crypto/ec/ecp_nistz256.c:1109: error: BUFFER_OVERRUN_L3
  Offset added: 32 Size: [0, 67108856] by call to `bn_set_words`.
Showing all 8 steps of the trace


crypto/ec/ecp_nistz256.c:1109:16: Call
1107.       int ret = 0;
1108.   
1109.       if ((ret = bn_set_words(out->X, in->X, P256_LIMBS))
                       ^
1110.           && (ret = bn_set_words(out->Y, in->Y, P256_LIMBS))
1111.           && (ret = bn_set_words(out->Z, ONE, P256_LIMBS)))

crypto/bn/bn_intern.c:188:1: <Offset trace>
186.   }
187.   
188. > int bn_set_words(BIGNUM *a, const BN_ULONG *words, int num_words)
189.   {
190.       if (bn_wexpand(a, num_words) == NULL) {

crypto/bn/bn_intern.c:188:1: Parameter `num_words`
  186.   }
  187.   
  188. > int bn_set_words(BIGNUM *a, const BN_ULONG *words, int num_words)
  189.   {
  190.       if (bn_wexpand(a, num_words) == NULL) {

crypto/bn/bn_intern.c:188:1: <Length trace>
186.   }
187.   
188. > int bn_set_words(BIGNUM *a, const BN_ULONG *words, int num_words)
189.   {
190.       if (bn_wexpand(a, num_words) == NULL) {

crypto/bn/bn_intern.c:188:1: Parameter `*a->d`
  186.   }
  187.   
  188. > int bn_set_words(BIGNUM *a, const BN_ULONG *words, int num_words)
  189.   {
  190.       if (bn_wexpand(a, num_words) == NULL) {

crypto/bn/bn_intern.c:190:9: Call
  188.   int bn_set_words(BIGNUM *a, const BN_ULONG *words, int num_words)
  189.   {
  190.       if (bn_wexpand(a, num_words) == NULL) {
                 ^
  191.           BNerr(BN_F_BN_SET_WORDS, ERR_R_MALLOC_FAILURE);
  192.           return 0;

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
    946.   }
    947.   
    948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
    949.   {
    950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_intern.c:195:5: Array access: Offset added: 32 Size: [0, 67108856] by call to `bn_set_words` 
  193.       }
  194.   
  195.       memcpy(a->d, words, sizeof(BN_ULONG) * num_words);
             ^
  196.       a->top = num_words;
  197.       bn_correct_top(a);

int bn_set_words(BIGNUM *a, const BN_ULONG *words, int num_words)
{
    if (bn_wexpand(a, num_words) == NULL) {
        BNerr(BN_F_BN_SET_WORDS, ERR_R_MALLOC_FAILURE);
        return 0;
    }
    memcpy(a->d, words, sizeof(BN_ULONG) * num_words);
    a->top = num_words;
    bn_correct_top(a);
    return 1;
}
['static int ecp_nistz256_set_from_affine(EC_POINT *out, const EC_GROUP *group,\n                                               const P256_POINT_AFFINE *in,\n                                               BN_CTX *ctx)\n{\n    int ret = 0;\n    if ((ret = bn_set_words(out->X, in->X, P256_LIMBS))\n        && (ret = bn_set_words(out->Y, in->Y, P256_LIMBS))\n        && (ret = bn_set_words(out->Z, ONE, P256_LIMBS)))\n        out->Z_is_one = 1;\n    return ret;\n}', 'int bn_set_words(BIGNUM *a, const BN_ULONG *words, int num_words)\n{\n    if (bn_wexpand(a, num_words) == NULL) {\n        BNerr(BN_F_BN_SET_WORDS, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    memcpy(a->d, words, sizeof(BN_ULONG) * num_words);\n    a->top = num_words;\n    bn_correct_top(a);\n    return 1;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']