crypto/ec/ec_ameth.c:309: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `EC_KEY_set_group`.
Showing all 17 steps of the trace


crypto/ec/ec_ameth.c:300:23: Call
298.   static int ec_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)
299.   {
300.       EC_GROUP *group = EC_GROUP_dup(EC_KEY_get0_group(from->pkey.ec));
                             ^
301.   
302.       if (group == NULL)

crypto/ec/ec_lib.c:246:10: Call
  244.       if ((t = EC_GROUP_new(a->meth)) == NULL)
  245.           return (NULL);
  246.       if (!EC_GROUP_copy(t, a))
                  ^
  247.           goto err;
  248.   

crypto/ec/ec_lib.c:135:1: Parameter `dest->cofactor->top`
    133.   }
    134.   
    135. > int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
    136.   {
    137.       if (dest->meth->group_copy == 0) {

crypto/ec/ec_ameth.c:309:9: Call
307.               goto err;
308.       }
309.       if (EC_KEY_set_group(to->pkey.ec, group) == 0)
               ^
310.           goto err;
311.       EC_GROUP_free(group);

crypto/ec/ec_key.c:429:1: Parameter `group->cofactor->top`
  427.   }
  428.   
  429. > int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group)
  430.   {
  431.       if (key->meth->set_group != NULL && key->meth->set_group(key, group) == 0)

crypto/ec/ec_key.c:434:18: Call
  432.           return 0;
  433.       EC_GROUP_free(key->group);
  434.       key->group = EC_GROUP_dup(group);
                          ^
  435.       return (key->group == NULL) ? 0 : 1;
  436.   }

crypto/ec/ec_lib.c:236:1: Parameter `a->cofactor->top`
    234.   }
    235.   
    236. > EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)
    237.   {
    238.       EC_GROUP *t = NULL;

crypto/ec/ec_lib.c:246:10: Call
    244.       if ((t = EC_GROUP_new(a->meth)) == NULL)
    245.           return (NULL);
    246.       if (!EC_GROUP_copy(t, a))
                    ^
    247.           goto err;
    248.   

crypto/ec/ec_lib.c:135:1: Parameter `src->cofactor->top`
      133.   }
      134.   
      135. > int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
      136.   {
      137.       if (dest->meth->group_copy == 0) {

crypto/ec/ec_lib.c:211:14: Call
      209.           if (!BN_copy(dest->order, src->order))
      210.               return 0;
      211.           if (!BN_copy(dest->cofactor, src->cofactor))
                          ^
      212.               return 0;
      213.       }

