crypto/ec/ecp_nistz256.c:891: error: BUFFER_OVERRUN_L3
  Offset: [-1, +oo] Size: [1, +oo] by call to `BN_CTX_end`.
Showing all 9 steps of the trace


crypto/ec/ecp_nistz256.c:777:8: Parameter `ctx->stack.depth`
775.   }
776.   
777.   __owur static int ecp_nistz256_mult_precompute(EC_GROUP *group, BN_CTX *ctx)
              ^
778.   {
779.       /*

crypto/ec/ecp_nistz256.c:891:5: Call
889.   
890.    err:
891.       BN_CTX_end(ctx);
           ^
892.       BN_CTX_free(new_ctx);
893.   

crypto/bn/bn_ctx.c:185:1: Parameter `*ctx->stack.indexes`
  183.   }
  184.   
  185. > void BN_CTX_end(BN_CTX *ctx)
  186.   {
  187.       if (ctx == NULL)

crypto/bn/bn_ctx.c:193:27: Call
  191.           ctx->err_stack--;
  192.       else {
  193.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                   ^
  194.           /* Does this stack frame have anything to release? */
  195.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:268:1: <Offset trace>
266.   }
267.   
268. > static unsigned int BN_STACK_pop(BN_STACK *st)
269.   {
270.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:268:1: Parameter `st->depth`
    266.   }
    267.   
    268. > static unsigned int BN_STACK_pop(BN_STACK *st)
    269.   {
    270.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:268:1: <Length trace>
266.   }
267.   
268. > static unsigned int BN_STACK_pop(BN_STACK *st)
269.   {
270.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:268:1: Parameter `*st->indexes`
    266.   }
    267.   
    268. > static unsigned int BN_STACK_pop(BN_STACK *st)
    269.   {
    270.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:270:12: Array access: Offset: [-1, +oo] Size: [1, +oo] by call to `BN_CTX_end` 
    268.   static unsigned int BN_STACK_pop(BN_STACK *st)
    269.   {
    270.       return st->indexes[--(st->depth)];
                      ^
    271.   }
    272.   

static unsigned int BN_STACK_pop(BN_STACK *st)
{
    return st->indexes[--(st->depth)];
}
['static int ecp_nistz256_mult_precompute(EC_GROUP *group, BN_CTX *ctx)\n{\n    const BIGNUM *order;\n    EC_POINT *P = NULL, *T = NULL;\n    const EC_POINT *generator;\n    NISTZ256_PRE_COMP *pre_comp;\n    BN_CTX *new_ctx = NULL;\n    int i, j, k, ret = 0;\n    size_t w;\n    PRECOMP256_ROW *preComputedTable = NULL;\n    unsigned char *precomp_storage = NULL;\n    EC_pre_comp_free(group);\n    generator = EC_GROUP_get0_generator(group);\n    if (generator == NULL) {\n        ECerr(EC_F_ECP_NISTZ256_MULT_PRECOMPUTE, EC_R_UNDEFINED_GENERATOR);\n        return 0;\n    }\n    if (ecp_nistz256_is_affine_G(generator)) {\n        return 1;\n    }\n    if ((pre_comp = ecp_nistz256_pre_comp_new(group)) == NULL)\n        return 0;\n    if (ctx == NULL) {\n        ctx = new_ctx = BN_CTX_new();\n        if (ctx == NULL)\n            goto err;\n    }\n    BN_CTX_start(ctx);\n    order = EC_GROUP_get0_order(group);\n    if (order == NULL)\n        goto err;\n    if (BN_is_zero(order)) {\n        ECerr(EC_F_ECP_NISTZ256_MULT_PRECOMPUTE, EC_R_UNKNOWN_ORDER);\n        goto err;\n    }\n    w = 7;\n    if ((precomp_storage =\n         OPENSSL_malloc(37 * 64 * sizeof(P256_POINT_AFFINE) + 64)) == NULL) {\n        ECerr(EC_F_ECP_NISTZ256_MULT_PRECOMPUTE, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    preComputedTable = (void *)ALIGNPTR(precomp_storage, 64);\n    P = EC_POINT_new(group);\n    T = EC_POINT_new(group);\n    if (P == NULL || T == NULL)\n        goto err;\n    if (!EC_POINT_copy(T, generator))\n        goto err;\n    for (k = 0; k < 64; k++) {\n        if (!EC_POINT_copy(P, T))\n            goto err;\n        for (j = 0; j < 37; j++) {\n            P256_POINT_AFFINE temp;\n            if (!EC_POINT_make_affine(group, P, ctx))\n                goto err;\n            if (!ecp_nistz256_bignum_to_field_elem(temp.X, P->X) ||\n                !ecp_nistz256_bignum_to_field_elem(temp.Y, P->Y)) {\n                ECerr(EC_F_ECP_NISTZ256_MULT_PRECOMPUTE,\n                      EC_R_COORDINATES_OUT_OF_RANGE);\n                goto err;\n            }\n            ecp_nistz256_scatter_w7(preComputedTable[j], &temp, k);\n            for (i = 0; i < 7; i++) {\n                if (!EC_POINT_dbl(group, P, P, ctx))\n                    goto err;\n            }\n        }\n        if (!EC_POINT_add(group, T, T, generator, ctx))\n            goto err;\n    }\n    pre_comp->group = group;\n    pre_comp->w = w;\n    pre_comp->precomp = preComputedTable;\n    pre_comp->precomp_storage = precomp_storage;\n    precomp_storage = NULL;\n    SETPRECOMP(group, nistz256, pre_comp);\n    pre_comp = NULL;\n    ret = 1;\n err:\n    BN_CTX_end(ctx);\n    BN_CTX_free(new_ctx);\n    EC_nistz256_pre_comp_free(pre_comp);\n    OPENSSL_free(precomp_storage);\n    EC_POINT_free(P);\n    EC_POINT_free(T);\n    return ret;\n}', 'void BN_CTX_end(BN_CTX *ctx)\n{\n    if (ctx == NULL)\n        return;\n    CTXDBG("ENTER BN_CTX_end()", ctx);\n    if (ctx->err_stack)\n        ctx->err_stack--;\n    else {\n        unsigned int fp = BN_STACK_pop(&ctx->stack);\n        if (fp < ctx->used)\n            BN_POOL_release(&ctx->pool, ctx->used - fp);\n        ctx->used = fp;\n        ctx->too_many = 0;\n    }\n    CTXDBG("LEAVE BN_CTX_end()", ctx);\n}', 'static unsigned int BN_STACK_pop(BN_STACK *st)\n{\n    return st->indexes[--(st->depth)];\n}']