test/sm2crypttest.c:152: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `EC_KEY_set_group`.
Showing all 16 steps of the trace


test/sm2crypttest.c:152:5: Call
150.   
151.       key = EC_KEY_new();
152.       EC_KEY_set_group(key, group);
           ^
153.       EC_KEY_set_private_key(key, priv);
154.   

crypto/ec/ec_key.c:424:1: Parameter `group->mont_data->N.top`
  422.   }
  423.   
  424. > int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group)
  425.   {
  426.       if (key->meth->set_group != NULL && key->meth->set_group(key, group) == 0)

crypto/ec/ec_key.c:429:18: Call
  427.           return 0;
  428.       EC_GROUP_free(key->group);
  429.       key->group = EC_GROUP_dup(group);
                          ^
  430.       return (key->group == NULL) ? 0 : 1;
  431.   }

crypto/ec/ec_lib.c:231:1: Parameter `a->mont_data->N.top`
    229.   }
    230.   
    231. > EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)
    232.   {
    233.       EC_GROUP *t = NULL;

crypto/ec/ec_lib.c:241:10: Call
    239.       if ((t = EC_GROUP_new(a->meth)) == NULL)
    240.           return NULL;
    241.       if (!EC_GROUP_copy(t, a))
                    ^
    242.           goto err;
    243.   

crypto/ec/ec_lib.c:130:1: Parameter `src->mont_data->N.top`
      128.   }
      129.   
      130. > int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
      131.   {
      132.       if (dest->meth->group_copy == 0) {

crypto/ec/ec_lib.c:181:14: Call
      179.                   return 0;
      180.           }
      181.           if (!BN_MONT_CTX_copy(dest->mont_data, src->mont_data))
                          ^
      182.               return 0;
      183.       } else {

crypto/bn/bn_mont.c:369:1: Parameter `from->N.top`
        367.   }
        368.   
        369. > BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, BN_MONT_CTX *from)
        370.   {
        371.       if (to == from)

crypto/bn/bn_mont.c:376:10: Call
        374.       if (!BN_copy(&(to->RR), &(from->RR)))
        375.           return NULL;
        376.       if (!BN_copy(&(to->N), &(from->N)))
                        ^
        377.           return NULL;
        378.       if (!BN_copy(&(to->Ni), &(from->Ni)))

crypto/bn/bn_lib.c:285:1: <Offset trace>
283.   }
284.   
285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
286.   {
287.       bn_check_top(b);

crypto/bn/bn_lib.c:285:1: Parameter `b->top`
          283.   }
          284.   
          285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
          286.   {
          287.       bn_check_top(b);

crypto/bn/bn_lib.c:285:1: <Length trace>
283.   }
284.   
285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
286.   {
287.       bn_check_top(b);

crypto/bn/bn_lib.c:285:1: Parameter `*a->d`
          283.   }
          284.   
          285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
          286.   {
          287.       bn_check_top(b);

crypto/bn/bn_lib.c:291:9: Call
          289.       if (a == b)
          290.           return a;
          291.       if (bn_wexpand(a, b->top) == NULL)
                         ^
          292.           return NULL;
          293.   

crypto/bn/bn_lib.c:910:1: Parameter `*a->d`
            908.   }
            909.   
            910. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
            911.   {
            912.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:295:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `EC_KEY_set_group` 
          293.   
          294.       if (b->top > 0)
          295.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                         ^
          296.   
          297.       a->top = b->top;
