crypto/ec/ec_asn1.c:855: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, 8388607] by call to `EC_POINT_oct2point`.
Showing all 26 steps of the trace


crypto/ec/ec_asn1.c:696:9: Call
694.           goto err;
695.       }
696.       b = BN_bin2bn(params->curve->b->data, params->curve->b->length, NULL);
               ^
697.       if (b == NULL) {
698.           ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, ERR_R_BN_LIB);

crypto/bn/bn_lib.c:542:1: Parameter `ret->top`
  540.   }
  541.   
  542. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
  543.   {
  544.       unsigned int i, m;

crypto/ec/ec_asn1.c:855:10: Call
853.   
854.       /* extract the ec point */
855.       if (!EC_POINT_oct2point(ret, point, params->base->data,
                ^
856.                               params->base->length, NULL)) {
857.           ECerr(EC_F_EC_ASN1_PARAMETERS2GROUP, ERR_R_EC_LIB);

crypto/ec/ec_oct.c:166:1: Parameter `group->field->top`
  164.   }
  165.   
  166. > int EC_POINT_oct2point(const EC_GROUP *group, EC_POINT *point,
  167.                          const unsigned char *buf, size_t len, BN_CTX *ctx)
  168.   {

crypto/ec/ec_oct.c:188:20: Call
  186.           }
  187.   #else
  188.               return ec_GF2m_simple_oct2point(group, point, buf, len, ctx);
                            ^
  189.   #endif
  190.       }

crypto/ec/ec2_oct.c:294:1: Parameter `group->field->top`
    292.    * simple implementation only uses affine coordinates.
    293.    */
    294. > int ec_GF2m_simple_oct2point(const EC_GROUP *group, EC_POINT *point,
    295.                                const unsigned char *buf, size_t len,
    296.                                BN_CTX *ctx)

crypto/ec/ec2_oct.c:363:14: Call
    361.   
    362.       if (form == POINT_CONVERSION_COMPRESSED) {
    363.           if (!EC_POINT_set_compressed_coordinates_GF2m
                        ^
    364.               (group, point, x, y_bit, ctx))
    365.               goto err;

crypto/ec/ec_oct.c:107:1: Parameter `group->field->top`
      105.   
      106.   #ifndef OPENSSL_NO_EC2M
      107. > int EC_POINT_set_compressed_coordinates_GF2m(const EC_GROUP *group,
      108.                                                EC_POINT *point, const BIGNUM *x,
      109.                                                int y_bit, BN_CTX *ctx)

crypto/ec/ec_oct.c:124:20: Call
      122.       if (group->meth->flags & EC_FLAGS_DEFAULT_OCT) {
      123.           if (group->meth->field_type == NID_X9_62_prime_field)
      124.               return ec_GFp_simple_set_compressed_coordinates(group, point, x,
                                ^
      125.                                                               y_bit, ctx);
      126.           else

crypto/ec/ecp_oct.c:71:1: Parameter `group->field->top`
        69.   #include "ec_lcl.h"
        70.   
        71. > int ec_GFp_simple_set_compressed_coordinates(const EC_GROUP *group,
        72.                                                EC_POINT *point,
        73.                                                const BIGNUM *x_, int y_bit,

crypto/ec/ecp_oct.c:106:10: Call
        104.   
        105.       /* tmp1 := x^3 */
        106.       if (!BN_nnmod(x, x_, group->field, ctx))
                        ^
        107.           goto err;
        108.       if (group->meth->field_decode == 0) {

crypto/bn/bn_mod.c:119:1: Parameter `d->top`
          117.   #include "bn_lcl.h"
          118.   
          119. > int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
          120.   {
          121.       /*

crypto/bn/bn_mod.c:126:11: Call
          124.        */
          125.   
          126.       if (!(BN_mod(r, m, d, ctx)))
                           ^
          127.           return 0;
          128.       if (!r->neg)

crypto/bn/bn_div.c:254:31: Call
            252.   
            253.       /* First we normalise the numbers */
            254.       norm_shift = BN_BITS2 - ((BN_num_bits(divisor)) % BN_BITS2);
                                                 ^
            255.       if (!(BN_lshift(sdiv, divisor, norm_shift)))
            256.           goto err;

crypto/bn/bn_lib.c:221:9: Assignment
              219.   
              220.       if (BN_is_zero(a))
              221.           return 0;
                             ^
              222.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));
              223.   }

crypto/bn/bn_div.c:254:5: Assignment
            252.   
            253.       /* First we normalise the numbers */
            254.       norm_shift = BN_BITS2 - ((BN_num_bits(divisor)) % BN_BITS2);
                       ^
            255.       if (!(BN_lshift(sdiv, divisor, norm_shift)))
            256.           goto err;

crypto/bn/bn_div.c:255:11: Call
            253.       /* First we normalise the numbers */
            254.       norm_shift = BN_BITS2 - ((BN_num_bits(divisor)) % BN_BITS2);
            255.       if (!(BN_lshift(sdiv, divisor, norm_shift)))
                             ^
            256.           goto err;
            257.       sdiv->neg = 0;

crypto/bn/bn_shift.c:130:1: <Offset trace>
128.   }
129.   
130. > int BN_lshift(BIGNUM *r, const BIGNUM *a, int n)
131.   {
132.       int i, nw, lb, rb;

crypto/bn/bn_shift.c:130:1: Parameter `n`
              128.   }
              129.   
              130. > int BN_lshift(BIGNUM *r, const BIGNUM *a, int n)
              131.   {
              132.       int i, nw, lb, rb;

crypto/bn/bn_shift.c:145:5: Assignment
              143.   
              144.       r->neg = a->neg;
              145.       nw = n / BN_BITS2;
                         ^
              146.       if (bn_wexpand(r, a->top + nw + 1) == NULL)
              147.           return (0);

crypto/bn/bn_shift.c:130:1: <Length trace>
128.   }
129.   
130. > int BN_lshift(BIGNUM *r, const BIGNUM *a, int n)
131.   {
132.       int i, nw, lb, rb;

crypto/bn/bn_shift.c:130:1: Parameter `*r->d`
              128.   }
              129.   
              130. > int BN_lshift(BIGNUM *r, const BIGNUM *a, int n)
              131.   {
              132.       int i, nw, lb, rb;

crypto/bn/bn_shift.c:146:9: Call
              144.       r->neg = a->neg;
              145.       nw = n / BN_BITS2;
              146.       if (bn_wexpand(r, a->top + nw + 1) == NULL)
                             ^
              147.           return (0);
              148.       lb = n % BN_BITS2;

crypto/bn/bn_lib.c:995:1: Parameter `*a->d`
                993.   }
                994.   
                995. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
                996.   {
                997.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_shift.c:151:5: Assignment
              149.       rb = BN_BITS2 - lb;
              150.       f = a->d;
              151.       t = r->d;
                         ^
              152.       t[a->top + nw] = 0;
              153.       if (lb == 0)

crypto/bn/bn_shift.c:159:13: Array access: Offset: [1, +oo] Size: [0, 8388607] by call to `EC_POINT_oct2point` 
              157.           for (i = a->top - 1; i >= 0; i--) {
              158.               l = f[i];
              159.               t[nw + i + 1] |= (l >> rb) & BN_MASK2;
                                 ^
              160.               t[nw + i] = (l << lb) & BN_MASK2;
              161.           }
