crypto/dsa/dsa_ossl.c:350: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_MONT_CTX_set_locked`.
Showing all 18 steps of the trace


crypto/dsa/dsa_ossl.c:280:1: Parameter `dsa->p->top`
278.   }
279.   
280. > static int dsa_do_verify(const unsigned char *dgst, int dgst_len,
281.                            DSA_SIG *sig, DSA *dsa)
282.   {

crypto/dsa/dsa_ossl.c:300:9: Call
298.       }
299.   
300.       if (BN_num_bits(dsa->p) > OPENSSL_DSA_MAX_MODULUS_BITS) {
               ^
301.           DSAerr(DSA_F_DSA_DO_VERIFY, DSA_R_MODULUS_TOO_LARGE);
302.           return -1;

crypto/bn/bn_lib.c:140:9: Call
  138.       bn_check_top(a);
  139.   
  140.       if (BN_is_zero(a))
                 ^
  141.           return 0;
  142.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));

crypto/bn/bn_lib.c:853:1: Parameter `a->top`
    851.   }
    852.   
    853. > int BN_is_zero(const BIGNUM *a)
    854.   {
    855.       return a->top == 0;

crypto/dsa/dsa_ossl.c:350:16: Call
348.   
349.       if (dsa->flags & DSA_FLAG_CACHE_MONT_P) {
350.           mont = BN_MONT_CTX_set_locked(&dsa->method_mont_p,
                      ^
351.                                         dsa->lock, dsa->p, ctx);
352.           if (!mont)

crypto/bn/bn_mont.c:416:1: Parameter `mod->top`
  414.   }
  415.   
  416. > BN_MONT_CTX *BN_MONT_CTX_set_locked(BN_MONT_CTX **pmont, CRYPTO_RWLOCK *lock,
  417.                                       const BIGNUM *mod, BN_CTX *ctx)
  418.   {

crypto/bn/bn_mont.c:438:10: Call
  436.       if (ret == NULL)
  437.           return NULL;
  438.       if (!BN_MONT_CTX_set(ret, mod, ctx)) {
                  ^
  439.           BN_MONT_CTX_free(ret);
  440.           return NULL;

crypto/bn/bn_mont.c:251:1: Parameter `mod->top`
    249.   }
    250.   
    251. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
    252.   {
    253.       int i, ret = 0;

crypto/bn/bn_mont.c:256:9: Call
    254.       BIGNUM *Ri, *R;
    255.   
    256.       if (BN_is_zero(mod))
                   ^
    257.           return 0;
    258.   

crypto/bn/bn_lib.c:853:1: Parameter `a->top`
      851.   }
      852.   
      853. > int BN_is_zero(const BIGNUM *a)
      854.   {
      855.       return a->top == 0;

crypto/bn/bn_mont.c:263:10: Call
    261.           goto err;
    262.       R = &(mont->RR);            /* grab RR as a temp */
    263.       if (!BN_copy(&(mont->N), mod))
                    ^
    264.           goto err;               /* Set N */
    265.       if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0)

crypto/bn/bn_lib.c:281:1: <Offset trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `b->top`
      279.   }
      280.   
      281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      282.   {
      283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: <Length trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `*a->d`
      279.   }
      280.   
      281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      282.   {
      283.       bn_check_top(b);

crypto/bn/bn_lib.c:287:9: Call
      285.       if (a == b)
      286.           return a;
      287.       if (bn_wexpand(a, b->top) == NULL)
                     ^
      288.           return NULL;
      289.   

crypto/bn/bn_lib.c:949:1: Parameter `*a->d`
        947.   }
        948.   
        949. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
        950.   {
        951.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:291:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_MONT_CTX_set_locked` 
      289.   
      290.       if (b->top > 0)
      291.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      292.   
      293.       a->neg = b->neg;
