crypto/ec/ecp_smpl.c:159: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_copy`.
Showing all 14 steps of the trace


crypto/ec/ecp_smpl.c:133:1: Parameter `p->top`
131.   }
132.   
133. > int ec_GFp_simple_group_set_curve(EC_GROUP *group,
134.                                     const BIGNUM *p, const BIGNUM *a,
135.                                     const BIGNUM *b, BN_CTX *ctx)

crypto/ec/ecp_smpl.c:142:9: Call
140.   
141.       /* p must be a prime > 3 */
142.       if (BN_num_bits(p) <= 2 || !BN_is_odd(p)) {
               ^
143.           ECerr(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE, EC_R_INVALID_FIELD);
144.           return 0;

crypto/bn/bn_lib.c:166:9: Call
  164.       bn_check_top(a);
  165.   
  166.       if (BN_is_zero(a))
                 ^
  167.           return 0;
  168.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));

crypto/bn/bn_lib.c:852:1: Parameter `a->top`
    850.   }
    851.   
    852. > int BN_is_zero(const BIGNUM *a)
    853.   {
    854.       return a->top == 0;

crypto/ec/ecp_smpl.c:142:33: Call
140.   
141.       /* p must be a prime > 3 */
142.       if (BN_num_bits(p) <= 2 || !BN_is_odd(p)) {
                                       ^
143.           ECerr(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE, EC_R_INVALID_FIELD);
144.           return 0;

crypto/bn/bn_lib.c:867:1: Parameter `a->top`
  865.   }
  866.   
  867. > int BN_is_odd(const BIGNUM *a)
  868.   {
  869.       return (a->top > 0) && (a->d[0] & 1);

crypto/ec/ecp_smpl.c:159:10: Call
157.   
158.       /* group->field */
159.       if (!BN_copy(group->field, p))
                ^
160.           goto err;
161.       BN_set_negative(group->field, 0);

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
  321.   }
  322.   
  323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  324.   {
  325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
  321.   }
  322.   
  323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  324.   {
  325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
  327.       if (a == b)
  328.           return a;
  329.       if (bn_wexpand(a, b->top) == NULL)
                 ^
  330.           return NULL;
  331.   

crypto/bn/bn_lib.c:948:1: Parameter `*a->d`
    946.   }
    947.   
    948. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
    949.   {
    950.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_copy` 
  331.   
  332.       if (b->top > 0)
  333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                 ^
  334.   
  335.       a->top = b->top;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->top = b->top;
    a->neg = b->neg;
    bn_check_top(a);
    return a;
}
['int ec_GFp_simple_group_set_curve(EC_GROUP *group,\n                                  const BIGNUM *p, const BIGNUM *a,\n                                  const BIGNUM *b, BN_CTX *ctx)\n{\n    int ret = 0;\n    BN_CTX *new_ctx = NULL;\n    BIGNUM *tmp_a;\n    if (BN_num_bits(p) <= 2 || !BN_is_odd(p)) {\n        ECerr(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE, EC_R_INVALID_FIELD);\n        return 0;\n    }\n    if (ctx == NULL) {\n        ctx = new_ctx = BN_CTX_new();\n        if (ctx == NULL)\n            return 0;\n    }\n    BN_CTX_start(ctx);\n    tmp_a = BN_CTX_get(ctx);\n    if (tmp_a == NULL)\n        goto err;\n    if (!BN_copy(group->field, p))\n        goto err;\n    BN_set_negative(group->field, 0);\n    if (!BN_nnmod(tmp_a, a, p, ctx))\n        goto err;\n    if (group->meth->field_encode) {\n        if (!group->meth->field_encode(group, group->a, tmp_a, ctx))\n            goto err;\n    } else if (!BN_copy(group->a, tmp_a))\n        goto err;\n    if (!BN_nnmod(group->b, b, p, ctx))\n        goto err;\n    if (group->meth->field_encode)\n        if (!group->meth->field_encode(group, group->b, group->b, ctx))\n            goto err;\n    if (!BN_add_word(tmp_a, 3))\n        goto err;\n    group->a_is_minus3 = (0 == BN_cmp(tmp_a, group->field));\n    ret = 1;\n err:\n    BN_CTX_end(ctx);\n    BN_CTX_free(new_ctx);\n    return ret;\n}', 'int BN_num_bits(const BIGNUM *a)\n{\n    int i = a->top - 1;\n    bn_check_top(a);\n    if (BN_is_zero(a))\n        return 0;\n    return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));\n}', 'int BN_is_zero(const BIGNUM *a)\n{\n    return a->top == 0;\n}', 'int BN_is_odd(const BIGNUM *a)\n{\n    return (a->top > 0) && (a->d[0] & 1);\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->top = b->top;\n    a->neg = b->neg;\n    bn_check_top(a);\n    return a;\n}', 'BIGNUM *bn_wexpand(BIGNUM *a, int words)\n{\n    return (words <= a->dmax) ? a : bn_expand2(a, words);\n}']