test/ectest.c:1140: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `EC_GROUP_check`.
Showing all 24 steps of the trace


test/ectest.c:1135:10: Call
1133.       int nid = curves[n].nid;
1134.   
1135.       if (!TEST_ptr(group = EC_GROUP_new_by_curve_name(nid))) {
                 ^
1136.           TEST_info("EC_GROUP_new_curve_name() failed with curve %s\n",
1137.                     OBJ_nid2sn(nid));

crypto/ec/ec_curve.c:3131:19: Call
  3129.       for (i = 0; i < curve_list_length; i++)
  3130.           if (curve_list[i].nid == nid) {
  3131.               ret = ec_group_new_from_data(curve_list[i]);
                            ^
  3132.               break;
  3133.           }

crypto/ec/ec_curve.c:3042:14: Call
    3040.       params += seed_len;         /* skip seed */
    3041.   
    3042.       if ((p = BN_bin2bn(params + 0 * param_len, param_len, NULL)) == NULL
                         ^
    3043.           || (a = BN_bin2bn(params + 1 * param_len, param_len, NULL)) == NULL
    3044.           || (b = BN_bin2bn(params + 2 * param_len, param_len, NULL)) == NULL) {

crypto/bn/bn_lib.c:374:1: Parameter `ret->top`
      372.   }
      373.   
      374. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
      375.   {
      376.       unsigned int i, m;

test/ectest.c:1140:10: Call
1138.           return 0;
1139.       }
1140.       if (!TEST_true(EC_GROUP_check(group, NULL))) {
                 ^
1141.           TEST_info("EC_GROUP_check() failed with curve %s\n", OBJ_nid2sn(nid));
1142.           EC_GROUP_free(group);

crypto/ec/ec_check.c:23:1: Parameter `group->order->top`
  21.   }
  22.   
  23. > int EC_GROUP_check(const EC_GROUP *group, BN_CTX *ctx)
  24.   {
  25.       int ret = 0;

crypto/ec/ec_check.c:69:9: Call
  67.       if (order == NULL)
  68.           goto err;
  69.       if (BN_is_zero(order)) {
                ^
  70.           ECerr(EC_F_EC_GROUP_CHECK, EC_R_UNDEFINED_ORDER);
  71.           goto err;

crypto/bn/bn_lib.c:866:1: Parameter `a->top`
    864.   }
    865.   
    866. > int BN_is_zero(const BIGNUM *a)
    867.   {
    868.       return a->top == 0;

crypto/ec/ec_check.c:74:10: Call
  72.       }
  73.   
  74.       if (!EC_POINT_mul(group, point, order, NULL, NULL, ctx))
                 ^
  75.           goto err;
  76.       if (!EC_POINT_is_at_infinity(group, point)) {

crypto/ec/ec_lib.c:971:1: Parameter `g_scalar->top`
    969.   }
    970.   
    971. > int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
    972.                    const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
    973.   {

crypto/ec/ec_lib.c:982:12: Call
    980.       scalars[0] = p_scalar;
    981.   
    982.       return EC_POINTs_mul(group, r, g_scalar,
                      ^
    983.                            (point != NULL
    984.                             && p_scalar != NULL), points, scalars, ctx);

crypto/ec/ec_lib.c:933:1: Parameter `scalar->top`
      931.    */
      932.   
      933. > int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
      934.                     size_t num, const EC_POINT *points[],
      935.                     const BIGNUM *scalars[], BN_CTX *ctx)

crypto/ec/ec_lib.c:965:15: Call
      963.       else
      964.           /* use default */
      965.           ret = ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
                           ^
      966.   
      967.       BN_CTX_free(new_ctx);

crypto/ec/ec_mult.c:410:1: Parameter `scalar->top`
        408.    * in the addition if scalar != NULL
        409.    */
        410. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
        411.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
        412.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:453:20: Call
        451.                * always call the ladder version.
        452.                */
        453.               return ec_scalar_mul_ladder(group, r, scalar, NULL, ctx);
                                  ^
        454.           }
        455.           if ((scalar == NULL) && (num == 1) && (scalars[0] != group->order)) {

crypto/ec/ec_mult.c:139:1: Parameter `scalar->top`
          137.    * Returns 1 on success, 0 otherwise.
          138.    */
          139. > int ec_scalar_mul_ladder(const EC_GROUP *group, EC_POINT *r,
          140.                            const BIGNUM *scalar, const EC_POINT *point,
          141.                            BN_CTX *ctx)

crypto/ec/ec_mult.c:215:10: Call
          213.       }
          214.   
          215.       if (!BN_copy(k, scalar)) {
                          ^
          216.           ECerr(EC_F_EC_SCALAR_MUL_LADDER, ERR_R_BN_LIB);
          217.           goto err;

crypto/bn/bn_lib.c:281:1: <Offset trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `b->top`
            279.   }
            280.   
            281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
            282.   {
            283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: <Length trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `*a->d`
            279.   }
            280.   
            281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
            282.   {
            283.       bn_check_top(b);

crypto/bn/bn_lib.c:287:9: Call
            285.       if (a == b)
            286.           return a;
            287.       if (bn_wexpand(a, b->top) == NULL)
                           ^
            288.           return NULL;
            289.   

crypto/bn/bn_lib.c:962:1: Parameter `*a->d`
              960.   }
              961.   
              962. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
              963.   {
              964.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:291:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `EC_GROUP_check` 
            289.   
            290.       if (b->top > 0)
            291.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                           ^
            292.   
            293.       a->neg = b->neg;
