crypto/ec/ecp_smpl.c:566: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `BN_mod_sqr`.
Showing all 16 steps of the trace


crypto/ec/ecp_smpl.c:494:1: Parameter `ctx->stack.depth`
492.   }
493.   
494. > int ec_GFp_simple_point_get_affine_coordinates(const EC_GROUP *group,
495.                                                  const EC_POINT *point,
496.                                                  BIGNUM *x, BIGNUM *y,

crypto/ec/ecp_smpl.c:516:5: Call
514.       }
515.   
516.       BN_CTX_start(ctx);
           ^
517.       Z = BN_CTX_get(ctx);
518.       Z_1 = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:181:1: Parameter `ctx->stack.depth`
  179.   }
  180.   
  181. > void BN_CTX_start(BN_CTX *ctx)
  182.   {
  183.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/ec/ecp_smpl.c:566:18: Call
564.                   goto err;
565.           } else {
566.               if (!BN_mod_sqr(Z_2, Z_1, group->field, ctx))
                        ^
567.                   goto err;
568.           }

crypto/bn/bn_mod.c:102:1: Parameter `ctx->stack.depth`
  100.   }
  101.   
  102. > int BN_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx)
  103.   {
  104.       if (!BN_sqr(r, a, ctx))

crypto/bn/bn_mod.c:104:10: Call
  102.   int BN_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx)
  103.   {
  104.       if (!BN_sqr(r, a, ctx))
                  ^
  105.           return 0;
  106.       /* r->neg == 0,  thus we don't need BN_nnmod */

crypto/bn/bn_sqr.c:32:5: Call
    30.       }
    31.   
    32.       BN_CTX_start(ctx);
              ^
    33.       rr = (a != r) ? r : BN_CTX_get(ctx);
    34.       tmp = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:181:1: Parameter `*ctx->stack.indexes`
      179.   }
      180.   
      181. > void BN_CTX_start(BN_CTX *ctx)
      182.   {
      183.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_sqr.c:99:5: Call
    97.       bn_check_top(rr);
    98.       bn_check_top(tmp);
    99.       BN_CTX_end(ctx);
               ^
    100.       return (ret);
    101.   }

crypto/bn/bn_ctx.c:195:1: Parameter `*ctx->stack.indexes`
      193.   }
      194.   
      195. > void BN_CTX_end(BN_CTX *ctx)
      196.   {
      197.       CTXDBG_ENTRY("BN_CTX_end", ctx);

crypto/bn/bn_ctx.c:201:27: Call
      199.           ctx->err_stack--;
      200.       else {
      201.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                       ^
      202.           /* Does this stack frame have anything to release? */
      203.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:271:1: <Offset trace>
269.   }
270.   
271. > static unsigned int BN_STACK_pop(BN_STACK *st)
272.   {
273.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:271:1: Parameter `st->depth`
        269.   }
        270.   
        271. > static unsigned int BN_STACK_pop(BN_STACK *st)
        272.   {
        273.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:271:1: <Length trace>
269.   }
270.   
271. > static unsigned int BN_STACK_pop(BN_STACK *st)
272.   {
273.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:271:1: Parameter `*st->indexes`
        269.   }
        270.   
        271. > static unsigned int BN_STACK_pop(BN_STACK *st)
        272.   {
        273.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:273:12: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `BN_mod_sqr` 
        271.   static unsigned int BN_STACK_pop(BN_STACK *st)
        272.   {
        273.       return st->indexes[--(st->depth)];
                          ^
        274.   }
        275.   

