crypto/ec/ec_curve.c:3273: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `EC_GROUP_get_order`.
Showing all 14 steps of the trace


crypto/ec/ec_curve.c:3213:1: Parameter `group->order->top`
3211.    *          if not found. If there was an error it returns -1.
3212.    */
3213. > int ec_curve_nid_from_params(const EC_GROUP *group)
3214.   {
3215.       int ret = -1, nid, len, field_type, param_len;

crypto/ec/ec_curve.c:3248:17: Call
3246.        * EC group order, whichever is larger.
3247.        */
3248.       param_len = BN_num_bytes(group->order);
                        ^
3249.       len = BN_num_bytes(group->field);
3250.       if (len > param_len)

crypto/bn/bn_lib.c:140:9: Call
  138.       bn_check_top(a);
  139.   
  140.       if (BN_is_zero(a))
                 ^
  141.           return 0;
  142.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));

crypto/bn/bn_lib.c:866:1: Parameter `a->top`
    864.   }
    865.   
    866. > int BN_is_zero(const BIGNUM *a)
    867.   {
    868.       return a->top == 0;

crypto/ec/ec_curve.c:3273:12: Call
3271.           && EC_POINT_get_affine_coordinates(group, generator, bn[3], bn[4], ctx)
3272.           /* Get order */
3273.           && EC_GROUP_get_order(group, bn[5], ctx)))
                   ^
3274.           goto end;
3275.   

crypto/ec/ec_lib.c:322:1: Parameter `group->order->top`
  320.   }
  321.   
  322. > int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx)
  323.   {
  324.       if (group->order == NULL)

crypto/ec/ec_lib.c:326:10: Call
  324.       if (group->order == NULL)
  325.           return 0;
  326.       if (!BN_copy(order, group->order))
                  ^
  327.           return 0;
  328.   

crypto/bn/bn_lib.c:281:1: <Offset trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `b->top`
    279.   }
    280.   
    281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    282.   {
    283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: <Length trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `*a->d`
    279.   }
    280.   
    281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
    282.   {
    283.       bn_check_top(b);

crypto/bn/bn_lib.c:287:9: Call
    285.       if (a == b)
    286.           return a;
    287.       if (bn_wexpand(a, b->top) == NULL)
                   ^
    288.           return NULL;
    289.   

crypto/bn/bn_lib.c:962:1: Parameter `*a->d`
      960.   }
      961.   
      962. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
      963.   {
      964.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:291:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `EC_GROUP_get_order` 
    289.   
    290.       if (b->top > 0)
    291.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                   ^
    292.   
    293.       a->neg = b->neg;
