crypto/ec/ec2_oct.c:279: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `BN_CTX_end`.
Showing all 9 steps of the trace


crypto/ec/ec2_oct.c:172:1: Parameter `ctx->stack.depth`
170.    * an error will be returned.
171.    */
172. > size_t ec_GF2m_simple_point2oct(const EC_GROUP *group, const EC_POINT *point,
173.                                   point_conversion_form_t form,
174.                                   unsigned char *buf, size_t len, BN_CTX *ctx)

crypto/ec/ec2_oct.c:279:9: Call
277.   
278.       if (used_ctx)
279.           BN_CTX_end(ctx);
               ^
280.       BN_CTX_free(new_ctx);
281.       return ret;

crypto/bn/bn_ctx.c:250:1: Parameter `*ctx->stack.indexes`
  248.   }
  249.   
  250. > void BN_CTX_end(BN_CTX *ctx)
  251.   {
  252.       CTXDBG_ENTRY("BN_CTX_end", ctx);

crypto/bn/bn_ctx.c:256:27: Call
  254.           ctx->err_stack--;
  255.       else {
  256.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                   ^
  257.           /* Does this stack frame have anything to release? */
  258.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:326:1: <Offset trace>
324.   }
325.   
326. > static unsigned int BN_STACK_pop(BN_STACK *st)
327.   {
328.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:326:1: Parameter `st->depth`
    324.   }
    325.   
    326. > static unsigned int BN_STACK_pop(BN_STACK *st)
    327.   {
    328.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:326:1: <Length trace>
324.   }
325.   
326. > static unsigned int BN_STACK_pop(BN_STACK *st)
327.   {
328.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:326:1: Parameter `*st->indexes`
    324.   }
    325.   
    326. > static unsigned int BN_STACK_pop(BN_STACK *st)
    327.   {
    328.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:328:12: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `BN_CTX_end` 
    326.   static unsigned int BN_STACK_pop(BN_STACK *st)
    327.   {
    328.       return st->indexes[--(st->depth)];
                      ^
    329.   }
    330.   

static unsigned int BN_STACK_pop(BN_STACK *st)
{
    return st->indexes[--(st->depth)];
}
['size_t ec_GF2m_simple_point2oct(const EC_GROUP *group, const EC_POINT *point,\n                                point_conversion_form_t form,\n                                unsigned char *buf, size_t len, BN_CTX *ctx)\n{\n    size_t ret;\n    BN_CTX *new_ctx = NULL;\n    int used_ctx = 0;\n    BIGNUM *x, *y, *yxi;\n    size_t field_len, i, skip;\n    if ((form != POINT_CONVERSION_COMPRESSED)\n        && (form != POINT_CONVERSION_UNCOMPRESSED)\n        && (form != POINT_CONVERSION_HYBRID)) {\n        ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_INVALID_FORM);\n        goto err;\n    }\n    if (EC_POINT_is_at_infinity(group, point)) {\n        if (buf != NULL) {\n            if (len < 1) {\n                ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);\n                return 0;\n            }\n            buf[0] = 0;\n        }\n        return 1;\n    }\n    field_len = (EC_GROUP_get_degree(group) + 7) / 8;\n    ret =\n        (form ==\n         POINT_CONVERSION_COMPRESSED) ? 1 + field_len : 1 + 2 * field_len;\n    if (buf != NULL) {\n        if (len < ret) {\n            ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, EC_R_BUFFER_TOO_SMALL);\n            goto err;\n        }\n        if (ctx == NULL) {\n            ctx = new_ctx = BN_CTX_new();\n            if (ctx == NULL)\n                return 0;\n        }\n        BN_CTX_start(ctx);\n        used_ctx = 1;\n        x = BN_CTX_get(ctx);\n        y = BN_CTX_get(ctx);\n        yxi = BN_CTX_get(ctx);\n        if (yxi == NULL)\n            goto err;\n        if (!EC_POINT_get_affine_coordinates_GF2m(group, point, x, y, ctx))\n            goto err;\n        buf[0] = form;\n        if ((form != POINT_CONVERSION_UNCOMPRESSED) && !BN_is_zero(x)) {\n            if (!group->meth->field_div(group, yxi, y, x, ctx))\n                goto err;\n            if (BN_is_odd(yxi))\n                buf[0]++;\n        }\n        i = 1;\n        skip = field_len - BN_num_bytes(x);\n        if (skip > field_len) {\n            ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n        while (skip > 0) {\n            buf[i++] = 0;\n            skip--;\n        }\n        skip = BN_bn2bin(x, buf + i);\n        i += skip;\n        if (i != 1 + field_len) {\n            ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n        if (form == POINT_CONVERSION_UNCOMPRESSED\n            || form == POINT_CONVERSION_HYBRID) {\n            skip = field_len - BN_num_bytes(y);\n            if (skip > field_len) {\n                ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);\n                goto err;\n            }\n            while (skip > 0) {\n                buf[i++] = 0;\n                skip--;\n            }\n            skip = BN_bn2bin(y, buf + i);\n            i += skip;\n        }\n        if (i != ret) {\n            ECerr(EC_F_EC_GF2M_SIMPLE_POINT2OCT, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n    }\n    if (used_ctx)\n        BN_CTX_end(ctx);\n    BN_CTX_free(new_ctx);\n    return ret;\n err:\n    if (used_ctx)\n        BN_CTX_end(ctx);\n    BN_CTX_free(new_ctx);\n    return 0;\n}', 'void BN_CTX_end(BN_CTX *ctx)\n{\n    CTXDBG_ENTRY("BN_CTX_end", ctx);\n    if (ctx->err_stack)\n        ctx->err_stack--;\n    else {\n        unsigned int fp = BN_STACK_pop(&ctx->stack);\n        if (fp < ctx->used)\n            BN_POOL_release(&ctx->pool, ctx->used - fp);\n        ctx->used = fp;\n        ctx->too_many = 0;\n    }\n    CTXDBG_EXIT(ctx);\n}', 'static unsigned int BN_STACK_pop(BN_STACK *st)\n{\n    return st->indexes[--(st->depth)];\n}']