test/ectest.c:214: error: BUFFER_OVERRUN_L3
  Offset: [16, +oo] (⇐ 1 + [15, +oo]) Size: [0, 8388607] by call to `EC_POINT_set_compressed_coordinates_GFp`.
Showing all 25 steps of the trace


test/ectest.c:171:13: Call
169.           || !TEST_ptr(a = BN_new())
170.           || !TEST_ptr(b = BN_new())
171.           || !TEST_true(BN_hex2bn(&p, "17"))
                   ^
172.           || !TEST_true(BN_hex2bn(&a, "1"))
173.           || !TEST_true(BN_hex2bn(&b, "1"))

crypto/bn/bn_print.c:126:1: Parameter `(*bn)->top`
  124.   }
  125.   
  126. > int BN_hex2bn(BIGNUM **bn, const char *a)
  127.   {
  128.       BIGNUM *ret = NULL;

test/ectest.c:214:13: Call
212.           || !TEST_ptr(yplusone = BN_new())
213.           || !TEST_true(BN_hex2bn(&x, "D"))
214.           || !TEST_true(EC_POINT_set_compressed_coordinates_GFp(group, Q, x, 1,
                   ^
215.                                                                 ctx)))
216.           goto err;

crypto/ec/ec_oct.c:23:1: Parameter `x->top`
  21.   #include "ec_lcl.h"
  22.   
  23. > int EC_POINT_set_compressed_coordinates_GFp(const EC_GROUP *group,
  24.                                               EC_POINT *point, const BIGNUM *x,
  25.                                               int y_bit, BN_CTX *ctx)

crypto/ec/ec_oct.c:40:20: Call
  38.       if (group->meth->flags & EC_FLAGS_DEFAULT_OCT) {
  39.           if (group->meth->field_type == NID_X9_62_prime_field)
  40.               return ec_GFp_simple_set_compressed_coordinates(group, point, x,
                           ^
  41.                                                               y_bit, ctx);
  42.           else

crypto/ec/ecp_oct.c:42:12: Call
    40.   
    41.       BN_CTX_start(ctx);
    42.       tmp1 = BN_CTX_get(ctx);
                     ^
    43.       tmp2 = BN_CTX_get(ctx);
    44.       x = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:229:5: Call
      227.       }
      228.       /* OK, make sure the returned bignum is "zero" */
      229.       BN_zero(ret);
                 ^
      230.       ctx->used++;
      231.       CTXDBG_RET(ctx, ret);

crypto/bn/bn_lib.c:395:1: Parameter `*a->d`
        393.   }
        394.   
        395. > int BN_set_word(BIGNUM *a, BN_ULONG w)
        396.   {
        397.       bn_check_top(a);

crypto/bn/bn_lib.c:398:9: Call
        396.   {
        397.       bn_check_top(a);
        398.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                       ^
        399.           return (0);
        400.       a->neg = 0;

crypto/bn/bn_lcl.h:660:1: Parameter `*a->d`
          658.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
          659.   
          660. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
          661.   {
          662.       if (bits > (INT_MAX - BN_BITS2 + 1))

crypto/ec/ecp_oct.c:65:14: Call
    63.               goto err;
    64.       } else {
    65.           if (!BN_mod_sqr(tmp2, x_, group->field, ctx))
                       ^
    66.               goto err;
    67.           if (!BN_mod_mul(tmp1, tmp2, x_, group->field, ctx))

crypto/bn/bn_mod.c:102:1: Parameter `*r->d`
      100.   }
      101.   
      102. > int BN_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx)
      103.   {
      104.       if (!BN_sqr(r, a, ctx))

crypto/bn/bn_mod.c:104:10: Call
      102.   int BN_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx)
      103.   {
      104.       if (!BN_sqr(r, a, ctx))
                      ^
      105.           return 0;
      106.       /* r->neg == 0,  thus we don't need BN_nnmod */

crypto/bn/bn_sqr.c:17:1: Parameter `a->top`
        15.    * I've just gone over this and it is now %20 faster on x86 - eay - 27 Jun 96
        16.    */
        17. > int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
        18.   {
        19.       int max, al;

crypto/bn/bn_sqr.c:25:5: Assignment
        23.       bn_check_top(a);
        24.   
        25.       al = a->top;
                  ^
        26.       if (al <= 0) {
        27.           r->top = 0;

crypto/bn/bn_sqr.c:74:17: Call
        72.                   if (bn_wexpand(tmp, max) == NULL)
        73.                       goto err;
        74.                   bn_sqr_normal(rr->d, a->d, al, tmp->d);
                              ^
        75.               }
        76.           }

crypto/bn/bn_sqr.c:105:1: <Offset trace>
103.   
104.   /* tmp must have 2*n words */
105. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
106.   {
107.       int i, j, max;

crypto/bn/bn_sqr.c:105:1: Parameter `n`
          103.   
          104.   /* tmp must have 2*n words */
          105. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
          106.   {
          107.       int i, j, max;

crypto/bn/bn_sqr.c:116:5: Assignment
          114.       rp[0] = rp[max - 1] = 0;
          115.       rp++;
          116.       j = n;
                     ^
          117.   
          118.       if (--j > 0) {

crypto/bn/bn_sqr.c:118:9: Assignment
          116.       j = n;
          117.   
          118.       if (--j > 0) {
                         ^
          119.           ap++;
          120.           rp[j] = bn_mul_words(rp, ap, j, ap[-1]);

crypto/bn/bn_sqr.c:105:1: <Length trace>
103.   
104.   /* tmp must have 2*n words */
105. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
106.   {
107.       int i, j, max;

crypto/bn/bn_sqr.c:105:1: Parameter `*r`
          103.   
          104.   /* tmp must have 2*n words */
          105. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
          106.   {
          107.       int i, j, max;

crypto/bn/bn_sqr.c:113:5: Assignment
          111.       max = n * 2;
          112.       ap = a;
          113.       rp = r;
                     ^
          114.       rp[0] = rp[max - 1] = 0;
          115.       rp++;

crypto/bn/bn_sqr.c:115:5: Assignment
          113.       rp = r;
          114.       rp[0] = rp[max - 1] = 0;
          115.       rp++;
                     ^
          116.       j = n;
          117.   

crypto/bn/bn_sqr.c:120:9: Array access: Offset: [16, +oo] (⇐ 1 + [15, +oo]) Size: [0, 8388607] by call to `EC_POINT_set_compressed_coordinates_GFp` 
          118.       if (--j > 0) {
          119.           ap++;
          120.           rp[j] = bn_mul_words(rp, ap, j, ap[-1]);
                         ^
          121.           rp += 2;
          122.       }
