crypto/dsa/dsa_sign.c:184: error: BUFFER_OVERRUN_L3
  Offset: [16, +oo] Size: [0, +oo] by call to `BN_mod_exp_mont`.
Showing all 12 steps of the trace


crypto/dsa/dsa_sign.c:150:1: Parameter `dsa->method_mont_p->RR.d`
148.   	}
149.   
150. > int DSA_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp, BIGNUM **rp)
151.   	{
152.   	BN_CTX *ctx;

crypto/dsa/dsa_sign.c:184:7: Call
182.   
183.   	/* Compute r = (g^k mod p) mod q */
184.   	if (!BN_mod_exp_mont(r,dsa->g,&k,dsa->p,ctx,
             ^
185.   		(BN_MONT_CTX *)dsa->method_mont_p)) goto err;
186.   	if (!BN_mod(r,r,dsa->q,ctx)) goto err;

crypto/bn/bn_exp.c:301:1: Parameter `*in_mont->RR.d`
  299.   
  300.   /* #ifdef MONT_MUL_MOD */
  301. > int BN_mod_exp_mont(BIGNUM *rr, BIGNUM *a, const BIGNUM *p,
  302.   		    const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
  303.   	{

crypto/bn/bn_exp.c:351:7: Call
  349.   	else
  350.   		aa=a;
  351.   	if (!BN_to_montgomery(&(val[0]),aa,mont,ctx)) goto err; /* 1 */
               ^
  352.   	if (!BN_mod_mul_montgomery(d,&(val[0]),&(val[0]),mont,ctx)) goto err; /* 2 */
  353.   

crypto/bn/bn_mont.c:71:1: Parameter `*b->d`
    69.   #define MONT_WORD
    70.   
    71. > int BN_mod_mul_montgomery(BIGNUM *r, BIGNUM *a, BIGNUM *b,
    72.   			  BN_MONT_CTX *mont, BN_CTX *ctx)
    73.   	{

crypto/bn/bn_mont.c:98:8: Call
    96.   	else
    97.   		{
    98.   		if (!BN_mul(tmp,a,b,ctx)) goto err;
                  ^
    99.   		}
    100.   	/* reduce from aRR to aR */

crypto/bn/bn_mul.c:560:1: <Offset trace>
558.   #endif
559.   
560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
561.   	{
562.   	int top,al,bl;

crypto/bn/bn_mul.c:560:1: Parameter `a->top`
      558.   #endif
      559.   
      560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
      561.   	{
      562.   	int top,al,bl;

crypto/bn/bn_mul.c:577:2: Assignment
      575.   	bn_check_top(r);
      576.   
      577.   	al=a->top;
              ^
      578.   	bl=b->top;
      579.   	r->neg=a->neg^b->neg;

crypto/bn/bn_mul.c:560:1: <Length trace>
558.   #endif
559.   
560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
561.   	{
562.   	int top,al,bl;

crypto/bn/bn_mul.c:560:1: Parameter `*b->d`
      558.   #endif
      559.   
      560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
      561.   	{
      562.   	int top,al,bl;

crypto/bn/bn_mul.c:641:4: Array access: Offset: [16, +oo] Size: [0, +oo] by call to `BN_mod_exp_mont` 
      639.   			{
      640.   			bn_wexpand(b,al);
      641.   			b->d[bl]=0;
                ^
      642.   			bl++;
      643.   			goto symetric;
