crypto/ec/ec_mult.c:293: error: BUFFER_OVERRUN_S2
  Offset: `num` + 1 Size: [1, +oo].
Showing all 9 steps of the trace


crypto/ec/ec_mult.c:125:1: <Offset trace>
123.    * in the addition if scalar != NULL
124.    */
125. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
126.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
127.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:125:1: Parameter `num`
123.    * in the addition if scalar != NULL
124.    */
125. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
126.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
127.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:125:1: <Length trace>
123.    * in the addition if scalar != NULL
124.    */
125. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
126.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
127.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:125:1: Parameter `num`
123.    * in the addition if scalar != NULL
124.    */
125. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
126.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
127.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:219:5: Assignment
217.       }
218.   
219.       totalnum = num + numblocks;
           ^
220.   
221.       wsize = OPENSSL_malloc(totalnum * sizeof wsize[0]);

crypto/ec/ec_mult.c:223:12: Call
221.       wsize = OPENSSL_malloc(totalnum * sizeof wsize[0]);
222.       wNAF_len = OPENSSL_malloc(totalnum * sizeof wNAF_len[0]);
223.       wNAF = OPENSSL_malloc((totalnum + 1) * sizeof wNAF[0]); /* includes space
                  ^
224.                                                                * for pivot */
225.       val_sub = OPENSSL_malloc(totalnum * sizeof val_sub[0]);

crypto/mem.c:165:9: Assignment
  163.   
  164.       if (num <= 0)
  165.           return NULL;
                 ^
  166.   
  167.       FAILTEST();

crypto/ec/ec_mult.c:223:5: Assignment
221.       wsize = OPENSSL_malloc(totalnum * sizeof wsize[0]);
222.       wNAF_len = OPENSSL_malloc(totalnum * sizeof wNAF_len[0]);
223.       wNAF = OPENSSL_malloc((totalnum + 1) * sizeof wNAF[0]); /* includes space
           ^
224.                                                                * for pivot */
225.       val_sub = OPENSSL_malloc(totalnum * sizeof val_sub[0]);

crypto/ec/ec_mult.c:293:17: Array access: Offset: num + 1 Size: [1, +oo]
291.                   totalnum = num + 1; /* don't use wNAF splitting */
292.                   wNAF[num] = tmp_wNAF;
293.                   wNAF[num + 1] = NULL;
                       ^
294.                   wNAF_len[num] = tmp_len;
295.                   /*