static unsigned int BN_STACK_pop(BN_STACK *st)
{
    return st->indexes[--(st->depth)];
}
['int ec_GFp_simple_point_get_affine_coordinates(const EC_GROUP *group,\n                                               const EC_POINT *point,\n                                               BIGNUM *x, BIGNUM *y,\n                                               BN_CTX *ctx)\n{\n    BN_CTX *new_ctx = NULL;\n    BIGNUM *Z, *Z_1, *Z_2, *Z_3;\n    const BIGNUM *Z_;\n    int ret = 0;\n    if (EC_POINT_is_at_infinity(group, point)) {\n        ECerr(EC_F_EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES,\n              EC_R_POINT_AT_INFINITY);\n        return 0;\n    }\n    if (ctx == NULL) {\n        ctx = new_ctx = BN_CTX_new();\n        if (ctx == NULL)\n            return 0;\n    }\n    BN_CTX_start(ctx);\n    Z = BN_CTX_get(ctx);\n    Z_1 = BN_CTX_get(ctx);\n    Z_2 = BN_CTX_get(ctx);\n    Z_3 = BN_CTX_get(ctx);\n    if (Z_3 == NULL)\n        goto err;\n    if (group->meth->field_decode) {\n        if (!group->meth->field_decode(group, Z, point->Z, ctx))\n            goto err;\n        Z_ = Z;\n    } else {\n        Z_ = point->Z;\n    }\n    if (BN_is_one(Z_)) {\n        if (group->meth->field_decode) {\n            if (x != NULL) {\n                if (!group->meth->field_decode(group, x, point->X, ctx))\n                    goto err;\n            }\n            if (y != NULL) {\n                if (!group->meth->field_decode(group, y, point->Y, ctx))\n                    goto err;\n            }\n        } else {\n            if (x != NULL) {\n                if (!BN_copy(x, point->X))\n                    goto err;\n            }\n            if (y != NULL) {\n                if (!BN_copy(y, point->Y))\n                    goto err;\n            }\n        }\n    } else {\n        if (!BN_mod_inverse(Z_1, Z_, group->field, ctx)) {\n            ECerr(EC_F_EC_GFP_SIMPLE_POINT_GET_AFFINE_COORDINATES,\n                  ERR_R_BN_LIB);\n            goto err;\n        }\n        if (group->meth->field_encode == 0) {\n            if (!group->meth->field_sqr(group, Z_2, Z_1, ctx))\n                goto err;\n        } else {\n            if (!BN_mod_sqr(Z_2, Z_1, group->field, ctx))\n                goto err;\n        }\n        if (x != NULL) {\n            if (!group->meth->field_mul(group, x, point->X, Z_2, ctx))\n                goto err;\n        }\n        if (y != NULL) {\n            if (group->meth->field_encode == 0) {\n                if (!group->meth->field_mul(group, Z_3, Z_2, Z_1, ctx))\n                    goto err;\n            } else {\n                if (!BN_mod_mul(Z_3, Z_2, Z_1, group->field, ctx))\n                    goto err;\n            }\n            if (!group->meth->field_mul(group, y, point->Y, Z_3, ctx))\n                goto err;\n        }\n    }\n    ret = 1;\n err:\n    BN_CTX_end(ctx);\n    BN_CTX_free(new_ctx);\n    return ret;\n}', 'void BN_CTX_start(BN_CTX *ctx)\n{\n    CTXDBG_ENTRY("BN_CTX_start", ctx);\n    if (ctx->err_stack || ctx->too_many)\n        ctx->err_stack++;\n    else if (!BN_STACK_push(&ctx->stack, ctx->used)) {\n        BNerr(BN_F_BN_CTX_START, BN_R_TOO_MANY_TEMPORARY_VARIABLES);\n        ctx->err_stack++;\n    }\n    CTXDBG_EXIT(ctx);\n}', 'int BN_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx)\n{\n    if (!BN_sqr(r, a, ctx))\n        return 0;\n    return BN_mod(r, r, m, ctx);\n}', 'int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)\n{\n    int max, al;\n    int ret = 0;\n    BIGNUM *tmp, *rr;\n    bn_check_top(a);\n    al = a->top;\n    if (al <= 0) {\n        r->top = 0;\n        r->neg = 0;\n        return 1;\n    }\n    BN_CTX_start(ctx);\n    rr = (a != r) ? r : BN_CTX_get(ctx);\n    tmp = BN_CTX_get(ctx);\n    if (!rr || !tmp)\n        goto err;\n    max = 2 * al;\n    if (bn_wexpand(rr, max) == NULL)\n        goto err;\n    if (al == 4) {\n#ifndef BN_SQR_COMBA\n        BN_ULONG t[8];\n        bn_sqr_normal(rr->d, a->d, 4, t);\n#else\n        bn_sqr_comba4(rr->d, a->d);\n#endif\n    } else if (al == 8) {\n#ifndef BN_SQR_COMBA\n        BN_ULONG t[16];\n        bn_sqr_normal(rr->d, a->d, 8, t);\n#else\n        bn_sqr_comba8(rr->d, a->d);\n#endif\n    } else {\n#if defined(BN_RECURSION)\n        if (al < BN_SQR_RECURSIVE_SIZE_NORMAL) {\n            BN_ULONG t[BN_SQR_RECURSIVE_SIZE_NORMAL * 2];\n            bn_sqr_normal(rr->d, a->d, al, t);\n        } else {\n            int j, k;\n            j = BN_num_bits_word((BN_ULONG)al);\n            j = 1 << (j - 1);\n            k = j + j;\n            if (al == j) {\n                if (bn_wexpand(tmp, k * 2) == NULL)\n                    goto err;\n                bn_sqr_recursive(rr->d, a->d, al, tmp->d);\n            } else {\n                if (bn_wexpand(tmp, max) == NULL)\n                    goto err;\n                bn_sqr_normal(rr->d, a->d, al, tmp->d);\n            }\n        }\n#else\n        if (bn_wexpand(tmp, max) == NULL)\n            goto err;\n        bn_sqr_normal(rr->d, a->d, al, tmp->d);\n#endif\n    }\n    rr->neg = 0;\n    if (a->d[al - 1] == (a->d[al - 1] & BN_MASK2l))\n        rr->top = max - 1;\n    else\n        rr->top = max;\n    if (rr != r)\n        BN_copy(r, rr);\n    ret = 1;\n err:\n    bn_check_top(rr);\n    bn_check_top(tmp);\n    BN_CTX_end(ctx);\n    return (ret);\n}', 'void BN_CTX_end(BN_CTX *ctx)\n{\n    CTXDBG_ENTRY("BN_CTX_end", ctx);\n    if (ctx->err_stack)\n        ctx->err_stack--;\n    else {\n        unsigned int fp = BN_STACK_pop(&ctx->stack);\n        if (fp < ctx->used)\n            BN_POOL_release(&ctx->pool, ctx->used - fp);\n        ctx->used = fp;\n        ctx->too_many = 0;\n    }\n    CTXDBG_EXIT(ctx);\n}', 'static unsigned int BN_STACK_pop(BN_STACK *st)\n{\n    return st->indexes[--(st->depth)];\n}']