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
        321.   }
        322.   
        323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        324.   {
        325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
        321.   }
        322.   
        323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        324.   {
        325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
        327.       if (a == b)
        328.           return a;
        329.       if (bn_wexpand(a, b->top) == NULL)
                       ^
        330.           return NULL;
        331.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
          946.   }
          947.   
          948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
          949.   {
          950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `EC_KEY_set_group` 
        331.   
        332.       if (b->top > 0)
        333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                       ^
        334.   
        335.       a->top = b->top;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->top = b->top;
    a->neg = b->neg;
    bn_check_top(a);
    return a;
}
['static int ec_copy_parameters(EVP_PKEY *to, const EVP_PKEY *from)\n{\n    EC_GROUP *group = EC_GROUP_dup(EC_KEY_get0_group(from->pkey.ec));\n    if (group == NULL)\n        return 0;\n    if (to->pkey.ec == NULL) {\n        to->pkey.ec = EC_KEY_new();\n        if (to->pkey.ec == NULL)\n            goto err;\n    }\n    if (EC_KEY_set_group(to->pkey.ec, group) == 0)\n        goto err;\n    EC_GROUP_free(group);\n    return 1;\n err:\n    EC_GROUP_free(group);\n    return 0;\n}', 'EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)\n{\n    EC_GROUP *t = NULL;\n    int ok = 0;\n    if (a == NULL)\n        return NULL;\n    if ((t = EC_GROUP_new(a->meth)) == NULL)\n        return (NULL);\n    if (!EC_GROUP_copy(t, a))\n        goto err;\n    ok = 1;\n err:\n    if (!ok) {\n        EC_GROUP_free(t);\n        return NULL;\n    }\n        return t;\n}', 'int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)\n{\n    if (dest->meth->group_copy == 0) {\n        ECerr(EC_F_EC_GROUP_COPY, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);\n        return 0;\n    }\n    if (dest->meth != src->meth) {\n        ECerr(EC_F_EC_GROUP_COPY, EC_R_INCOMPATIBLE_OBJECTS);\n        return 0;\n    }\n    if (dest == src)\n        return 1;\n    dest->pre_comp_type = src->pre_comp_type;\n    switch (src->pre_comp_type) {\n    case PCT_none:\n        dest->pre_comp.ec = NULL;\n        break;\n    case PCT_nistz256:\n#ifdef ECP_NISTZ256_ASM\n        dest->pre_comp.nistz256 = EC_nistz256_pre_comp_dup(src->pre_comp.nistz256);\n#endif\n        break;\n#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128\n    case PCT_nistp224:\n        dest->pre_comp.nistp224 = EC_nistp224_pre_comp_dup(src->pre_comp.nistp224);\n        break;\n    case PCT_nistp256:\n        dest->pre_comp.nistp256 = EC_nistp256_pre_comp_dup(src->pre_comp.nistp256);\n        break;\n    case PCT_nistp521:\n        dest->pre_comp.nistp521 = EC_nistp521_pre_comp_dup(src->pre_comp.nistp521);\n        break;\n#else\n    case PCT_nistp224:\n    case PCT_nistp256:\n    case PCT_nistp521:\n        break;\n#endif\n    case PCT_ec:\n        dest->pre_comp.ec = EC_ec_pre_comp_dup(src->pre_comp.ec);\n        break;\n    }\n    if (src->mont_data != NULL) {\n        if (dest->mont_data == NULL) {\n            dest->mont_data = BN_MONT_CTX_new();\n            if (dest->mont_data == NULL)\n                return 0;\n        }\n        if (!BN_MONT_CTX_copy(dest->mont_data, src->mont_data))\n            return 0;\n    } else {\n        BN_MONT_CTX_free(dest->mont_data);\n        dest->mont_data = NULL;\n    }\n    if (src->generator != NULL) {\n        if (dest->generator == NULL) {\n            dest->generator = EC_POINT_new(dest);\n            if (dest->generator == NULL)\n                return 0;\n        }\n        if (!EC_POINT_copy(dest->generator, src->generator))\n            return 0;\n    } else {\n        EC_POINT_clear_free(dest->generator);\n        dest->generator = NULL;\n    }\n    if ((src->meth->flags & EC_FLAGS_CUSTOM_CURVE) == 0) {\n        if (!BN_copy(dest->order, src->order))\n            return 0;\n        if (!BN_copy(dest->cofactor, src->cofactor))\n            return 0;\n    }\n    dest->curve_name = src->curve_name;\n    dest->asn1_flag = src->asn1_flag;\n    dest->asn1_form = src->asn1_form;\n    if (src->seed) {\n        OPENSSL_free(dest->seed);\n        dest->seed = OPENSSL_malloc(src->seed_len);\n        if (dest->seed == NULL)\n            return 0;\n        if (!memcpy(dest->seed, src->seed, src->seed_len))\n            return 0;\n        dest->seed_len = src->seed_len;\n    } else {\n        OPENSSL_free(dest->seed);\n        dest->seed = NULL;\n        dest->seed_len = 0;\n    }\n    return dest->meth->group_copy(dest, src);\n}', 'int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group)\n{\n    if (key->meth->set_group != NULL && key->meth->set_group(key, group) == 0)\n        return 0;\n    EC_GROUP_free(key->group);\n    key->group = EC_GROUP_dup(group);\n    return (key->group == NULL) ? 0 : 1;\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->top = b->top;\n    a->neg = b->neg;\n    bn_check_top(a);\n    return a;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']