crypto/sm2/sm2_pmeth.c:60: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `EC_GROUP_dup`.
Showing all 12 steps of the trace


crypto/sm2/sm2_pmeth.c:60:27: Call
58.       dctx = dst->data;
59.       if (sctx->gen_group != NULL) {
60.           dctx->gen_group = EC_GROUP_dup(sctx->gen_group);
                                ^
61.           if (dctx->gen_group == NULL) {
62.               pkey_sm2_cleanup(dst);

crypto/ec/ec_lib.c:233:1: Parameter `a->cofactor->top`
  231.   }
  232.   
  233. > EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)
  234.   {
  235.       EC_GROUP *t = NULL;

crypto/ec/ec_lib.c:243:10: Call
  241.       if ((t = EC_GROUP_new(a->meth)) == NULL)
  242.           return NULL;
  243.       if (!EC_GROUP_copy(t, a))
                  ^
  244.           goto err;
  245.   

crypto/ec/ec_lib.c:130:1: Parameter `src->cofactor->top`
    128.   }
    129.   
    130. > int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
    131.   {
    132.       if (dest->meth->group_copy == 0) {

crypto/ec/ec_lib.c:208:14: Call
    206.           if (!BN_copy(dest->order, src->order))
    207.               return 0;
    208.           if (!BN_copy(dest->cofactor, src->cofactor))
                        ^
    209.               return 0;
    210.       }

crypto/bn/bn_lib.c:280:1: <Offset trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `b->top`
      278.   }
      279.   
      280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      281.   {
      282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: <Length trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `*a->d`
      278.   }
      279.   
      280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      281.   {
      282.       bn_check_top(b);

crypto/bn/bn_lib.c:286:9: Call
      284.       if (a == b)
      285.           return a;
      286.       if (bn_wexpand(a, b->top) == NULL)
                     ^
      287.           return NULL;
      288.   

crypto/bn/bn_lib.c:942:1: Parameter `*a->d`
        940.   }
        941.   
        942. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
        943.   {
        944.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:290:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `EC_GROUP_dup` 
      288.   
      289.       if (b->top > 0)
      290.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      291.   
      292.       a->neg = b->neg;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->neg = b->neg;
    a->top = b->top;
    a->flags |= b->flags & BN_FLG_FIXED_TOP;
    bn_check_top(a);
    return a;
}
['static int pkey_sm2_copy(EVP_PKEY_CTX *dst, EVP_PKEY_CTX *src)\n{\n    SM2_PKEY_CTX *dctx, *sctx;\n    if (!pkey_sm2_init(dst))\n        return 0;\n    sctx = src->data;\n    dctx = dst->data;\n    if (sctx->gen_group != NULL) {\n        dctx->gen_group = EC_GROUP_dup(sctx->gen_group);\n        if (dctx->gen_group == NULL) {\n            pkey_sm2_cleanup(dst);\n            return 0;\n        }\n    }\n    dctx->md = sctx->md;\n    return 1;\n}', 'EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)\n{\n    EC_GROUP *t = NULL;\n    int ok = 0;\n    if (a == NULL)\n        return NULL;\n    if ((t = EC_GROUP_new(a->meth)) == NULL)\n        return NULL;\n    if (!EC_GROUP_copy(t, a))\n        goto err;\n    ok = 1;\n err:\n    if (!ok) {\n        EC_GROUP_free(t);\n        return NULL;\n    }\n        return t;\n}', 'int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)\n{\n    if (dest->meth->group_copy == 0) {\n        ECerr(EC_F_EC_GROUP_COPY, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);\n        return 0;\n    }\n    if (dest->meth != src->meth) {\n        ECerr(EC_F_EC_GROUP_COPY, EC_R_INCOMPATIBLE_OBJECTS);\n        return 0;\n    }\n    if (dest == src)\n        return 1;\n    dest->curve_name = src->curve_name;\n    dest->pre_comp_type = src->pre_comp_type;\n    switch (src->pre_comp_type) {\n    case PCT_none:\n        dest->pre_comp.ec = NULL;\n        break;\n    case PCT_nistz256:\n#ifdef ECP_NISTZ256_ASM\n        dest->pre_comp.nistz256 = EC_nistz256_pre_comp_dup(src->pre_comp.nistz256);\n#endif\n        break;\n#ifndef OPENSSL_NO_EC_NISTP_64_GCC_128\n    case PCT_nistp224:\n        dest->pre_comp.nistp224 = EC_nistp224_pre_comp_dup(src->pre_comp.nistp224);\n        break;\n    case PCT_nistp256:\n        dest->pre_comp.nistp256 = EC_nistp256_pre_comp_dup(src->pre_comp.nistp256);\n        break;\n    case PCT_nistp521:\n        dest->pre_comp.nistp521 = EC_nistp521_pre_comp_dup(src->pre_comp.nistp521);\n        break;\n#else\n    case PCT_nistp224:\n    case PCT_nistp256:\n    case PCT_nistp521:\n        break;\n#endif\n    case PCT_ec:\n        dest->pre_comp.ec = EC_ec_pre_comp_dup(src->pre_comp.ec);\n        break;\n    }\n    if (src->mont_data != NULL) {\n        if (dest->mont_data == NULL) {\n            dest->mont_data = BN_MONT_CTX_new();\n            if (dest->mont_data == NULL)\n                return 0;\n        }\n        if (!BN_MONT_CTX_copy(dest->mont_data, src->mont_data))\n            return 0;\n    } else {\n        BN_MONT_CTX_free(dest->mont_data);\n        dest->mont_data = NULL;\n    }\n    if (src->generator != NULL) {\n        if (dest->generator == NULL) {\n            dest->generator = EC_POINT_new(dest);\n            if (dest->generator == NULL)\n                return 0;\n        }\n        if (!EC_POINT_copy(dest->generator, src->generator))\n            return 0;\n    } else {\n        EC_POINT_clear_free(dest->generator);\n        dest->generator = NULL;\n    }\n    if ((src->meth->flags & EC_FLAGS_CUSTOM_CURVE) == 0) {\n        if (!BN_copy(dest->order, src->order))\n            return 0;\n        if (!BN_copy(dest->cofactor, src->cofactor))\n            return 0;\n    }\n    dest->asn1_flag = src->asn1_flag;\n    dest->asn1_form = src->asn1_form;\n    if (src->seed) {\n        OPENSSL_free(dest->seed);\n        if ((dest->seed = OPENSSL_malloc(src->seed_len)) == NULL) {\n            ECerr(EC_F_EC_GROUP_COPY, ERR_R_MALLOC_FAILURE);\n            return 0;\n        }\n        if (!memcpy(dest->seed, src->seed, src->seed_len))\n            return 0;\n        dest->seed_len = src->seed_len;\n    } else {\n        OPENSSL_free(dest->seed);\n        dest->seed = NULL;\n        dest->seed_len = 0;\n    }\n    return dest->meth->group_copy(dest, src);\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->neg = b->neg;\n    a->top = b->top;\n    a->flags |= b->flags & BN_FLG_FIXED_TOP;\n    bn_check_top(a);\n    return a;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']