crypto/ec/ec_mult.c:951: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `BN_CTX_end`.
Showing all 9 steps of the trace


crypto/ec/ec_mult.c:814:1: Parameter `ctx->stack.depth`
812.    * points[2^(w-1)*numblocks]       = NULL
813.    */
814. > int ec_wNAF_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
815.   {
816.       const EC_POINT *generator;

crypto/ec/ec_mult.c:951:5: Call
949.   
950.    err:
951.       BN_CTX_end(ctx);
           ^
952.       BN_CTX_free(new_ctx);
953.       EC_ec_pre_comp_free(pre_comp);

crypto/bn/bn_ctx.c:185:1: Parameter `*ctx->stack.indexes`
  183.   }
  184.   
  185. > void BN_CTX_end(BN_CTX *ctx)
  186.   {
  187.       if (ctx == NULL)

crypto/bn/bn_ctx.c:193:27: Call
  191.           ctx->err_stack--;
  192.       else {
  193.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                   ^
  194.           /* Does this stack frame have anything to release? */
  195.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:268:1: <Offset trace>
266.   }
267.   
268. > static unsigned int BN_STACK_pop(BN_STACK *st)
269.   {
270.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:268:1: Parameter `st->depth`
    266.   }
    267.   
    268. > static unsigned int BN_STACK_pop(BN_STACK *st)
    269.   {
    270.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:268:1: <Length trace>
266.   }
267.   
268. > static unsigned int BN_STACK_pop(BN_STACK *st)
269.   {
270.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:268:1: Parameter `*st->indexes`
    266.   }
    267.   
    268. > static unsigned int BN_STACK_pop(BN_STACK *st)
    269.   {
    270.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:270:12: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `BN_CTX_end` 
    268.   static unsigned int BN_STACK_pop(BN_STACK *st)
    269.   {
    270.       return st->indexes[--(st->depth)];
                      ^
    271.   }
    272.   

static unsigned int BN_STACK_pop(BN_STACK *st)
{
    return st->indexes[--(st->depth)];
}
['int ec_wNAF_precompute_mult(EC_GROUP *group, BN_CTX *ctx)\n{\n    const EC_POINT *generator;\n    EC_POINT *tmp_point = NULL, *base = NULL, **var;\n    BN_CTX *new_ctx = NULL;\n    const BIGNUM *order;\n    size_t i, bits, w, pre_points_per_block, blocksize, numblocks, num;\n    EC_POINT **points = NULL;\n    EC_PRE_COMP *pre_comp;\n    int ret = 0;\n    EC_pre_comp_free(group);\n    if ((pre_comp = ec_pre_comp_new(group)) == NULL)\n        return 0;\n    generator = EC_GROUP_get0_generator(group);\n    if (generator == NULL) {\n        ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, EC_R_UNDEFINED_GENERATOR);\n        goto err;\n    }\n    if (ctx == NULL) {\n        ctx = new_ctx = BN_CTX_new();\n        if (ctx == NULL)\n            goto err;\n    }\n    BN_CTX_start(ctx);\n    order = EC_GROUP_get0_order(group);\n    if (order == NULL)\n        goto err;\n    if (BN_is_zero(order)) {\n        ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, EC_R_UNKNOWN_ORDER);\n        goto err;\n    }\n    bits = BN_num_bits(order);\n    blocksize = 8;\n    w = 4;\n    if (EC_window_bits_for_scalar_size(bits) > w) {\n        w = EC_window_bits_for_scalar_size(bits);\n    }\n    numblocks = (bits + blocksize - 1) / blocksize;\n    pre_points_per_block = (size_t)1 << (w - 1);\n    num = pre_points_per_block * numblocks;\n    points = OPENSSL_malloc(sizeof(*points) * (num + 1));\n    if (points == NULL) {\n        ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    var = points;\n    var[num] = NULL;\n    for (i = 0; i < num; i++) {\n        if ((var[i] = EC_POINT_new(group)) == NULL) {\n            ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n    }\n    if ((tmp_point = EC_POINT_new(group)) == NULL\n        || (base = EC_POINT_new(group)) == NULL) {\n        ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    if (!EC_POINT_copy(base, generator))\n        goto err;\n    for (i = 0; i < numblocks; i++) {\n        size_t j;\n        if (!EC_POINT_dbl(group, tmp_point, base, ctx))\n            goto err;\n        if (!EC_POINT_copy(*var++, base))\n            goto err;\n        for (j = 1; j < pre_points_per_block; j++, var++) {\n            if (!EC_POINT_add(group, *var, tmp_point, *(var - 1), ctx))\n                goto err;\n        }\n        if (i < numblocks - 1) {\n            size_t k;\n            if (blocksize <= 2) {\n                ECerr(EC_F_EC_WNAF_PRECOMPUTE_MULT, ERR_R_INTERNAL_ERROR);\n                goto err;\n            }\n            if (!EC_POINT_dbl(group, base, tmp_point, ctx))\n                goto err;\n            for (k = 2; k < blocksize; k++) {\n                if (!EC_POINT_dbl(group, base, base, ctx))\n                    goto err;\n            }\n        }\n    }\n    if (!EC_POINTs_make_affine(group, num, points, ctx))\n        goto err;\n    pre_comp->group = group;\n    pre_comp->blocksize = blocksize;\n    pre_comp->numblocks = numblocks;\n    pre_comp->w = w;\n    pre_comp->points = points;\n    points = NULL;\n    pre_comp->num = num;\n    SETPRECOMP(group, ec, pre_comp);\n    pre_comp = NULL;\n    ret = 1;\n err:\n    BN_CTX_end(ctx);\n    BN_CTX_free(new_ctx);\n    EC_ec_pre_comp_free(pre_comp);\n    if (points) {\n        EC_POINT **p;\n        for (p = points; *p != NULL; p++)\n            EC_POINT_free(*p);\n        OPENSSL_free(points);\n    }\n    EC_POINT_free(tmp_point);\n    EC_POINT_free(base);\n    return ret;\n}', 'void BN_CTX_end(BN_CTX *ctx)\n{\n    if (ctx == NULL)\n        return;\n    CTXDBG("ENTER BN_CTX_end()", ctx);\n    if (ctx->err_stack)\n        ctx->err_stack--;\n    else {\n        unsigned int fp = BN_STACK_pop(&ctx->stack);\n        if (fp < ctx->used)\n            BN_POOL_release(&ctx->pool, ctx->used - fp);\n        ctx->used = fp;\n        ctx->too_many = 0;\n    }\n    CTXDBG("LEAVE BN_CTX_end()", ctx);\n}', 'static unsigned int BN_STACK_pop(BN_STACK *st)\n{\n    return st->indexes[--(st->depth)];\n}']