crypto/rsa/rsa_ossl.c:739: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607] by call to `BN_MONT_CTX_set_locked`.
Showing all 10 steps of the trace


crypto/rsa/rsa_ossl.c:700:1: Parameter `rsa->q->d`
698.   }
699.   
700. > static int rsa_ossl_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
701.   {
702.       BIGNUM *r1, *m1, *vrfy;

crypto/rsa/rsa_ossl.c:739:21: Call
737.               if (!BN_MONT_CTX_set_locked
738.                   (&rsa->_method_mod_p, rsa->lock, p, ctx)
739.                   || !BN_MONT_CTX_set_locked(&rsa->_method_mod_q,
                           ^
740.                                              rsa->lock, q, ctx)) {
741.                   BN_free(local_p);

crypto/bn/bn_mont.c:499:1: Parameter `*mod->d`
  497.   }
  498.   
  499. > BN_MONT_CTX *BN_MONT_CTX_set_locked(BN_MONT_CTX **pmont, CRYPTO_RWLOCK *lock,
  500.                                       const BIGNUM *mod, BN_CTX *ctx)
  501.   {

crypto/bn/bn_mont.c:521:10: Call
  519.       if (ret == NULL)
  520.           return NULL;
  521.       if (!BN_MONT_CTX_set(ret, mod, ctx)) {
                  ^
  522.           BN_MONT_CTX_free(ret);
  523.           return NULL;

crypto/bn/bn_mont.c:348:1: Parameter `*mod->d`
    346.   }
    347.   
    348. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
    349.   {
    350.       int ret = 0;

crypto/bn/bn_mont.c:360:10: Call
    358.           goto err;
    359.       R = &(mont->RR);            /* grab RR as a temp */
    360.       if (!BN_copy(&(mont->N), mod))
                    ^
    361.           goto err;               /* Set N */
    362.       mont->N.neg = 0;

crypto/bn/bn_lib.c:419:1: <Length trace>
417.   }
418.   
419. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
420.   {
421.       int i;

crypto/bn/bn_lib.c:419:1: Parameter `*b->d`
      417.   }
      418.   
      419. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      420.   {
      421.       int i;

crypto/bn/bn_lib.c:434:5: Assignment
      432.   #if 1
      433.       A = a->d;
      434.       B = b->d;
                 ^
      435.       for (i = b->top >> 2; i > 0; i--, A += 4, B += 4) {
      436.           BN_ULONG a0, a1, a2, a3;

crypto/bn/bn_lib.c:440:14: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607] by call to `BN_MONT_CTX_set_locked` 
      438.           a1 = B[1];
      439.           a2 = B[2];
      440.           a3 = B[3];
                          ^
      441.           A[0] = a0;
      442.           A[1] = a1;
