crypto/ec/ec2_oct.c:220: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `BN_CTX_end`.
Showing all 9 steps of the trace


crypto/ec/ec2_oct.c:113:1: Parameter `ctx->stack.depth`
111.    * an error will be returned.
112.    */
113. > size_t ec_GF2m_simple_point2oct(const EC_GROUP *group, const EC_POINT *point,
114.                                   point_conversion_form_t form,
115.                                   unsigned char *buf, size_t len, BN_CTX *ctx)

crypto/ec/ec2_oct.c:220:9: Call
218.   
219.       if (used_ctx)
220.           BN_CTX_end(ctx);
               ^
221.       BN_CTX_free(new_ctx);
222.       return ret;

crypto/bn/bn_ctx.c:185:1: Parameter `*ctx->stack.indexes`
  183.   }
  184.   
  185. > void BN_CTX_end(BN_CTX *ctx)
  186.   {
  187.       if (ctx == NULL)

crypto/bn/bn_ctx.c:193:27: Call
  191.           ctx->err_stack--;
  192.       else {
  193.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                   ^
  194.           /* Does this stack frame have anything to release? */
  195.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:268:1: <Offset trace>
266.   }
267.   
268. > static unsigned int BN_STACK_pop(BN_STACK *st)
269.   {
270.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:268:1: Parameter `st->depth`
    266.   }
    267.   
    268. > static unsigned int BN_STACK_pop(BN_STACK *st)
    269.   {
    270.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:268:1: <Length trace>
266.   }
267.   
268. > static unsigned int BN_STACK_pop(BN_STACK *st)
269.   {
270.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:268:1: Parameter `*st->indexes`
    266.   }
    267.   
    268. > static unsigned int BN_STACK_pop(BN_STACK *st)
    269.   {
    270.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:270:12: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `BN_CTX_end` 
    268.   static unsigned int BN_STACK_pop(BN_STACK *st)
    269.   {
    270.       return st->indexes[--(st->depth)];
                      ^
    271.   }
    272.   

static unsigned int BN_STACK_pop(BN_STACK *st)
{
    return st->indexes[--(st->depth)];
}
['size_t ec_GF2m_simple_point2oct(const EC_GROUP *group, const EC_POINT *point,\n                                point_conversion_form_t form,\n                                unsigned char *buf, size_t len, BN_CTX *ctx)\n{\n    size_t ret;\n    BN_CTX *new_ctx = NULL;\n    int used_ctx = 0;\n    BIGNUM *x, *y, *yxi;\n    size_t field_len, i, skip;\n    if ((form != POINT_CONVERSION_COMPRESSED)\n        && (form != POINT_CONVERSION_UNCOMPRESSED)\n        && (form != POINT_CONVERSION_HYBRID)) {\n        ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_INVALID_FORM);\n        goto err;\n    }\n    if (EC_POINT_is_at_infinity(group, point)) {\n        if (buf != NULL) {\n            if (len < 1) {\n                ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);\n                return 0;\n            }\n            buf[0] = 0;\n        }\n        return 1;\n    }\n    field_len = (EC_GROUP_get_degree(group) + 7) / 8;\n    ret =\n        (form ==\n         POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2 * field_len;\n    if (buf != NULL) {\n        if (len < ret) {\n            ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);\n            goto err;\n        }\n        if (ctx == NULL) {\n            ctx = new_ctx = BN_CTX_new();\n            if (ctx == NULL)\n                return 0;\n        }\n        BN_CTX_start(ctx);\n        used_ctx = 1;\n        x = BN_CTX_get(ctx);\n        y = BN_CTX_get(ctx);\n        yxi = BN_CTX_get(ctx);\n        if (yxi == NULL)\n            goto err;\n        if (!EC_POINT_get_affine_coordinates(group, point, x, y, ctx))\n            goto err;\n        buf[0] = form;\n        if ((form != POINT_CONVERSION_UNCOMPRESSED) && !BN_is_zero(x)) {\n            if (!group->meth->field_div(group, yxi, y, x, ctx))\n                goto err;\n            if (BN_is_odd(yxi))\n                buf[0]++;\n        }\n        i = 1;\n        skip = field_len - BN_num_bytes(x);\n        if (skip > field_len) {\n            ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n        while (skip > 0) {\n            buf[i++] = 0;\n            skip--;\n        }\n        skip = BN_bn2bin(x, buf + i);\n        i += skip;\n        if (i != 1 + field_len) {\n            ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n        if (form == POINT_CONVERSION_UNCOMPRESSED\n            || form == POINT_CONVERSION_HYBRID) {\n            skip = field_len - BN_num_bytes(y);\n            if (skip > field_len) {\n                ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);\n                goto err;\n            }\n            while (skip > 0) {\n                buf[i++] = 0;\n                skip--;\n            }\n            skip = BN_bn2bin(y, buf + i);\n            i += skip;\n        }\n        if (i != ret) {\n            ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n    }\n    if (used_ctx)\n        BN_CTX_end(ctx);\n    BN_CTX_free(new_ctx);\n    return ret;\n err:\n    if (used_ctx)\n        BN_CTX_end(ctx);\n    BN_CTX_free(new_ctx);\n    return 0;\n}', 'void BN_CTX_end(BN_CTX *ctx)\n{\n    if (ctx == NULL)\n        return;\n    CTXDBG("ENTER BN_CTX_end()", ctx);\n    if (ctx->err_stack)\n        ctx->err_stack--;\n    else {\n        unsigned int fp = BN_STACK_pop(&ctx->stack);\n        if (fp < ctx->used)\n            BN_POOL_release(&ctx->pool, ctx->used - fp);\n        ctx->used = fp;\n        ctx->too_many = 0;\n    }\n    CTXDBG("LEAVE BN_CTX_end()", ctx);\n}', 'static unsigned int BN_STACK_pop(BN_STACK *st)\n{\n    return st->indexes[--(st->depth)];\n}']