crypto/ec/ec2_smpl.c:687: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_copy`.
Showing all 10 steps of the trace


crypto/ec/ec2_smpl.c:680:9: Call
678.   
679.       BN_CTX_start(ctx);
680.       x = BN_CTX_get(ctx);
               ^
681.       y = BN_CTX_get(ctx);
682.       if (y == NULL)

crypto/bn/bn_ctx.c:229:5: Call
  227.       }
  228.       /* OK, make sure the returned bignum is "zero" */
  229.       BN_zero(ret);
             ^
  230.       ctx->used++;
  231.       CTXDBG_RET(ctx, ret);

crypto/bn/bn_lib.c:365:15: Assignment
    363.       a->neg = 0;
    364.       a->d[0] = w;
    365.       a->top = (w ? 1 : 0);
                         ^
    366.       a->flags &= ~BN_FLG_FIXED_TOP;
    367.       bn_check_top(a);

crypto/bn/bn_lib.c:365:5: Assignment
    363.       a->neg = 0;
    364.       a->d[0] = w;
    365.       a->top = (w ? 1 : 0);
               ^
    366.       a->flags &= ~BN_FLG_FIXED_TOP;
    367.       bn_check_top(a);

crypto/ec/ec2_smpl.c:687:10: Call
685.       if (!EC_POINT_get_affine_coordinates_GF2m(group, point, x, y, ctx))
686.           goto err;
687.       if (!BN_copy(point->X, x))
                ^
688.           goto err;
689.       if (!BN_copy(point->Y, y))

crypto/bn/bn_lib.c:280:1: <Offset trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `b->top`
  278.   }
  279.   
  280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  281.   {
  282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: <Length trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `*b->d`
  278.   }
  279.   
  280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  281.   {
  282.       bn_check_top(b);

crypto/bn/bn_lib.c:290:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_copy` 
  288.   
  289.       if (b->top > 0)
  290.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                 ^
  291.   
  292.       a->neg = b->neg;

BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
{
    bn_check_top(b);
    if (a == b)
        return a;
    if (bn_wexpand(a, b->top) == NULL)
        return NULL;
    if (b->top > 0)
        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
    a->neg = b->neg;
    a->top = b->top;
    a->flags |= b->flags & BN_FLG_FIXED_TOP;
    bn_check_top(a);
    return a;
}
['int ec_GF2m_simple_make_affine(const EC_GROUP *group, EC_POINT *point,\n                               BN_CTX *ctx)\n{\n    BN_CTX *new_ctx = NULL;\n    BIGNUM *x, *y;\n    int ret = 0;\n    if (point->Z_is_one || EC_POINT_is_at_infinity(group, point))\n        return 1;\n    if (ctx == NULL) {\n        ctx = new_ctx = BN_CTX_new();\n        if (ctx == NULL)\n            return 0;\n    }\n    BN_CTX_start(ctx);\n    x = BN_CTX_get(ctx);\n    y = BN_CTX_get(ctx);\n    if (y == NULL)\n        goto err;\n    if (!EC_POINT_get_affine_coordinates_GF2m(group, point, x, y, ctx))\n        goto err;\n    if (!BN_copy(point->X, x))\n        goto err;\n    if (!BN_copy(point->Y, y))\n        goto err;\n    if (!BN_one(point->Z))\n        goto err;\n    point->Z_is_one = 1;\n    ret = 1;\n err:\n    BN_CTX_end(ctx);\n    BN_CTX_free(new_ctx);\n    return ret;\n}', 'BIGNUM *BN_CTX_get(BN_CTX *ctx)\n{\n    BIGNUM *ret;\n    CTXDBG_ENTRY("BN_CTX_get", ctx);\n    if (ctx->err_stack || ctx->too_many)\n        return NULL;\n    if ((ret = BN_POOL_get(&ctx->pool, ctx->flags)) == NULL) {\n        ctx->too_many = 1;\n        BNerr(BN_F_BN_CTX_GET, BN_R_TOO_MANY_TEMPORARY_VARIABLES);\n        return NULL;\n    }\n    BN_zero(ret);\n    ctx->used++;\n    CTXDBG_RET(ctx, ret);\n    return ret;\n}', 'int BN_set_word(BIGNUM *a, BN_ULONG w)\n{\n    bn_check_top(a);\n    if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)\n        return 0;\n    a->neg = 0;\n    a->d[0] = w;\n    a->top = (w ? 1 : 0);\n    a->flags &= ~BN_FLG_FIXED_TOP;\n    bn_check_top(a);\n    return 1;\n}', 'BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)\n{\n    bn_check_top(b);\n    if (a == b)\n        return a;\n    if (bn_wexpand(a, b->top) == NULL)\n        return NULL;\n    if (b->top > 0)\n        memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);\n    a->neg = b->neg;\n    a->top = b->top;\n    a->flags |= b->flags & BN_FLG_FIXED_TOP;\n    bn_check_top(a);\n    return a;\n}']