crypto/dsa/dsa_asn1.c:56: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, +oo] by call to `i2d_ASN1_INTEGER`.
Showing all 10 steps of the trace


crypto/dsa/dsa_asn1.c:38:18: Call
36.   	unsigned char *p;
37.   
38.   	rbs.data=Malloc(BN_num_bits(v->r)/8+1);
                       ^
39.   	if (rbs.data == NULL)
40.   		{

crypto/bn/bn_lib.c:245:19: Assignment
  243.   	bn_check_top(a);
  244.   
  245.   	if (a->top == 0) return(0);
                           ^
  246.   	l=a->d[a->top-1];
  247.   	i=(a->top-1)*BN_BITS2;

crypto/dsa/dsa_asn1.c:38:11: Array declaration
36.   	unsigned char *p;
37.   
38.   	rbs.data=Malloc(BN_num_bits(v->r)/8+1);
                ^
39.   	if (rbs.data == NULL)
40.   		{

crypto/dsa/dsa_asn1.c:38:2: Assignment
36.   	unsigned char *p;
37.   
38.   	rbs.data=Malloc(BN_num_bits(v->r)/8+1);
       ^
39.   	if (rbs.data == NULL)
40.   		{

crypto/dsa/dsa_asn1.c:56:6: Call
54.   	sbs.length=BN_bn2bin(v->s,sbs.data);
55.   
56.   	len=i2d_ASN1_INTEGER(&rbs,NULL);
           ^
57.   	len+=i2d_ASN1_INTEGER(&sbs,NULL);
58.   

crypto/asn1/a_int.c:88:1: <Offset trace>
86.    */
87.   
88. > int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
89.   	{
90.   	int pad=0,ret,r,i,t;

crypto/asn1/a_int.c:88:1: Parameter `a->length`
  86.    */
  87.   
  88. > int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
  89.   	{
  90.   	int pad=0,ret,r,i,t;

crypto/asn1/a_int.c:88:1: <Length trace>
86.    */
87.   
88. > int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
89.   	{
90.   	int pad=0,ret,r,i,t;

crypto/asn1/a_int.c:88:1: Parameter `*a->data`
  86.    */
  87.   
  88. > int i2d_ASN1_INTEGER(ASN1_INTEGER *a, unsigned char **pp)
  89.   	{
  90.   	int pad=0,ret,r,i,t;

crypto/asn1/a_int.c:113:39: Array access: Offset: [1, +oo] Size: [0, +oo] by call to `i2d_ASN1_INTEGER` 
  111.   			 * otherwise we don't.
  112.   			 */
  113.   				for(i = 1; i < a->length; i++) if(a->data[i]) {
                                               ^
  114.   						pad=1;
  115.   						pb=0xFF;
