apps/req.c:521: error: BUFFER_OVERRUN_L3
  Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `DSA_generate_key`.
Showing all 27 steps of the trace


apps/req.c:254:11: Call
252.   						}
253.   
254.   					dtmp=X509_get_pubkey(xtmp);
                 ^
255.   					if (dtmp->type == EVP_PKEY_DSA)
256.   						dsa_params=DSAparams_dup(dtmp->pkey.dsa);

crypto/x509/x509_cmp.c:241:9: Call
  239.   	if ((x == NULL) || (x->cert_info == NULL))
  240.   		return(NULL);
  241.   	return(X509_PUBKEY_get(x->cert_info->key));
                 ^
  242.   	}
  243.   

crypto/asn1/x_pubkey.c:239:9: Call
    237.   			p=a->parameter->value.sequence->data;
    238.   			j=a->parameter->value.sequence->length;
    239.   			if (!d2i_DSAparams(&ret->pkey.dsa,&p,(long)j))
                   ^
    240.   				goto err;
    241.   			}

crypto/asn1/d2i_dsap.c:67:1: Parameter `(*a)->q->top`
      65.   #include <openssl/asn1_mac.h>
      66.   
      67. > DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)
      68.   	{
      69.   	int i=ERR_R_NESTED_ASN1_ERROR;

apps/req.c:266:12: Call
264.   					}
265.   				BIO_free(in);
266.   				newkey=BN_num_bits(dsa_params->p);
                  ^
267.   				in=NULL;
268.   				}

crypto/bn/bn_lib.c:238:1: Parameter `a->top`
  236.   	}
  237.   
  238. > int BN_num_bits(BIGNUM *a)
  239.   	{
  240.   	BN_ULONG l;

apps/req.c:521:9: Call
519.   			if (pkey_type == TYPE_DSA)
520.   			{
521.   			if (!DSA_generate_key(dsa_params)) goto end;
               ^
522.   			if (!EVP_PKEY_assign_DSA(pkey,dsa_params)) goto end;
523.   			dsa_params=NULL;

crypto/dsa/dsa_key.c:68:1: Parameter `dsa->p->top`
  66.   #include <openssl/rand.h>
  67.   
  68. > int DSA_generate_key(DSA *dsa)
  69.   	{
  70.   	int ok=0;

crypto/dsa/dsa_key.c:100:7: Call
  98.   		pub_key=dsa->pub_key;
  99.   
  100.   	if (!BN_mod_exp(pub_key,dsa->g,priv_key,dsa->p,ctx)) goto err;
               ^
  101.   
  102.   	dsa->priv_key=priv_key;

crypto/bn/bn_exp.c:157:1: Parameter `m->top`
    155.   	}
    156.   
    157. > int BN_mod_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m, BN_CTX *ctx)
    158.   	{
    159.   	int ret;

crypto/bn/bn_exp.c:177:9: Call
    175.   #endif
    176.   #ifdef RECP_MUL_MOD
    177.   		{ ret=BN_mod_exp_recp(r,a,p,m,ctx); }
                   ^
    178.   #else
    179.   		{ ret=BN_mod_exp_simple(r,a,p,m,ctx); }

crypto/bn/bn_exp.c:186:1: Parameter `m->top`
      184.   
      185.   /* #ifdef RECP_MUL_MOD */
      186. > int BN_mod_exp_recp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m, BN_CTX *ctx)
      187.   	{
      188.   	int i,j,bits,ret=0,wstart,wend,window,wvalue;

crypto/bn/bn_exp.c:203:6: Call
      201.   		}
      202.   	BN_RECP_CTX_init(&recp);
      203.   	if (BN_RECP_CTX_set(&recp,m,ctx) <= 0) goto err;
                  ^
      204.   
      205.   	BN_init(&(val[0]));

crypto/bn/bn_recp.c:94:1: Parameter `*recp->N.d`
        92.   	}
        93.   
        94. > int BN_RECP_CTX_set(BN_RECP_CTX *recp, BIGNUM *d, BN_CTX *ctx)
        95.   	{
        96.   	BN_copy(&(recp->N),d);

