crypto/ec/ecp_smpl.c:1376: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_set_word`.
Showing all 5 steps of the trace


crypto/ec/ecp_smpl.c:1240:1: Parameter `(*points)->Z->d`
1238.   }
1239.   
1240. > int ec_GFp_simple_points_make_affine(const EC_GROUP *group, size_t num,
1241.                                        EC_POINT *points[], BN_CTX *ctx)
1242.   {

crypto/ec/ecp_smpl.c:1376:22: Call
1374.                       goto err;
1375.               } else {
1376.                   if (!BN_one(p->Z))
                             ^
1377.                       goto err;
1378.               }

crypto/bn/bn_lib.c:530:1: <Length trace>
528.   }
529.   
530. > int BN_set_word(BIGNUM *a, BN_ULONG w)
531.   {
532.       bn_check_top(a);

crypto/bn/bn_lib.c:530:1: Parameter `*a->d`
  528.   }
  529.   
  530. > int BN_set_word(BIGNUM *a, BN_ULONG w)
  531.   {
  532.       bn_check_top(a);

crypto/bn/bn_lib.c:536:5: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_set_word` 
  534.           return (0);
  535.       a->neg = 0;
  536.       a->d[0] = w;
             ^
  537.       a->top = (w ? 1 : 0);
  538.       bn_check_top(a);

int BN_set_word(BIGNUM *a, BN_ULONG w)
{
    bn_check_top(a);
    if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
        return (0);
    a->neg = 0;
    a->d[0] = w;
    a->top = (w ? 1 : 0);
    bn_check_top(a);
    return (1);
}
['int ec_GFp_simple_points_make_affine(const EC_GROUP *group, size_t num,\n                                     EC_POINT *points[], BN_CTX *ctx)\n{\n    BN_CTX *new_ctx = NULL;\n    BIGNUM *tmp, *tmp_Z;\n    BIGNUM **prod_Z = NULL;\n    size_t i;\n    int ret = 0;\n    if (num == 0)\n        return 1;\n    if (ctx == NULL) {\n        ctx = new_ctx = BN_CTX_new();\n        if (ctx == NULL)\n            return 0;\n    }\n    BN_CTX_start(ctx);\n    tmp = BN_CTX_get(ctx);\n    tmp_Z = BN_CTX_get(ctx);\n    if (tmp == NULL || tmp_Z == NULL)\n        goto err;\n    prod_Z = OPENSSL_malloc(num * sizeof prod_Z[0]);\n    if (prod_Z == NULL)\n        goto err;\n    for (i = 0; i < num; i++) {\n        prod_Z[i] = BN_new();\n        if (prod_Z[i] == NULL)\n            goto err;\n    }\n    if (!BN_is_zero(points[0]->Z)) {\n        if (!BN_copy(prod_Z[0], points[0]->Z))\n            goto err;\n    } else {\n        if (group->meth->field_set_to_one != 0) {\n            if (!group->meth->field_set_to_one(group, prod_Z[0], ctx))\n                goto err;\n        } else {\n            if (!BN_one(prod_Z[0]))\n                goto err;\n        }\n    }\n    for (i = 1; i < num; i++) {\n        if (!BN_is_zero(points[i]->Z)) {\n            if (!group->\n                meth->field_mul(group, prod_Z[i], prod_Z[i - 1], points[i]->Z,\n                                ctx))\n                goto err;\n        } else {\n            if (!BN_copy(prod_Z[i], prod_Z[i - 1]))\n                goto err;\n        }\n    }\n    if (!BN_mod_inverse(tmp, prod_Z[num - 1], group->field, ctx)) {\n        ECerr(EC_F_EC_GFP_SIMPLE_POINTS_MAKE_AFFINE, ERR_R_BN_LIB);\n        goto err;\n    }\n    if (group->meth->field_encode != 0) {\n        if (!group->meth->field_encode(group, tmp, tmp, ctx))\n            goto err;\n        if (!group->meth->field_encode(group, tmp, tmp, ctx))\n            goto err;\n    }\n    for (i = num - 1; i > 0; --i) {\n        if (!BN_is_zero(points[i]->Z)) {\n            if (!group->\n                meth->field_mul(group, tmp_Z, prod_Z[i - 1], tmp, ctx))\n                goto err;\n            if (!group->meth->field_mul(group, tmp, tmp, points[i]->Z, ctx))\n                goto err;\n            if (!BN_copy(points[i]->Z, tmp_Z))\n                goto err;\n        }\n    }\n    if (!BN_is_zero(points[0]->Z)) {\n        if (!BN_copy(points[0]->Z, tmp))\n            goto err;\n    }\n    for (i = 0; i < num; i++) {\n        EC_POINT *p = points[i];\n        if (!BN_is_zero(p->Z)) {\n            if (!group->meth->field_sqr(group, tmp, p->Z, ctx))\n                goto err;\n            if (!group->meth->field_mul(group, p->X, p->X, tmp, ctx))\n                goto err;\n            if (!group->meth->field_mul(group, tmp, tmp, p->Z, ctx))\n                goto err;\n            if (!group->meth->field_mul(group, p->Y, p->Y, tmp, ctx))\n                goto err;\n            if (group->meth->field_set_to_one != 0) {\n                if (!group->meth->field_set_to_one(group, p->Z, ctx))\n                    goto err;\n            } else {\n                if (!BN_one(p->Z))\n                    goto err;\n            }\n            p->Z_is_one = 1;\n        }\n    }\n    ret = 1;\n err:\n    BN_CTX_end(ctx);\n    BN_CTX_free(new_ctx);\n    if (prod_Z != NULL) {\n        for (i = 0; i < num; i++) {\n            if (prod_Z[i] == NULL)\n                break;\n            BN_clear_free(prod_Z[i]);\n        }\n        OPENSSL_free(prod_Z);\n    }\n    return ret;\n}', 'int BN_set_word(BIGNUM *a, BN_ULONG w)\n{\n    bn_check_top(a);\n    if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)\n        return (0);\n    a->neg = 0;\n    a->d[0] = w;\n    a->top = (w ? 1 : 0);\n    bn_check_top(a);\n    return (1);\n}']