crypto/ec/ec_curve.c:3086: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_set_word`.
Showing all 9 steps of the trace


crypto/ec/ec_curve.c:3053:22: Call
3051.           }
3052.       } else if (data->field_type == NID_X9_62_prime_field) {
3053.           if ((group = EC_GROUP_new_curve_GFp(p, a, b, ctx)) == NULL) {
                             ^
3054.               ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
3055.               goto err;

crypto/ec/ec_cvt.c:55:9: Call
  53.   
  54.       if (!EC_GROUP_set_curve_GFp(ret, p, a, b, ctx)) {
  55.           EC_GROUP_clear_free(ret);
                ^
  56.           return NULL;
  57.       }

crypto/ec/ec_lib.c:111:1: Parameter `group->cofactor->d`
    109.   }
    110.   
    111. > void EC_GROUP_clear_free(EC_GROUP *group)
    112.   {
    113.       if (!group)

crypto/ec/ec_curve.c:3086:13: Call
3084.       }
3085.       if ((order = BN_bin2bn(params + 5 * param_len, param_len, NULL)) == NULL
3086.           || !BN_set_word(x, (BN_ULONG)data->cofactor)) {
                    ^
3087.           ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);
3088.           goto err;

crypto/bn/bn_lib.c:358:1: <Length trace>
356.   }
357.   
358. > int BN_set_word(BIGNUM *a, BN_ULONG w)
359.   {
360.       bn_check_top(a);

crypto/bn/bn_lib.c:358:1: Parameter `*a->d`
  356.   }
  357.   
  358. > int BN_set_word(BIGNUM *a, BN_ULONG w)
  359.   {
  360.       bn_check_top(a);

crypto/bn/bn_lib.c:361:9: Call
  359.   {
  360.       bn_check_top(a);
  361.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                 ^
  362.           return 0;
  363.       a->neg = 0;

crypto/bn/bn_lcl.h:660:1: Parameter `*a->d`
    658.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
    659.   
    660. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
    661.   {
    662.       if (bits > (INT_MAX - BN_BITS2 + 1))

crypto/bn/bn_lib.c:364:5: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_set_word` 
  362.           return 0;
  363.       a->neg = 0;
  364.       a->d[0] = w;
             ^
  365.       a->top = (w ? 1 : 0);
  366.       a->flags &= ~BN_FLG_FIXED_TOP;

