crypto/ec/ecp_smpl.c:1331: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_set_word`.
Showing all 7 steps of the trace


crypto/ec/ecp_smpl.c:1195:1: Parameter `(*points)->Z->d`
1193.   }
1194.   
1195. > int ec_GFp_simple_points_make_affine(const EC_GROUP *group, size_t num,
1196.                                        EC_POINT *points[], BN_CTX *ctx)
1197.   {

crypto/ec/ecp_smpl.c:1331:22: Call
1329.                       goto err;
1330.               } else {
1331.                   if (!BN_one(p->Z))
                             ^
1332.                       goto err;
1333.               }

crypto/bn/bn_lib.c:387:1: <Length trace>
385.   }
386.   
387. > int BN_set_word(BIGNUM *a, BN_ULONG w)
388.   {
389.       bn_check_top(a);

crypto/bn/bn_lib.c:387:1: Parameter `*a->d`
  385.   }
  386.   
  387. > int BN_set_word(BIGNUM *a, BN_ULONG w)
  388.   {
  389.       bn_check_top(a);

crypto/bn/bn_lib.c:390:9: Call
  388.   {
  389.       bn_check_top(a);
  390.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                 ^
  391.           return 0;
  392.       a->neg = 0;

crypto/bn/bn_lcl.h:651:1: Parameter `*a->d`
    649.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
    650.   
    651. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
    652.   {
    653.       if (bits > (INT_MAX - BN_BITS2 + 1))

crypto/bn/bn_lib.c:393:5: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_set_word` 
  391.           return 0;
  392.       a->neg = 0;
  393.       a->d[0] = w;
             ^
  394.       a->top = (w ? 1 : 0);
  395.       bn_check_top(a);
