crypto/dsa/dsa_ossl.c:184: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `BN_mod_mul`.
Showing all 21 steps of the trace


crypto/dsa/dsa_ossl.c:163:14: Call
161.    redo:
162.       if ((dsa->kinv == NULL) || (dsa->r == NULL)) {
163.           if (!dsa_sign_setup(dsa, ctx, &kinv, &r, dgst, dlen))
                    ^
164.               goto err;
165.       } else {

crypto/dsa/dsa_ossl.c:230:1: Parameter `ctx_in->stack.depth`
  228.   }
  229.   
  230. > static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in,
  231.                             BIGNUM **kinvp, BIGNUM **rp,
  232.                             const unsigned char *dgst, int dlen)

crypto/dsa/dsa_ossl.c:184:10: Call
182.   
183.       /* Compute  s = inv(k) (m + xr) mod q */
184.       if (!BN_mod_mul(xr, dsa->priv_key, r, dsa->q, ctx))
                ^
185.           goto err;               /* s = xr */
186.       if (!BN_add(s, xr, m))

crypto/bn/bn_mod.c:179:1: Parameter `ctx->stack.depth`
  177.   
  178.   /* slow but works */
  179. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
  180.                  BN_CTX *ctx)
  181.   {

crypto/bn/bn_mod.c:189:5: Call
  187.       bn_check_top(m);
  188.   
  189.       BN_CTX_start(ctx);
             ^
  190.       if ((t = BN_CTX_get(ctx)) == NULL)
  191.           goto err;

crypto/bn/bn_ctx.c:236:1: Parameter `ctx->stack.depth`
    234.   }
    235.   
    236. > void BN_CTX_start(BN_CTX *ctx)
    237.   {
    238.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_mod.c:193:14: Call
  191.           goto err;
  192.       if (a == b) {
  193.           if (!BN_sqr(t, a, ctx))
                      ^
  194.               goto err;
  195.       } else {

crypto/bn/bn_sqr.c:66:1: Parameter `ctx->stack.depth`
    64.    * I've just gone over this and it is now %20 faster on x86 - eay - 27 Jun 96
    65.    */
    66. > int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
    67.   {
    68.       int max, al;

crypto/bn/bn_mod.c:199:10: Call
  197.               goto err;
  198.       }
  199.       if (!BN_nnmod(r, t, m, ctx))
                  ^
  200.           goto err;
  201.       bn_check_top(r);

crypto/bn/bn_mod.c:119:1: Parameter `ctx->stack.depth`
    117.   #include "bn_lcl.h"
    118.   
    119. > int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
    120.   {
    121.       /*

crypto/bn/bn_mod.c:126:11: Call
    124.        */
    125.   
    126.       if (!(BN_mod(r, m, d, ctx)))
                     ^
    127.           return 0;
    128.       if (!r->neg)

crypto/bn/bn_div.c:242:5: Call
      240.       }
      241.   
      242.       BN_CTX_start(ctx);
                 ^
      243.       tmp = BN_CTX_get(ctx);
      244.       snum = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:236:1: Parameter `*ctx->stack.indexes`
        234.   }
        235.   
        236. > void BN_CTX_start(BN_CTX *ctx)
        237.   {
        238.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_div.c:469:5: Call
      467.       if (no_branch)
      468.           bn_correct_top(res);
      469.       BN_CTX_end(ctx);
                 ^
      470.       return (1);
      471.    err:

crypto/bn/bn_ctx.c:250:1: Parameter `*ctx->stack.indexes`
        248.   }
        249.   
        250. > void BN_CTX_end(BN_CTX *ctx)
        251.   {
        252.       CTXDBG_ENTRY("BN_CTX_end", ctx);

crypto/bn/bn_ctx.c:256:27: Call
        254.           ctx->err_stack--;
        255.       else {
        256.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                         ^
        257.           /* Does this stack frame have anything to release? */
        258.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:326:1: <Offset trace>
324.   }
325.   
326. > static unsigned int BN_STACK_pop(BN_STACK *st)
327.   {
328.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:326:1: Parameter `st->depth`
          324.   }
          325.   
          326. > static unsigned int BN_STACK_pop(BN_STACK *st)
          327.   {
          328.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:326:1: <Length trace>
324.   }
325.   
326. > static unsigned int BN_STACK_pop(BN_STACK *st)
327.   {
328.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:326:1: Parameter `*st->indexes`
          324.   }
          325.   
          326. > static unsigned int BN_STACK_pop(BN_STACK *st)
          327.   {
          328.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:328:12: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `BN_mod_mul` 
          326.   static unsigned int BN_STACK_pop(BN_STACK *st)
          327.   {
          328.       return st->indexes[--(st->depth)];
                            ^
          329.   }
          330.   