crypto/bn/bn_recp.c:96:2: Call
        94.   int BN_RECP_CTX_set(BN_RECP_CTX *recp, BIGNUM *d, BN_CTX *ctx)
        95.   	{
        96.   	BN_copy(&(recp->N),d);
               ^
        97.   	BN_zero(&(recp->Nr));
        98.   	recp->num_bits=BN_num_bits(d);

crypto/bn/bn_lib.c:454:1: Parameter `*a->d`
          452.   	}
          453.   
          454. > BIGNUM *BN_copy(BIGNUM *a, BIGNUM *b)
          455.   	{
          456.   	int i;

crypto/bn/bn_exp.c:209:7: Call
      207.   
      208.   	if (!BN_mod(&(val[0]),a,m,ctx)) goto err;		/* 1 */
      209.   	if (!BN_mod_mul_reciprocal(aa,&(val[0]),&(val[0]),&recp,ctx))
                   ^
      210.   		goto err;				/* 2 */
      211.   

crypto/bn/bn_recp.c:103:1: Parameter `*recp->N.d`
        101.   	}
        102.   
        103. > int BN_mod_mul_reciprocal(BIGNUM *r, BIGNUM *x, BIGNUM *y, BN_RECP_CTX *recp,
        104.   	     BN_CTX *ctx)
        105.   	{

crypto/bn/bn_recp.c:120:2: Call
        118.   		a=x; /* Just do the mod */
        119.   
        120.   	BN_div_recp(NULL,r,a,recp,ctx);
                ^
        121.   	ret=1;
        122.   err:

crypto/bn/bn_recp.c:127:1: Parameter `*recp->N.d`
          125.   	}
          126.   
          127. > int BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BN_RECP_CTX *recp,
          128.   	     BN_CTX *ctx)
          129.   	{

crypto/bn/bn_recp.c:181:7: Call
          179.   	if (!BN_rshift(d,b,j+ex)) goto err;
          180.   	d->neg=0;
          181.   	if (!BN_mul(b,&(recp->N),d,ctx)) goto err;
                       ^
          182.   	if (!BN_usub(r,m,b)) goto err;
          183.   	r->neg=0;

crypto/bn/bn_mul.c:560:1: Parameter `*a->d`
            558.   #endif
            559.   
            560. > int BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_CTX *ctx)
            561.   	{
            562.   	int top,al,bl;

crypto/bn/bn_mul.c:647:4: Call
            645.   		else if ((i ==  -1) && !BN_get_flags(a,BN_FLG_STATIC_DATA))
            646.   			{
            647.   			bn_wexpand(a,bl);
                      ^
            648.   			a->d[al]=0;
            649.   			al++;

crypto/bn/bn_lib.c:344:1: <Length trace>
342.   	}
343.   
344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
345.   	{
346.   	BN_ULONG *A,*B,*a;

crypto/bn/bn_lib.c:344:1: Parameter `*b->d`
              342.   	}
              343.   
              344. > BIGNUM *bn_expand2(BIGNUM *b, int words)
              345.   	{
              346.   	BN_ULONG *A,*B,*a;

crypto/bn/bn_lib.c:367:3: Assignment
              365.   memset(A,0x5c,sizeof(BN_ULONG)*(words+1));
              366.   #if 1
              367.   		B=b->d;
                       ^
              368.   		/* Check if the previous number needs to be copied */
              369.   		if (B != NULL)

crypto/bn/bn_lib.c:377:43: Array access: Offset: [7, +oo] (⇐ [0, +oo] + 7) Size: [0, +oo] by call to `DSA_generate_key` 
              375.   				{
              376.   				A[0]=B[0]; A[1]=B[1]; A[2]=B[2]; A[3]=B[3];
              377.   				A[4]=B[4]; A[5]=B[5]; A[6]=B[6]; A[7]=B[7];
                                                               ^
              378.   				A+=8;
              379.   				B+=8;
