - 27 Jun 96
    16.    */
    17. > int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
    18.   {
    19.       int ret = bn_sqr_fixed_top(r, a, ctx);

crypto/bn/bn_sqr.c:19:15: Call
    17.   int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
    18.   {
    19.       int ret = bn_sqr_fixed_top(r, a, ctx);
                        ^
    20.   
    21.       bn_correct_top(r);

crypto/bn/bn_sqr.c:27:1: Parameter `a->top`
      25.   }
      26.   
      27. > int bn_sqr_fixed_top(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
      28.   {
      29.       int max, al;

crypto/bn/bn_sqr.c:35:5: Assignment
      33.       bn_check_top(a);
      34.   
      35.       al = a->top;
                ^
      36.       if (al <= 0) {
      37.           r->top = 0;

crypto/bn/bn_sqr.c:84:17: Call
      82.                   if (bn_wexpand(tmp, max) == NULL)
      83.                       goto err;
      84.                   bn_sqr_normal(rr->d, a->d, al, tmp->d);
                            ^
      85.               }
      86.           }

crypto/bn/bn_sqr.c:109:1: <Offset trace>
107.   
108.   /* tmp must have 2*n words */
109. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
110.   {
111.       int i, j, max;

crypto/bn/bn_sqr.c:109:1: Parameter `n`
        107.   
        108.   /* tmp must have 2*n words */
        109. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
        110.   {
        111.       int i, j, max;

crypto/bn/bn_sqr.c:115:5: Assignment
        113.       BN_ULONG *rp;
        114.   
        115.       max = n * 2;
                   ^
        116.       ap = a;
        117.       rp = r;

crypto/bn/bn_sqr.c:109:1: <Length trace>
107.   
108.   /* tmp must have 2*n words */
109. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
110.   {
111.       int i, j, max;

crypto/bn/bn_sqr.c:109:1: Parameter `*r`
        107.   
        108.   /* tmp must have 2*n words */
        109. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
        110.   {
        111.       int i, j, max;

crypto/bn/bn_sqr.c:117:5: Assignment
        115.       max = n * 2;
        116.       ap = a;
        117.       rp = r;
                   ^
        118.       rp[0] = rp[max - 1] = 0;
        119.       rp++;

crypto/bn/bn_sqr.c:118:13: Array access: Offset: [31, +oo] Size: [0, 8388607] by call to `BN_mod_mul` 
        116.       ap = a;
        117.       rp = r;
        118.       rp[0] = rp[max - 1] = 0;
                           ^
        119.       rp++;
        120.       j = n;
