crypto/ec/ecp_nistz256.c:1424: error: BUFFER_OVERRUN_L3
  Offset added: 32 Size: [0, 67108856] by call to `bn_set_words`.
Showing all 8 steps of the trace


crypto/ec/ecp_nistz256.c:1424:14: Call
1422.       if (x != NULL) {
1423.           ecp_nistz256_from_mont(x_ret, x_aff);
1424.           if (!bn_set_words(x, x_ret, P256_LIMBS))
                     ^
1425.               return 0;
1426.       }

crypto/bn/bn_intern.c:188:1: <Offset trace>
186.   }
187.   
188. > int bn_set_words(BIGNUM *a, BN_ULONG *words, int num_words)
189.   {
190.       if (bn_wexpand(a, num_words) == NULL) {

crypto/bn/bn_intern.c:188:1: Parameter `num_words`
  186.   }
  187.   
  188. > int bn_set_words(BIGNUM *a, BN_ULONG *words, int num_words)
  189.   {
  190.       if (bn_wexpand(a, num_words) == NULL) {

crypto/bn/bn_intern.c:188:1: <Length trace>
186.   }
187.   
188. > int bn_set_words(BIGNUM *a, BN_ULONG *words, int num_words)
189.   {
190.       if (bn_wexpand(a, num_words) == NULL) {

crypto/bn/bn_intern.c:188:1: Parameter `*a->d`
  186.   }
  187.   
  188. > int bn_set_words(BIGNUM *a, BN_ULONG *words, int num_words)
  189.   {
  190.       if (bn_wexpand(a, num_words) == NULL) {

crypto/bn/bn_intern.c:190:9: Call
  188.   int bn_set_words(BIGNUM *a, BN_ULONG *words, int num_words)
  189.   {
  190.       if (bn_wexpand(a, num_words) == NULL) {
                 ^
  191.           BNerr(BN_F_BN_SET_WORDS, ERR_R_MALLOC_FAILURE);
  192.           return 0;

crypto/bn/bn_lib.c:1016:1: Parameter `*a->d`
    1014.   }
    1015.   
    1016. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
    1017.   {
    1018.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_intern.c:195:5: Array access: Offset added: 32 Size: [0, 67108856] by call to `bn_set_words` 
  193.       }
  194.   
  195.       memcpy(a->d, words, sizeof(BN_ULONG) * num_words);
             ^
  196.       a->top = num_words;
  197.       bn_correct_top(a);

int bn_set_words(BIGNUM *a, BN_ULONG *words, int num_words)
{
    if (bn_wexpand(a, num_words) == NULL) {
        BNerr(BN_F_BN_SET_WORDS, ERR_R_MALLOC_FAILURE);
        return 0;
    }
    memcpy(a->d, words, sizeof(BN_ULONG) * num_words);
    a->top = num_words;
    bn_correct_top(a);
    return 1;
}
['static int ecp_nistz256_get_affine(const EC_GROUP *group,\n                                          const EC_POINT *point,\n                                          BIGNUM *x, BIGNUM *y, BN_CTX *ctx)\n{\n    BN_ULONG z_inv2[P256_LIMBS];\n    BN_ULONG z_inv3[P256_LIMBS];\n    BN_ULONG x_aff[P256_LIMBS];\n    BN_ULONG y_aff[P256_LIMBS];\n    BN_ULONG point_x[P256_LIMBS], point_y[P256_LIMBS], point_z[P256_LIMBS];\n    BN_ULONG x_ret[P256_LIMBS], y_ret[P256_LIMBS];\n    if (EC_POINT_is_at_infinity(group, point)) {\n        ECerr(EC_F_ECP_NISTZ256_GET_AFFINE, EC_R_POINT_AT_INFINITY);\n        return 0;\n    }\n    if (!ecp_nistz256_bignum_to_field_elem(point_x, point->X) ||\n        !ecp_nistz256_bignum_to_field_elem(point_y, point->Y) ||\n        !ecp_nistz256_bignum_to_field_elem(point_z, point->Z)) {\n        ECerr(EC_F_ECP_NISTZ256_GET_AFFINE, EC_R_COORDINATES_OUT_OF_RANGE);\n        return 0;\n    }\n    ecp_nistz256_mod_inverse(z_inv3, point_z);\n    ecp_nistz256_sqr_mont(z_inv2, z_inv3);\n    ecp_nistz256_mul_mont(x_aff, z_inv2, point_x);\n    if (x != NULL) {\n        ecp_nistz256_from_mont(x_ret, x_aff);\n        if (!bn_set_words(x, x_ret, P256_LIMBS))\n            return 0;\n    }\n    if (y != NULL) {\n        ecp_nistz256_mul_mont(z_inv3, z_inv3, z_inv2);\n        ecp_nistz256_mul_mont(y_aff, z_inv3, point_y);\n        ecp_nistz256_from_mont(y_ret, y_aff);\n        if (!bn_set_words(y, y_ret, P256_LIMBS))\n            return 0;\n    }\n    return 1;\n}', 'int bn_set_words(BIGNUM *a, BN_ULONG *words, int num_words)\n{\n    if (bn_wexpand(a, num_words) == NULL) {\n        BNerr(BN_F_BN_SET_WORDS, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    memcpy(a->d, words, sizeof(BN_ULONG) * num_words);\n    a->top = num_words;\n    bn_correct_top(a);\n    return 1;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']