crypto/ec/ec_curve.c:3098: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_set_word`.
Showing all 7 steps of the trace


crypto/ec/ec_curve.c:3061:23: Call
3059.       if (curve.meth != 0) {
3060.           meth = curve.meth();
3061.           if (((group = EC_GROUP_new(meth)) == NULL) ||
                              ^
3062.               (!(group->meth->group_set_curve(group, p, a, b, ctx)))) {
3063.               ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);

crypto/ec/ec_lib.c:106:5: Call
  104.   
  105.    err:
  106.       BN_free(ret->order);
             ^
  107.       BN_free(ret->cofactor);
  108.       OPENSSL_free(ret);

crypto/bn/bn_lib.c:252:1: Parameter `*a->d`
    250.   }
    251.   
    252. > void BN_free(BIGNUM *a)
    253.   {
    254.       if (a == NULL)

crypto/ec/ec_curve.c:3098:13: Call
3096.       }
3097.       if ((order = BN_bin2bn(params + 5 * param_len, param_len, NULL)) == NULL
3098.           || !BN_set_word(x, (BN_ULONG)data->cofactor)) {
                    ^
3099.           ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);
3100.           goto err;

crypto/bn/bn_lib.c:530:1: <Length trace>
528.   }
529.   
530. > int BN_set_word(BIGNUM *a, BN_ULONG w)
531.   {
532.       bn_check_top(a);

crypto/bn/bn_lib.c:530:1: Parameter `*a->d`
  528.   }
  529.   
  530. > int BN_set_word(BIGNUM *a, BN_ULONG w)
  531.   {
  532.       bn_check_top(a);

crypto/bn/bn_lib.c:536:5: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_set_word` 
  534.           return (0);
  535.       a->neg = 0;
  536.       a->d[0] = w;
             ^
  537.       a->top = (w ? 1 : 0);
  538.       bn_check_top(a);

int BN_set_word(BIGNUM *a, BN_ULONG w)
{
    bn_check_top(a);
    if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
        return (0);
    a->neg = 0;
    a->d[0] = w;
    a->top = (w ? 1 : 0);
    bn_check_top(a);
    return (1);
}
['static EC_GROUP *ec_group_new_from_data(const ec_list_element curve)\n{\n    EC_GROUP *group = NULL;\n    EC_POINT *P = NULL;\n    BN_CTX *ctx = NULL;\n    BIGNUM *p = NULL, *a = NULL, *b = NULL, *x = NULL, *y = NULL, *order =\n        NULL;\n    int ok = 0;\n    int seed_len, param_len;\n    const EC_METHOD *meth;\n    const EC_CURVE_DATA *data;\n    const unsigned char *params;\n    if ((ctx = BN_CTX_new()) == NULL) {\n        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    data = curve.data;\n    seed_len = data->seed_len;\n    param_len = data->param_len;\n    params = (const unsigned char *)(data + 1);\n    params += seed_len;\n    if ((p = BN_bin2bn(params + 0 * param_len, param_len, NULL)) == NULL\n        || (a = BN_bin2bn(params + 1 * param_len, param_len, NULL)) == NULL\n        || (b = BN_bin2bn(params + 2 * param_len, param_len, NULL)) == NULL) {\n        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);\n        goto err;\n    }\n    if (curve.meth != 0) {\n        meth = curve.meth();\n        if (((group = EC_GROUP_new(meth)) == NULL) ||\n            (!(group->meth->group_set_curve(group, p, a, b, ctx)))) {\n            ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);\n            goto err;\n        }\n    } else if (data->field_type == NID_X9_62_prime_field) {\n        if ((group = EC_GROUP_new_curve_GFp(p, a, b, ctx)) == NULL) {\n            ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);\n            goto err;\n        }\n    }\n#ifndef OPENSSL_NO_EC2M\n    else {\n        if ((group = EC_GROUP_new_curve_GF2m(p, a, b, ctx)) == NULL) {\n            ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);\n            goto err;\n        }\n    }\n#endif\n    if ((P = EC_POINT_new(group)) == NULL) {\n        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);\n        goto err;\n    }\n    if ((x = BN_bin2bn(params + 3 * param_len, param_len, NULL)) == NULL\n        || (y = BN_bin2bn(params + 4 * param_len, param_len, NULL)) == NULL) {\n        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);\n        goto err;\n    }\n    if (!EC_POINT_set_affine_coordinates_GFp(group, P, x, y, ctx)) {\n        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);\n        goto err;\n    }\n    if ((order = BN_bin2bn(params + 5 * param_len, param_len, NULL)) == NULL\n        || !BN_set_word(x, (BN_ULONG)data->cofactor)) {\n        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);\n        goto err;\n    }\n    if (!EC_GROUP_set_generator(group, P, order, x)) {\n        ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);\n        goto err;\n    }\n    if (seed_len) {\n        if (!EC_GROUP_set_seed(group, params - seed_len, seed_len)) {\n            ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);\n            goto err;\n        }\n    }\n    ok = 1;\n err:\n    if (!ok) {\n        EC_GROUP_free(group);\n        group = NULL;\n    }\n    EC_POINT_free(P);\n    BN_CTX_free(ctx);\n    BN_free(p);\n    BN_free(a);\n    BN_free(b);\n    BN_free(order);\n    BN_free(x);\n    BN_free(y);\n    return group;\n}', 'EC_GROUP *EC_GROUP_new(const EC_METHOD *meth)\n{\n    EC_GROUP *ret;\n    if (meth == NULL) {\n        ECerr(EC_F_EC_GROUP_NEW, EC_R_SLOT_FULL);\n        return NULL;\n    }\n    if (meth->group_init == 0) {\n        ECerr(EC_F_EC_GROUP_NEW, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);\n        return NULL;\n    }\n    ret = OPENSSL_zalloc(sizeof(*ret));\n    if (ret == NULL) {\n        ECerr(EC_F_EC_GROUP_NEW, ERR_R_MALLOC_FAILURE);\n        return NULL;\n    }\n    ret->meth = meth;\n    ret->order = BN_new();\n    if (ret->order == NULL)\n        goto err;\n    ret->cofactor = BN_new();\n    if (ret->cofactor == NULL)\n        goto err;\n    ret->asn1_flag = OPENSSL_EC_NAMED_CURVE;\n    ret->asn1_form = POINT_CONVERSION_UNCOMPRESSED;\n    if (!meth->group_init(ret))\n        goto err;\n    return ret;\n err:\n    BN_free(ret->order);\n    BN_free(ret->cofactor);\n    OPENSSL_free(ret);\n    return NULL;\n}', 'void BN_free(BIGNUM *a)\n{\n    if (a == NULL)\n        return;\n    bn_check_top(a);\n    if (!BN_get_flags(a, BN_FLG_STATIC_DATA))\n        bn_free_d(a);\n    if (a->flags & BN_FLG_MALLOCED)\n        OPENSSL_free(a);\n    else {\n#if OPENSSL_API_COMPAT < 0x00908000L\n        a->flags |= BN_FLG_FREE;\n#endif\n        a->d = NULL;\n    }\n}', 'int BN_set_word(BIGNUM *a, BN_ULONG w)\n{\n    bn_check_top(a);\n    if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)\n        return (0);\n    a->neg = 0;\n    a->d[0] = w;\n    a->top = (w ? 1 : 0);\n    bn_check_top(a);\n    return (1);\n}']