apps/rsa.c:266: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [2, +oo] by call to `RSA_check_key`.
Showing all 21 steps of the trace


apps/rsa.c:220:14: Call
218.   			}
219.   		p=(unsigned char *)buf->data;
220.   		rsa=(RSA *)d2i_Netscape_RSA(NULL,&p,(long)size,NULL);
                    ^
221.   		BUF_MEM_free(buf);
222.   		}

crypto/asn1/n_pkey.c:192:1: Parameter `(*a)->q->top`
  190.   	}
  191.   
  192. > RSA *d2i_Netscape_RSA(RSA **a, unsigned char **pp, long length, int (*cb)())
  193.   	{
  194.   	RSA *ret=NULL;

apps/rsa.c:266:11: Call
264.   	if (check)
265.   		{
266.   		int r = RSA_check_key(rsa);
                 ^
267.   
268.   		if (r == 1)

crypto/rsa/rsa_chk.c:56:1: Parameter `key->p->top`
  54.   
  55.   
  56. > int RSA_check_key(RSA *key)
  57.   	{
  58.   	BIGNUM *i, *j, *k, *l, *m;

crypto/rsa/rsa_chk.c:78:6: Call
  76.   	
  77.   	/* p prime? */
  78.   	r = BN_is_prime(key->p, BN_prime_checks, NULL, NULL, NULL);
             ^
  79.   	if (r != 1)
  80.   		{

crypto/bn/bn_prime.c:154:1: Parameter `a->top`
    152.   	}
    153.   
    154. > int BN_is_prime(BIGNUM *a, int checks, void (*callback)(int,int,void *),
    155.   	     BN_CTX *ctx_passed, void *cb_arg)
    156.   	{

crypto/bn/bn_prime.c:175:7: Call
    173.   
    174.   	/* Setup the montgomery structure */
    175.   	if (!BN_MONT_CTX_set(mont,a,ctx2)) goto err;
                 ^
    176.   
    177.   	for (i=0; i<checks; i++)

crypto/bn/bn_mont.c:301:1: Parameter `*mont->N.d`
      299.   	}
      300.   
      301. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
      302.   	{
      303.   	BIGNUM Ri,*R;

crypto/bn/bn_mont.c:307:2: Call
      305.   	BN_init(&Ri);
      306.   	R= &(mont->RR);					/* grab RR as a temp */
      307.   	BN_copy(&(mont->N),mod);			/* Set N */
              ^
      308.   
      309.   #ifdef BN_RECURSION_MONT

crypto/bn/bn_lib.c:501:1: Parameter `*a->d`
        499.   	}
        500.   
        501. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        502.   	{
        503.   	int i;

crypto/bn/bn_prime.c:180:5: Call
    178.   		{
    179.   		if (!BN_rand(check,BN_num_bits(a)-1,0,0)) goto err;
    180.   		j=witness(check,a,ctx,ctx2,mont);
               ^
    181.   		if (j == -1) goto err;
    182.   		if (j)

crypto/bn/bn_prime.c:203:1: Parameter `*mont->N.d`
      201.   #define RECP_MUL_MOD
      202.   
      203. > static int witness(BIGNUM *a, BIGNUM *n, BN_CTX *ctx, BN_CTX *ctx2,
      204.   	     BN_MONT_CTX *mont)
      205.   	{

crypto/bn/bn_prime.c:226:7: Call
      224.   	k=BN_num_bits(n1);
      225.   
      226.   	if (!BN_to_montgomery(mont_one,BN_value_one(),mont,ctx2)) goto err;
                   ^
      227.   	if (!BN_to_montgomery(mont_n1,n1,mont,ctx2)) goto err;
      228.   	if (!BN_to_montgomery(mont_a,a,mont,ctx2)) goto err;

crypto/bn/bn_mont.c:71:1: Parameter `*mont->N.d`
        69.   #define MONT_WORD
        70.   
        71. > int BN_mod_mul_montgomery(BIGNUM *r, BIGNUM *a, BIGNUM *b,
        72.   			  BN_MONT_CTX *mont, BN_CTX *ctx)
        73.   	{

crypto/bn/bn_mont.c:101:7: Call
        99.   		}
        100.   	/* reduce from aRR to aR */
        101.   	if (!BN_from_montgomery(r,tmp,mont,ctx)) goto err;
                     ^
        102.   	ctx->tos-=2;
        103.   	return(1);

crypto/bn/bn_mont.c:108:1: Parameter `*mont->N.d`
          106.   	}
          107.   
          108. > int BN_from_montgomery(BIGNUM *ret, BIGNUM *a, BN_MONT_CTX *mont,
          109.   	     BN_CTX *ctx)
          110.   	{

crypto/bn/bn_mont.c:137:3: Assignment
          135.   
          136.   		r->neg=a->neg^n->neg;
          137.   		np=n->d;
                   ^
          138.   		rp=r->d;
          139.   		nrp= &(r->d[nl]);

crypto/bn/bn_mont.c:157:6: Call
          155.   		for (i=0; i<nl; i++)
          156.   			{
          157.   			v=bn_mul_add_words(rp,np,nl,(rp[0]*n0)&BN_MASK2);
                      ^
          158.   			nrp++;
          159.   			rp++;

crypto/bn/bn_asm.c:144:1: <Length trace>
142.   #else
143.   
144. > BN_ULONG bn_mul_add_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w)
145.   	{
146.   	BN_ULONG c=0;

crypto/bn/bn_asm.c:144:1: Parameter `*ap`
            142.   #else
            143.   
            144. > BN_ULONG bn_mul_add_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w)
            145.   	{
            146.   	BN_ULONG c=0;

crypto/bn/bn_asm.c:163:3: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [2, +oo] by call to `RSA_check_key` 
            161.   		mul_add(rp[2],ap[2],bl,bh,c);
            162.   		if (--num == 0) break;
            163.   		mul_add(rp[3],ap[3],bl,bh,c);
                     ^
            164.   		if (--num == 0) break;
            165.   		ap+=4;
