crypto/dsa/dsa_ossl.c:213: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_div`.
Showing all 15 steps of the trace


crypto/dsa/dsa_ossl.c:143:1: Parameter `(*rp)->d`
141.   }
142.   
143. > static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in,
144.                             BIGNUM **kinvp, BIGNUM **rp,
145.                             const unsigned char *dgst, int dlen)

crypto/dsa/dsa_ossl.c:213:10: Call
211.       }
212.   
213.       if (!BN_mod(r, r, dsa->q, ctx))
                ^
214.           goto err;
215.   

crypto/bn/bn_div.c:137:1: Parameter `*rm->d`
  135.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
  136.    */
  137. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
  138.              BN_CTX *ctx)
  139.   {

crypto/bn/bn_div.c:403:9: Call
  401.            */
  402.           int neg = num->neg;
  403.           BN_rshift(rm, snum, norm_shift);
                 ^
  404.           if (!BN_is_zero(rm))
  405.               rm->neg = neg;

crypto/bn/bn_shift.c:122:1: Parameter `*r->d`
    120.   }
    121.   
    122. > int BN_rshift(BIGNUM *r, const BIGNUM *a, int n)
    123.   {
    124.       int i, j, nw, lb, rb;

crypto/bn/bn_shift.c:145:13: Call
    143.       i = (BN_num_bits(a) - n + (BN_BITS2 - 1)) / BN_BITS2;
    144.       if (r != a) {
    145.           if (bn_wexpand(r, i) == NULL)
                       ^
    146.               return 0;
    147.           r->neg = a->neg;

crypto/bn/bn_lib.c:940:1: Parameter `*a->d`
      938.   }
      939.   
      940. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
      941.   {
      942.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:942:37: Call
      940.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
      941.   {
      942.       return (words <= a->dmax) ? a : bn_expand2(a, words);
                                                 ^
      943.   }
      944.   

crypto/bn/bn_lib.c:273:1: Parameter `*b->d`
        271.    */
        272.   
        273. > BIGNUM *bn_expand2(BIGNUM *b, int words)
        274.   {
        275.       bn_check_top(b);

crypto/bn/bn_lib.c:278:23: Call
        276.   
        277.       if (words > b->dmax) {
        278.           BN_ULONG *a = bn_expand_internal(b, words);
                                     ^
        279.           if (!a)
        280.               return NULL;

crypto/bn/bn_lib.c:235:1: <Offset trace>
233.   /* This is used by bn_expand2() */
234.   /* The caller MUST check that words > b->dmax before calling this */
235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
236.   {
237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:235:1: Parameter `b->top`
          233.   /* This is used by bn_expand2() */
          234.   /* The caller MUST check that words > b->dmax before calling this */
          235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
          236.   {
          237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:235:1: <Length trace>
233.   /* This is used by bn_expand2() */
234.   /* The caller MUST check that words > b->dmax before calling this */
235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
236.   {
237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:235:1: Parameter `*b->d`
          233.   /* This is used by bn_expand2() */
          234.   /* The caller MUST check that words > b->dmax before calling this */
          235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
          236.   {
          237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:260:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_div` 
          258.       assert(b->top <= words);
          259.       if (b->top > 0)
          260.           memcpy(a, b->d, sizeof(*a) * b->top);
                         ^
          261.   
          262.       return a;
