test/ecdhtest.c:343: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `EC_KEY_set_private_key`.
Showing all 14 steps of the trace


test/ecdhtest.c:339:9: Call
337.       if (!k)
338.           goto err;
339.       if(!BN_hex2bn(&priv, str))
               ^
340.           goto err;
341.       if (!priv)

crypto/bn/bn_print.c:126:1: Parameter `(*bn)->top`
  124.   }
  125.   
  126. > int BN_hex2bn(BIGNUM **bn, const char *a)
  127.   {
  128.       BIGNUM *ret = NULL;

test/ecdhtest.c:343:10: Call
341.       if (!priv)
342.           goto err;
343.       if (!EC_KEY_set_private_key(k, priv))
                ^
344.           goto err;
345.       grp = EC_KEY_get0_group(k);

crypto/ec/ec_key.c:438:1: Parameter `priv_key->top`
  436.   }
  437.   
  438. > int EC_KEY_set_private_key(EC_KEY *key, const BIGNUM *priv_key)
  439.   {
  440.       if (key->group == NULL || key->group->meth == NULL)

crypto/ec/ec_key.c:449:21: Call
  447.           return 0;
  448.       BN_clear_free(key->priv_key);
  449.       key->priv_key = BN_dup(priv_key);
                             ^
  450.       return (key->priv_key == NULL) ? 0 : 1;
  451.   }

crypto/bn/bn_lib.c:304:1: Parameter `a->top`
    302.   }
    303.   
    304. > BIGNUM *BN_dup(const BIGNUM *a)
    305.   {
    306.       BIGNUM *t;

crypto/bn/bn_lib.c:315:10: Call
    313.       if (t == NULL)
    314.           return NULL;
    315.       if (!BN_copy(t, a)) {
                    ^
    316.           BN_free(t);
    317.           return NULL;

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
      321.   }
      322.   
      323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      324.   {
      325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
      321.   }
      322.   
      323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      324.   {
      325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
      327.       if (a == b)
      328.           return a;
      329.       if (bn_wexpand(a, b->top) == NULL)
                     ^
      330.           return NULL;
      331.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
        946.   }
        947.   
        948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
        949.   {
        950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `EC_KEY_set_private_key` 
      331.   
      332.       if (b->top > 0)
      333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      334.   
      335.       a->top = b->top;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->top = b->top;
    a->neg = b->neg;
    bn_check_top(a);
    return a;
}
['static EC_KEY *mk_eckey(int nid, const char *str)\n{\n    int ok = 0;\n    EC_KEY *k = NULL;\n    BIGNUM *priv = NULL;\n    EC_POINT *pub = NULL;\n    const EC_GROUP *grp;\n    k = EC_KEY_new_by_curve_name(nid);\n    if (!k)\n        goto err;\n    if(!BN_hex2bn(&priv, str))\n        goto err;\n    if (!priv)\n        goto err;\n    if (!EC_KEY_set_private_key(k, priv))\n        goto err;\n    grp = EC_KEY_get0_group(k);\n    pub = EC_POINT_new(grp);\n    if (!pub)\n        goto err;\n    if (!EC_POINT_mul(grp, pub, priv, NULL, NULL, NULL))\n        goto err;\n    if (!EC_KEY_set_public_key(k, pub))\n        goto err;\n    ok = 1;\n err:\n    BN_clear_free(priv);\n    EC_POINT_free(pub);\n    if (ok)\n        return k;\n    EC_KEY_free(k);\n    return NULL;\n}', "int BN_hex2bn(BIGNUM **bn, const char *a)\n{\n    BIGNUM *ret = NULL;\n    BN_ULONG l = 0;\n    int neg = 0, h, m, i, j, k, c;\n    int num;\n    if ((a == NULL) || (*a == '\\0'))\n        return (0);\n    if (*a == '-') {\n        neg = 1;\n        a++;\n    }\n    for (i = 0; i <= (INT_MAX/4) && isxdigit((unsigned char)a[i]); i++)\n        continue;\n    if (i == 0 || i > INT_MAX/4)\n        goto err;\n    num = i + neg;\n    if (bn == NULL)\n        return (num);\n    if (*bn == NULL) {\n        if ((ret = BN_new()) == NULL)\n            return (0);\n    } else {\n        ret = *bn;\n        BN_zero(ret);\n    }\n    if (bn_expand(ret, i * 4) == NULL)\n        goto err;\n    j = i;\n    m = 0;\n    h = 0;\n    while (j > 0) {\n        m = ((BN_BYTES * 2) <= j) ? (BN_BYTES * 2) : j;\n        l = 0;\n        for (;;) {\n            c = a[j - m];\n            k = OPENSSL_hexchar2int(c);\n            if (k < 0)\n                k = 0;\n            l = (l << 4) | k;\n            if (--m <= 0) {\n                ret->d[h++] = l;\n                break;\n            }\n        }\n        j -= (BN_BYTES * 2);\n    }\n    ret->top = h;\n    bn_correct_top(ret);\n    *bn = ret;\n    bn_check_top(ret);\n    if (ret->top != 0)\n        ret->neg = neg;\n    return (num);\n err:\n    if (*bn == NULL)\n        BN_free(ret);\n    return (0);\n}", 'int EC_KEY_set_private_key(EC_KEY *key, const BIGNUM *priv_key)\n{\n    if (key->group == NULL || key->group->meth == NULL)\n        return 0;\n    if (key->group->meth->set_private != NULL\n        && key->group->meth->set_private(key, priv_key) == 0)\n        return 0;\n    if (key->meth->set_private != NULL\n        && key->meth->set_private(key, priv_key) == 0)\n        return 0;\n    BN_clear_free(key->priv_key);\n    key->priv_key = BN_dup(priv_key);\n    return (key->priv_key == NULL) ? 0 : 1;\n}', 'BIGNUM *BN_dup(const BIGNUM *a)\n{\n    BIGNUM *t;\n    if (a == NULL)\n        return NULL;\n    bn_check_top(a);\n    t = BN_get_flags(a, BN_FLG_SECURE) ? BN_secure_new() : BN_new();\n    if (t == NULL)\n        return NULL;\n    if (!BN_copy(t, a)) {\n        BN_free(t);\n        return NULL;\n    }\n    bn_check_top(t);\n    return t;\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->top = b->top;\n    a->neg = b->neg;\n    bn_check_top(a);\n    return a;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']