crypto/ec/ecp_nistz256.c:1126: error: BUFFER_OVERRUN_L1
  Offset: 4 Size: 4 by call to `bn_set_static_words`.
Showing all 11 steps of the trace


crypto/ec/ecp_nistz256.c:1109:8: Array declaration
1107.   #endif
1108.   
1109.   __owur static int ecp_nistz256_set_from_affine(EC_POINT *out, const EC_GROUP *group,
               ^
1110.                                                  const P256_POINT_AFFINE *in,
1111.                                                  BN_CTX *ctx)

crypto/ec/ecp_nistz256.c:1126:5: Call
1124.       }
1125.       memcpy(d_x, in->X, sizeof(d_x));
1126.       bn_set_static_words(x, d_x, P256_LIMBS);
            ^
1127.   
1128.       memcpy(d_y, in->Y, sizeof(d_y));

crypto/bn/bn_intern.c:179:1: Parameter `*words`
  177.   }
  178.   
  179. > void bn_set_static_words(BIGNUM *a, BN_ULONG *words, int size)
  180.   {
  181.       a->d = words;

crypto/bn/bn_intern.c:181:5: Assignment
  179.   void bn_set_static_words(BIGNUM *a, BN_ULONG *words, int size)
  180.   {
  181.       a->d = words;
             ^
  182.       a->dmax = a->top = size;
  183.       a->neg = 0;

crypto/bn/bn_intern.c:185:5: Call
  183.       a->neg = 0;
  184.       a->flags |= BN_FLG_STATIC_DATA;
  185.       bn_correct_top(a);
             ^
  186.   }
  187.   

crypto/bn/bn_lib.c:1021:1: <Offset trace>
1019.   }
1020.   
1021. > void bn_correct_top(BIGNUM *a)
1022.   {
1023.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:1021:1: Parameter `a->top`
    1019.   }
    1020.   
    1021. > void bn_correct_top(BIGNUM *a)
    1022.   {
    1023.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:1024:5: Assignment
    1022.   {
    1023.       BN_ULONG *ftl;
    1024.       int tmp_top = a->top;
                ^
    1025.   
    1026.       if (tmp_top > 0) {

crypto/bn/bn_lib.c:1021:1: <Length trace>
1019.   }
1020.   
1021. > void bn_correct_top(BIGNUM *a)
1022.   {
1023.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:1021:1: Parameter `*a->d`
    1019.   }
    1020.   
    1021. > void bn_correct_top(BIGNUM *a)
    1022.   {
    1023.       BN_ULONG *ftl;

crypto/bn/bn_lib.c:1027:14: Array access: Offset: 4 Size: 4 by call to `bn_set_static_words` 
    1025.   
    1026.       if (tmp_top > 0) {
    1027.           for (ftl = &(a->d[tmp_top]); tmp_top > 0; tmp_top--) {
                         ^
    1028.               ftl--;
    1029.               if (*ftl != 0)

void bn_correct_top(BIGNUM *a)
{
    BN_ULONG *ftl;
    int tmp_top = a->top;
    if (tmp_top > 0) {
        for (ftl = &(a->d[tmp_top]); tmp_top > 0; tmp_top--) {
            ftl--;
            if (*ftl != 0)
                break;
        }
        a->top = tmp_top;
    }
    bn_pollute(a);
}
['static int ecp_nistz256_set_from_affine(EC_POINT *out, const EC_GROUP *group,\n                                               const P256_POINT_AFFINE *in,\n                                               BN_CTX *ctx)\n{\n    BIGNUM *x, *y;\n    BN_ULONG d_x[P256_LIMBS], d_y[P256_LIMBS];\n    int ret = 0;\n    x = BN_new();\n    if (x == NULL)\n        return 0;\n    y = BN_new();\n    if (y == NULL) {\n        BN_free(x);\n        return 0;\n    }\n    memcpy(d_x, in->X, sizeof(d_x));\n    bn_set_static_words(x, d_x, P256_LIMBS);\n    memcpy(d_y, in->Y, sizeof(d_y));\n    bn_set_static_words(y, d_y, P256_LIMBS);\n    ret = EC_POINT_set_affine_coordinates_GFp(group, out, x, y, ctx);\n    BN_free(x);\n    BN_free(y);\n    return ret;\n}', 'void bn_set_static_words(BIGNUM *a, BN_ULONG *words, int size)\n{\n    a->d = words;\n    a->dmax = a->top = size;\n    a->neg = 0;\n    a->flags |= BN_FLG_STATIC_DATA;\n    bn_correct_top(a);\n}', 'void bn_correct_top(BIGNUM *a)\n{\n    BN_ULONG *ftl;\n    int tmp_top = a->top;\n    if (tmp_top > 0) {\n        for (ftl = &(a->d[tmp_top]); tmp_top > 0; tmp_top--) {\n            ftl--;\n            if (*ftl != 0)\n                break;\n        }\n        a->top = tmp_top;\n    }\n    bn_pollute(a);\n}']