crypto/evp/evp_pkey.c:172: error: BUFFER_OVERRUN_L1
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: 4 by call to `BN_mod_exp`.
Showing all 13 steps of the trace


crypto/evp/evp_pkey.c:161:24: Call
159.   		}
160.   		/* Calculate public key (ouch!) */
161.   		if (!(dsa->pub_key = BN_new())) {
                              ^
162.   			EVPerr(EVP_F_EVP_PKCS82PKEY,ERR_R_MALLOC_FAILURE);
163.   			DSA_free (dsa);

crypto/bn/bn_lib.c:300:2: Assignment
  298.   		}
  299.   	ret->flags=BN_FLG_MALLOCED;
  300.   	ret->top=0;
          ^
  301.   	ret->neg=0;
  302.   	ret->max=0;

crypto/evp/evp_pkey.c:172:8: Call
170.   		}
171.   			
172.   		if (!BN_mod_exp(dsa->pub_key, dsa->g,
              ^
173.   						 dsa->priv_key, dsa->p, ctx)) {
174.   			

crypto/bn/bn_exp.c:157:1: Parameter `r->top`
  155.   	}
  156.   
  157. > int BN_mod_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m, BN_CTX *ctx)
  158.   	{
  159.   	int ret;

crypto/bn/bn_exp.c:177:9: Call
  175.   #endif
  176.   #ifdef RECP_MUL_MOD
  177.   		{ ret=BN_mod_exp_recp(r,a,p,m,ctx); }
                 ^
  178.   #else
  179.   		{ ret=BN_mod_exp_simple(r,a,p,m,ctx); }

crypto/bn/bn_exp.c:186:1: Parameter `r->top`
    184.   
    185.   /* #ifdef RECP_MUL_MOD */
    186. > int BN_mod_exp_recp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m, BN_CTX *ctx)
    187.   	{
    188.   	int i,j,bits,ret=0,wstart,wend,window,wvalue;

crypto/bn/bn_exp.c:199:3: Call
    197.   	if (bits == 0)
    198.   		{
    199.   		BN_one(r);
             ^
    200.   		return(1);
    201.   		}

crypto/bn/bn_lib.c:567:1: Parameter `a->top`
      565.   	}
      566.   
      567. > int BN_set_word(BIGNUM *a, BN_ULONG w)
      568.   	{
      569.   	int i,n;

crypto/bn/bn_lib.c:570:6: Call
      568.   	{
      569.   	int i,n;
      570.   	if (bn_expand(a,sizeof(BN_ULONG)*8) == NULL) return(0);
                  ^
      571.   
      572.   	n=sizeof(BN_ULONG)/BN_BYTES;

crypto/bn/bn_lib.c:344:1: <Length trace>
342.   	}
343.   
344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
345.   	{
346.   	BN_ULONG *A,*a;

crypto/bn/bn_lib.c:344:1: Parameter `b->top`
        342.   	}
        343.   
        344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
        345.   	{
        346.   	BN_ULONG *A,*a;

crypto/bn/bn_lib.c:466:3: Assignment
        464.   		/* Now need to zero any data between b->top and b->max */
        465.   
        466.   		A= &(b->d[b->top]);
                 ^
        467.   		for (i=(b->max - b->top)>>3; i>0; i--,A+=8)
        468.   			{

crypto/bn/bn_lib.c:470:28: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: 4 by call to `BN_mod_exp` 
        468.   			{
        469.   			A[0]=0; A[1]=0; A[2]=0; A[3]=0;
        470.   			A[4]=0; A[5]=0; A[6]=0; A[7]=0;
                                          ^
        471.   			}
        472.   		for (i=(b->max - b->top)&7; i>0; i--,A++)