int BN_set_word(BIGNUM *a, BN_ULONG w)
{
    bn_check_top(a);
    if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
        return 0;
    a->neg = 0;
    a->d[0] = w;
    a->top = (w ? 1 : 0);
    a->flags &= ~BN_FLG_FIXED_TOP;
    bn_check_top(a);
    return 1;
}
['static EC_GROUP *ec_group_new_from_data(const ec_list_element curve)\n{\n    EC_GROUP *group = NULL;\n    EC_POINT *P = NULL;\n    BN_CTX *ctx = NULL;\n    BIGNUM *p = NULL, *a = NULL, *b = NULL, *x = NULL, *y = NULL, *order =\n        NULL;\n    int ok = 0;\n    int seed_len, param_len;\n    const EC_METHOD *meth;\n    const EC_CURVE_DATA *data;\n    const unsigned char *params;\n    if (curve.data == NULL)\n        return EC_GROUP_new(curve.meth != NULL ? curve.meth() : NULL);\n    if ((ctx = BN_CTX_new()) == NULL) {\n        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    data = curve.data;\n    seed_len = data->seed_len;\n    param_len = data->param_len;\n    params = (const unsigned char *)(data + 1);\n    params += seed_len;\n    if ((p = BN_bin2bn(params + 0 * param_len, param_len, NULL)) == NULL\n        || (a = BN_bin2bn(params + 1 * param_len, param_len, NULL)) == NULL\n        || (b = BN_bin2bn(params + 2 * param_len, param_len, NULL)) == NULL) {\n        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);\n        goto err;\n    }\n    if (curve.meth != 0) {\n        meth = curve.meth();\n        if (((group = EC_GROUP_new(meth)) == NULL) ||\n            (!(group->meth->group_set_curve(group, p, a, b, ctx)))) {\n            ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);\n            goto err;\n        }\n    } else if (data->field_type == NID_X9_62_prime_field) {\n        if ((group = EC_GROUP_new_curve_GFp(p, a, b, ctx)) == NULL) {\n            ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);\n            goto err;\n        }\n    }\n#ifndef OPENSSL_NO_EC2M\n    else {\n        if ((group = EC_GROUP_new_curve_GF2m(p, a, b, ctx)) == NULL) {\n            ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);\n            goto err;\n        }\n    }\n#endif\n    EC_GROUP_set_curve_name(group, curve.nid);\n    if ((P = EC_POINT_new(group)) == NULL) {\n        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);\n        goto err;\n    }\n    if ((x = BN_bin2bn(params + 3 * param_len, param_len, NULL)) == NULL\n        || (y = BN_bin2bn(params + 4 * param_len, param_len, NULL)) == NULL) {\n        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);\n        goto err;\n    }\n    if (!EC_POINT_set_affine_coordinates_GFp(group, P, x, y, ctx)) {\n        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);\n        goto err;\n    }\n    if ((order = BN_bin2bn(params + 5 * param_len, param_len, NULL)) == NULL\n        || !BN_set_word(x, (BN_ULONG)data->cofactor)) {\n        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);\n        goto err;\n    }\n    if (!EC_GROUP_set_generator(group, P, order, x)) {\n        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);\n        goto err;\n    }\n    if (seed_len) {\n        if (!EC_GROUP_set_seed(group, params - seed_len, seed_len)) {\n            ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);\n            goto err;\n        }\n    }\n    ok = 1;\n err:\n    if (!ok) {\n        EC_GROUP_free(group);\n        group = NULL;\n    }\n    EC_POINT_free(P);\n    BN_CTX_free(ctx);\n    BN_free(p);\n    BN_free(a);\n    BN_free(b);\n    BN_free(order);\n    BN_free(x);\n    BN_free(y);\n    return group;\n}', 'EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a,\n                                 const BIGNUM *b, BN_CTX *ctx)\n{\n    const EC_METHOD *meth;\n    EC_GROUP *ret;\n#if defined(OPENSSL_BN_ASM_MONT)\n    meth = EC_GFp_mont_method();\n#else\n    if (BN_nist_mod_func(p))\n        meth = EC_GFp_nist_method();\n    else\n        meth = EC_GFp_mont_method();\n#endif\n    ret = EC_GROUP_new(meth);\n    if (ret == NULL)\n        return NULL;\n    if (!EC_GROUP_set_curve_GFp(ret, p, a, b, ctx)) {\n        EC_GROUP_clear_free(ret);\n        return NULL;\n    }\n    return ret;\n}', 'void EC_GROUP_clear_free(EC_GROUP *group)\n{\n    if (!group)\n        return;\n    if (group->meth->group_clear_finish != 0)\n        group->meth->group_clear_finish(group);\n    else if (group->meth->group_finish != 0)\n        group->meth->group_finish(group);\n    EC_pre_comp_free(group);\n    BN_MONT_CTX_free(group->mont_data);\n    EC_POINT_clear_free(group->generator);\n    BN_clear_free(group->order);\n    BN_clear_free(group->cofactor);\n    OPENSSL_clear_free(group->seed, group->seed_len);\n    OPENSSL_clear_free(group, sizeof(*group));\n}', 'int BN_set_word(BIGNUM *a, BN_ULONG w)\n{\n    bn_check_top(a);\n    if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)\n        return 0;\n    a->neg = 0;\n    a->d[0] = w;\n    a->top = (w ? 1 : 0);\n    a->flags &= ~BN_FLG_FIXED_TOP;\n    bn_check_top(a);\n    return 1;\n}', 'static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)\n{\n    if (bits > (INT_MAX - BN_BITS2 + 1))\n        return NULL;\n    if (((bits+BN_BITS2-1)/BN_BITS2) <= (a)->dmax)\n        return a;\n    return bn_expand2((a),(bits+BN_BITS2-1)/BN_BITS2);\n}']