crypto/rsa/rsa_chk.c:98: error: BUFFER_OVERRUN_L3
  Offset: [-2, +oo] Size: 13 by call to `BN_mul`.
Showing all 13 steps of the trace


crypto/rsa/rsa_chk.c:68:8: Call
66.   	l = BN_new();
67.   	m = BN_new();
68.   	ctx = BN_CTX_new();
             ^
69.   	if (i == NULL || j == NULL || k == NULL || l == NULL ||
70.   		m == NULL || ctx == NULL)

crypto/bn/bn_lib.c:319:2: Call
  317.   		}
  318.   
  319.   	BN_CTX_init(ret);
          ^
  320.   	ret->flags=BN_FLG_MALLOCED;
  321.   	return(ret);

crypto/bn/bn_lib.c:327:2: Assignment
    325.   	{
    326.   	memset(ctx,0,sizeof(BN_CTX));
    327.   	ctx->tos=0;
            ^
    328.   	ctx->flags=0;
    329.   	}

crypto/rsa/rsa_chk.c:78:6: Call
76.   	
77.   	/* p prime? */
78.   	r = BN_is_prime(key->p, BN_prime_checks(BN_num_bits(key->p)), NULL, NULL, NULL);
           ^
79.   	if (r != 1)
80.   		{

crypto/bn/bn_prime.c:156:1: Parameter `ctx_passed->tos`
  154.   	}
  155.   
  156. > int BN_is_prime(BIGNUM *a, int checks, void (*callback)(int,int,void *),
  157.   	     BN_CTX *ctx_passed, void *cb_arg)
  158.   	{

crypto/rsa/rsa_chk.c:88:6: Call
86.   	
87.   	/* q prime? */
88.   	r = BN_is_prime(key->q, BN_prime_checks(BN_num_bits(key->q)), NULL, NULL, NULL);
           ^
89.   	if (r != 1)
90.   		{

crypto/bn/bn_prime.c:156:1: Parameter `ctx_passed->tos`
  154.   	}
  155.   
  156. > int BN_is_prime(BIGNUM *a, int checks, void (*callback)(int,int,void *),
  157.   	     BN_CTX *ctx_passed, void *cb_arg)
  158.   	{

crypto/rsa/rsa_chk.c:98:6: Call
96.   	
97.   	/* n = p*q? */
98.   	r = BN_mul(i, key->p, key->q, ctx);
            ^
99.   	if (!r) { ret = -1; goto err; }
100.   	

crypto/bn/bn_mul.c:560:1: <Offset trace>
558.   #endif
559.   
560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
561.   	{
562.   	int top,al,bl;

crypto/bn/bn_mul.c:560:1: Parameter `ctx->tos`
  558.   #endif
  559.   
  560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
  561.   	{
  562.   	int top,al,bl;

crypto/bn/bn_mul.c:560:1: <Length trace>
558.   #endif
559.   
560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
561.   	{
562.   	int top,al,bl;

crypto/bn/bn_mul.c:560:1: Parameter `ctx->bn[*]`
  558.   #endif
  559.   
  560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
  561.   	{
  562.   	int top,al,bl;

crypto/bn/bn_mul.c:669:3: Array access: Offset: [-2, +oo] Size: 13 by call to `BN_mul` 
  667.   		j=1<<(j-1);
  668.   		k=j+j;
  669.   		t= &(ctx->bn[ctx->tos]);
           ^
  670.   		if (al == j) /* exact multiple */
  671.   			{
