crypto/dsa/dsa_ameth.c:178: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_mod_exp`.
Showing all 13 steps of the trace


crypto/dsa/dsa_ameth.c:164:13: Call
162.       /* We have parameters now set private key */
163.       if ((dsa->priv_key = BN_secure_new()) == NULL
164.           || !ASN1_INTEGER_to_BN(privkey, dsa->priv_key)) {
                   ^
165.           DSAerr(DSA_F_DSA_PRIV_DECODE, DSA_R_BN_ERROR);
166.           goto dsaerr;

crypto/asn1/a_int.c:580:12: Call
  578.   BIGNUM *ASN1_INTEGER_to_BN(const ASN1_INTEGER *ai, BIGNUM *bn)
  579.   {
  580.       return asn1_string_to_bn(ai, bn, V_ASN1_INTEGER);
                    ^
  581.   }
  582.   

crypto/asn1/a_int.c:514:1: Parameter `bn->d`
    512.   }
    513.   
    514. > static BIGNUM *asn1_string_to_bn(const ASN1_INTEGER *ai, BIGNUM *bn,
    515.                                    int itype)
    516.   {

crypto/dsa/dsa_ameth.c:178:10: Call
176.       }
177.   
178.       if (!BN_mod_exp(dsa->pub_key, dsa->g, dsa->priv_key, dsa->p, ctx)) {
                ^
179.           DSAerr(DSA_F_DSA_PRIV_DECODE, DSA_R_BN_ERROR);
180.           goto dsaerr;

crypto/bn/bn_exp.c:91:1: Parameter `*m->d`
  89.   }
  90.   
  91. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
  92.                  BN_CTX *ctx)
  93.   {

crypto/bn/bn_exp.c:149:15: Call
  147.   #ifdef RECP_MUL_MOD
  148.       {
  149.           ret = BN_mod_exp_recp(r, a, p, m, ctx);
                       ^
  150.       }
  151.   #else

crypto/bn/bn_exp.c:161:1: Parameter `*m->d`
    159.   }
    160.   
    161. > int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
    162.                       const BIGNUM *m, BN_CTX *ctx)
    163.   {

crypto/bn/bn_exp.c:198:14: Call
    196.       if (m->neg) {
    197.           /* ignore sign of 'm' */
    198.           if (!BN_copy(aa, m))
                        ^
    199.               goto err;
    200.           aa->neg = 0;

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
      321.   }
      322.   
      323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      324.   {
      325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*b->d`
      321.   }
      322.   
      323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      324.   {
      325.       bn_check_top(b);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_mod_exp` 
      331.   
      332.       if (b->top > 0)
      333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      334.   
      335.       a->top = b->top;
