crypto/ec/ec_pmeth.c:70: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `EC_KEY_dup`.
Showing all 14 steps of the trace


crypto/ec/ec_pmeth.c:63:27: Call
61.       dctx = dst->data;
62.       if (sctx->gen_group) {
63.           dctx->gen_group = EC_GROUP_dup(sctx->gen_group);
                                ^
64.           if (!dctx->gen_group)
65.               return 0;

crypto/ec/ec_lib.c:236:1: Parameter `a->order->top`
  234.   }
  235.   
  236. > EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)
  237.   {
  238.       EC_GROUP *t = NULL;

crypto/ec/ec_pmeth.c:70:24: Call
68.   
69.       if (sctx->co_key) {
70.           dctx->co_key = EC_KEY_dup(sctx->co_key);
                             ^
71.           if (!dctx->co_key)
72.               return 0;

crypto/ec/ec_key.c:154:1: Parameter `ec_key->priv_key->top`
  152.   }
  153.   
  154. > EC_KEY *EC_KEY_dup(const EC_KEY *ec_key)
  155.   {
  156.       EC_KEY *ret = EC_KEY_new_method(ec_key->engine);

crypto/ec/ec_key.c:161:9: Call
  159.           return NULL;
  160.   
  161.       if (EC_KEY_copy(ret, ec_key) == NULL) {
                 ^
  162.           EC_KEY_free(ret);
  163.           return NULL;

crypto/ec/ec_key.c:77:1: Parameter `src->priv_key->top`
    75.   }
    76.   
    77. > EC_KEY *EC_KEY_copy(EC_KEY *dest, const EC_KEY *src)
    78.   {
    79.       if (dest == NULL || src == NULL) {

crypto/ec/ec_key.c:121:18: Call
    119.                       return NULL;
    120.               }
    121.               if (!BN_copy(dest->priv_key, src->priv_key))
                            ^
    122.                   return NULL;
    123.               if (src->group->meth->keycopy

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
      321.   }
      322.   
      323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      324.   {
      325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
      321.   }
      322.   
      323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      324.   {
      325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
      327.       if (a == b)
      328.           return a;
      329.       if (bn_wexpand(a, b->top) == NULL)
                     ^
      330.           return NULL;
      331.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
        946.   }
        947.   
        948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
        949.   {
        950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `EC_KEY_dup` 
      331.   
      332.       if (b->top > 0)
      333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      334.   
      335.       a->top = b->top;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->top = b->top;
    a->neg = b->neg;
    bn_check_top(a);
    return a;
}
['static int pkey_ec_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)\n{\n    EC_PKEY_CTX *dctx, *sctx;\n    if (!pkey_ec_init(dst))\n        return 0;\n    sctx = src->data;\n    dctx = dst->data;\n    if (sctx->gen_group) {\n        dctx->gen_group = EC_GROUP_dup(sctx->gen_group);\n        if (!dctx->gen_group)\n            return 0;\n    }\n    dctx->md = sctx->md;\n    if (sctx->co_key) {\n        dctx->co_key = EC_KEY_dup(sctx->co_key);\n        if (!dctx->co_key)\n            return 0;\n    }\n    dctx->kdf_type = sctx->kdf_type;\n    dctx->kdf_md = sctx->kdf_md;\n    dctx->kdf_outlen = sctx->kdf_outlen;\n    if (sctx->kdf_ukm) {\n        dctx->kdf_ukm = OPENSSL_memdup(sctx->kdf_ukm, sctx->kdf_ukmlen);\n        if (!dctx->kdf_ukm)\n            return 0;\n    } else\n        dctx->kdf_ukm = NULL;\n    dctx->kdf_ukmlen = sctx->kdf_ukmlen;\n    return 1;\n}', 'EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)\n{\n    EC_GROUP *t = NULL;\n    int ok = 0;\n    if (a == NULL)\n        return NULL;\n    if ((t = EC_GROUP_new(a->meth)) == NULL)\n        return (NULL);\n    if (!EC_GROUP_copy(t, a))\n        goto err;\n    ok = 1;\n err:\n    if (!ok) {\n        EC_GROUP_free(t);\n        return NULL;\n    }\n        return t;\n}', 'EC_KEY *EC_KEY_dup(const EC_KEY *ec_key)\n{\n    EC_KEY *ret = EC_KEY_new_method(ec_key->engine);\n    if (ret == NULL)\n        return NULL;\n    if (EC_KEY_copy(ret, ec_key) == NULL) {\n        EC_KEY_free(ret);\n        return NULL;\n    }\n    return ret;\n}', 'EC_KEY *EC_KEY_copy(EC_KEY *dest, const EC_KEY *src)\n{\n    if (dest == NULL || src == NULL) {\n        ECerr(EC_F_EC_KEY_COPY, ERR_R_PASSED_NULL_PARAMETER);\n        return NULL;\n    }\n    if (src->meth != dest->meth) {\n        if (dest->meth->finish != NULL)\n            dest->meth->finish(dest);\n        if (dest->group && dest->group->meth->keyfinish)\n            dest->group->meth->keyfinish(dest);\n#ifndef OPENSSL_NO_ENGINE\n        if (ENGINE_finish(dest->engine) == 0)\n            return 0;\n        dest->engine = NULL;\n#endif\n    }\n    if (src->group != NULL) {\n        const EC_METHOD *meth = EC_GROUP_method_of(src->group);\n        EC_GROUP_free(dest->group);\n        dest->group = EC_GROUP_new(meth);\n        if (dest->group == NULL)\n            return NULL;\n        if (!EC_GROUP_copy(dest->group, src->group))\n            return NULL;\n        if (src->pub_key != NULL) {\n            EC_POINT_free(dest->pub_key);\n            dest->pub_key = EC_POINT_new(src->group);\n            if (dest->pub_key == NULL)\n                return NULL;\n            if (!EC_POINT_copy(dest->pub_key, src->pub_key))\n                return NULL;\n        }\n        if (src->priv_key != NULL) {\n            if (dest->priv_key == NULL) {\n                dest->priv_key = BN_new();\n                if (dest->priv_key == NULL)\n                    return NULL;\n            }\n            if (!BN_copy(dest->priv_key, src->priv_key))\n                return NULL;\n            if (src->group->meth->keycopy\n                && src->group->meth->keycopy(dest, src) == 0)\n                return NULL;\n        }\n    }\n    dest->enc_flag = src->enc_flag;\n    dest->conv_form = src->conv_form;\n    dest->version = src->version;\n    dest->flags = src->flags;\n    if (!CRYPTO_dup_ex_data(CRYPTO_EX_INDEX_EC_KEY,\n                            &dest->ex_data, &src->ex_data))\n        return NULL;\n    if (src->meth != dest->meth) {\n#ifndef OPENSSL_NO_ENGINE\n        if (src->engine != NULL && ENGINE_init(src->engine) == 0)\n            return NULL;\n        dest->engine = src->engine;\n#endif\n        dest->meth = src->meth;\n    }\n    if (src->meth->copy != NULL && src->meth->copy(dest, src) == 0)\n        return NULL;\n    return dest;\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->top = b->top;\n    a->neg = b->neg;\n    bn_check_top(a);\n    return a;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']