crypto/ec/ecp_smpl.c:156: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_copy`.
Showing all 14 steps of the trace


crypto/ec/ecp_smpl.c:130:1: Parameter `p->top`
128.   }
129.   
130. > int ec_GFp_simple_group_set_curve(EC_GROUP *group,
131.                                     const BIGNUM *p, const BIGNUM *a,
132.                                     const BIGNUM *b, BN_CTX *ctx)

crypto/ec/ecp_smpl.c:139:9: Call
137.   
138.       /* p must be a prime > 3 */
139.       if (BN_num_bits(p) <= 2 || !BN_is_odd(p)) {
               ^
140.           ECerr(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE, EC_R_INVALID_FIELD);
141.           return 0;

crypto/bn/bn_lib.c:139:9: Call
  137.       bn_check_top(a);
  138.   
  139.       if (BN_is_zero(a))
                 ^
  140.           return 0;
  141.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));

crypto/bn/bn_lib.c:846:1: Parameter `a->top`
    844.   }
    845.   
    846. > int BN_is_zero(const BIGNUM *a)
    847.   {
    848.       return a->top == 0;

crypto/ec/ecp_smpl.c:139:33: Call
137.   
138.       /* p must be a prime > 3 */
139.       if (BN_num_bits(p) <= 2 || !BN_is_odd(p)) {
                                       ^
140.           ECerr(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE, EC_R_INVALID_FIELD);
141.           return 0;

crypto/bn/bn_lib.c:861:1: Parameter `a->top`
  859.   }
  860.   
  861. > int BN_is_odd(const BIGNUM *a)
  862.   {
  863.       return (a->top > 0) && (a->d[0] & 1);

crypto/ec/ecp_smpl.c:156:10: Call
154.   
155.       /* group->field */
156.       if (!BN_copy(group->field, p))
                ^
157.           goto err;
158.       BN_set_negative(group->field, 0);

crypto/bn/bn_lib.c:280:1: <Offset trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `b->top`
  278.   }
  279.   
  280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  281.   {
  282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: <Length trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `*a->d`
  278.   }
  279.   
  280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  281.   {
  282.       bn_check_top(b);

crypto/bn/bn_lib.c:286:9: Call
  284.       if (a == b)
  285.           return a;
  286.       if (bn_wexpand(a, b->top) == NULL)
                 ^
  287.           return NULL;
  288.   

crypto/bn/bn_lib.c:942:1: Parameter `*a->d`
    940.   }
    941.   
    942. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
    943.   {
    944.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:290:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_copy` 
  288.   
  289.       if (b->top > 0)
  290.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                 ^
  291.   
  292.       a->neg = b->neg;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->neg = b->neg;
    a->top = b->top;
    a->flags |= b->flags & BN_FLG_FIXED_TOP;
    bn_check_top(a);
    return a;
}
['int ec_GFp_simple_group_set_curve(EC_GROUP *group,\n                                  const BIGNUM *p, const BIGNUM *a,\n                                  const BIGNUM *b, BN_CTX *ctx)\n{\n    int ret = 0;\n    BN_CTX *new_ctx = NULL;\n    BIGNUM *tmp_a;\n    if (BN_num_bits(p) <= 2 || !BN_is_odd(p)) {\n        ECerr(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE, EC_R_INVALID_FIELD);\n        return 0;\n    }\n    if (ctx == NULL) {\n        ctx = new_ctx = BN_CTX_new();\n        if (ctx == NULL)\n            return 0;\n    }\n    BN_CTX_start(ctx);\n    tmp_a = BN_CTX_get(ctx);\n    if (tmp_a == NULL)\n        goto err;\n    if (!BN_copy(group->field, p))\n        goto err;\n    BN_set_negative(group->field, 0);\n    if (!BN_nnmod(tmp_a, a, p, ctx))\n        goto err;\n    if (group->meth->field_encode) {\n        if (!group->meth->field_encode(group, group->a, tmp_a, ctx))\n            goto err;\n    } else if (!BN_copy(group->a, tmp_a))\n        goto err;\n    if (!BN_nnmod(group->b, b, p, ctx))\n        goto err;\n    if (group->meth->field_encode)\n        if (!group->meth->field_encode(group, group->b, group->b, ctx))\n            goto err;\n    if (!BN_add_word(tmp_a, 3))\n        goto err;\n    group->a_is_minus3 = (0 == BN_cmp(tmp_a, group->field));\n    ret = 1;\n err:\n    BN_CTX_end(ctx);\n    BN_CTX_free(new_ctx);\n    return ret;\n}', 'int BN_num_bits(const BIGNUM *a)\n{\n    int i = a->top - 1;\n    bn_check_top(a);\n    if (BN_is_zero(a))\n        return 0;\n    return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));\n}', 'int BN_is_zero(const BIGNUM *a)\n{\n    return a->top == 0;\n}', 'int BN_is_odd(const BIGNUM *a)\n{\n    return (a->top > 0) && (a->d[0] & 1);\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->neg = b->neg;\n    a->top = b->top;\n    a->flags |= b->flags & BN_FLG_FIXED_TOP;\n    bn_check_top(a);\n    return a;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']