crypto/rsa/rsa_gen.c:138: error: BUFFER_OVERRUN_L1
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: 4 by call to `BN_mul`.
Showing all 11 steps of the trace


crypto/rsa/rsa_gen.c:136:9: Call
134.   
135.   	/* calculate n */
136.   	rsa->n=BN_new();
               ^
137.   	if (rsa->n == NULL) goto err;
138.   	if (!BN_mul(rsa->n,rsa->p,rsa->q,ctx)) goto err;

crypto/bn/bn_lib.c:300:2: Assignment
  298.   		}
  299.   	ret->flags=BN_FLG_MALLOCED;
  300.   	ret->top=0;
          ^
  301.   	ret->neg=0;
  302.   	ret->max=0;

crypto/rsa/rsa_gen.c:138:7: Call
136.   	rsa->n=BN_new();
137.   	if (rsa->n == NULL) goto err;
138.   	if (!BN_mul(rsa->n,rsa->p,rsa->q,ctx)) goto err;
             ^
139.   
140.   	/* calculate d */

crypto/bn/bn_mul.c:560:1: Parameter `r->top`
  558.   #endif
  559.   
  560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
  561.   	{
  562.   	int top,al,bl;

crypto/bn/bn_mul.c:583:3: Call
  581.   	if ((al == 0) || (bl == 0))
  582.   		{
  583.   		BN_zero(r);
           ^
  584.   		return(1);
  585.   		}

crypto/bn/bn_lib.c:548:1: Parameter `a->top`
    546.   	}
    547.   
    548. > int BN_set_word(BIGNUM *a, BN_ULONG w)
    549.   	{
    550.   	int i,n;

crypto/bn/bn_lib.c:551:6: Call
    549.   	{
    550.   	int i,n;
    551.   	if (bn_expand(a,sizeof(BN_ULONG)*8) == NULL) return(0);
                ^
    552.   
    553.   	n=sizeof(BN_ULONG)/BN_BYTES;

crypto/bn/bn_lib.c:344:1: <Length trace>
342.   	}
343.   
344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
345.   	{
346.   	BN_ULONG *A,*B,*a;

crypto/bn/bn_lib.c:344:1: Parameter `b->top`
      342.   	}
      343.   
      344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
      345.   	{
      346.   	BN_ULONG *A,*B,*a;

crypto/bn/bn_lib.c:418:3: Assignment
      416.   		/* Now need to zero any data between b->top and b->max */
      417.   
      418.   		B= &(b->d[b->top]);
               ^
      419.   		j=(b->max - b->top) & ~7;
      420.   		for (i=0; i<j; i+=8)

crypto/bn/bn_lib.c:423:28: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: 4 by call to `BN_mul` 
      421.   			{
      422.   			B[0]=0; B[1]=0; B[2]=0; B[3]=0;
      423.   			B[4]=0; B[5]=0; B[6]=0; B[7]=0;
                                        ^
      424.   			B+=8;
      425.   			}
