test/ectest.c:965: error: BUFFER_OVERRUN_L3
  Offset: [2, +oo] Size: [0, +oo] by call to `EC_POINTs_mul`.
Showing all 13 steps of the trace


test/ectest.c:965:14: Call
963.   
964.           /* z is still the group order */
965.           if (!TEST_true(EC_POINTs_mul(group, P, NULL, 2, points, scalars, ctx))
                    ^
966.               || !TEST_true(EC_POINTs_mul(group, R, z, 2, points, scalars, ctx))
967.               || !TEST_int_eq(0, EC_POINT_cmp(group, P, R, ctx))

crypto/ec/ec_lib.c:914:1: Parameter `num`
  912.    */
  913.   
  914. > int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
  915.                     size_t num, const EC_POINT *points[],
  916.                     const BIGNUM *scalars[], BN_CTX *ctx)

crypto/ec/ec_lib.c:920:16: Call
  918.       if (group->meth->mul == 0)
  919.           /* use default */
  920.           return ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
                        ^
  921.   
  922.       return group->meth->mul(group, r, scalar, num, points, scalars, ctx);

crypto/ec/ec_mult.c:129:1: <Offset trace>
127.    * in the addition if scalar != NULL
128.    */
129. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
130.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
131.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:129:1: Parameter `num`
    127.    * in the addition if scalar != NULL
    128.    */
    129. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
    130.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
    131.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:223:5: Assignment
    221.       }
    222.   
    223.       totalnum = num + numblocks;
               ^
    224.   
    225.       wsize = OPENSSL_malloc(totalnum * sizeof wsize[0]);

crypto/ec/ec_mult.c:129:1: <Length trace>
127.    * in the addition if scalar != NULL
128.    */
129. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
130.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
131.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:129:1: Parameter `num`
    127.    * in the addition if scalar != NULL
    128.    */
    129. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
    130.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
    131.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:223:5: Assignment
    221.       }
    222.   
    223.       totalnum = num + numblocks;
               ^
    224.   
    225.       wsize = OPENSSL_malloc(totalnum * sizeof wsize[0]);

crypto/ec/ec_mult.c:226:16: Call
    224.   
    225.       wsize = OPENSSL_malloc(totalnum * sizeof wsize[0]);
    226.       wNAF_len = OPENSSL_malloc(totalnum * sizeof wNAF_len[0]);
                          ^
    227.       wNAF = OPENSSL_malloc((totalnum + 1) * sizeof wNAF[0]); /* includes space
    228.                                                                * for pivot */

crypto/mem.c:166:9: Assignment
      164.   
      165.       if (num == 0)
      166.           return NULL;
                     ^
      167.   
      168.       FAILTEST();

crypto/ec/ec_mult.c:226:5: Assignment
    224.   
    225.       wsize = OPENSSL_malloc(totalnum * sizeof wsize[0]);
    226.       wNAF_len = OPENSSL_malloc(totalnum * sizeof wNAF_len[0]);
               ^
    227.       wNAF = OPENSSL_malloc((totalnum + 1) * sizeof wNAF[0]); /* includes space
    228.                                                                * for pivot */

crypto/ec/ec_mult.c:331:25: Array access: Offset: [2, +oo] Size: [0, +oo] by call to `EC_POINTs_mul` 
    329.                   for (i = num; i < totalnum; i++) {
    330.                       if (i < totalnum - 1) {
    331.                           wNAF_len[i] = blocksize;
                                   ^
    332.                           if (tmp_len < blocksize) {
    333.                               ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);
