crypto/ec/ec_curve.c:3041: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_set_word`.
Showing all 9 steps of the trace


crypto/ec/ec_curve.c:3010:22: Call
3008.           }
3009.       } else if (data->field_type == NID_X9_62_prime_field) {
3010.           if ((group = EC_GROUP_new_curve_GFp(p, a, b, ctx)) == NULL) {
                             ^
3011.               ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
3012.               goto err;

crypto/ec/ec_cvt.c:55:9: Call
  53.   
  54.       if (!EC_GROUP_set_curve_GFp(ret, p, a, b, ctx)) {
  55.           EC_GROUP_clear_free(ret);
                ^
  56.           return NULL;
  57.       }

crypto/ec/ec_lib.c:111:1: Parameter `group->cofactor->d`
    109.   }
    110.   
    111. > void EC_GROUP_clear_free(EC_GROUP *group)
    112.   {
    113.       if (!group)

crypto/ec/ec_curve.c:3041:13: Call
3039.       }
3040.       if ((order = BN_bin2bn(params + 5 * param_len, param_len, NULL)) == NULL
3041.           || !BN_set_word(x, (BN_ULONG)data->cofactor)) {
                    ^
3042.           ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);
3043.           goto err;

crypto/bn/bn_lib.c:387:1: <Length trace>
385.   }
386.   
387. > int BN_set_word(BIGNUM *a, BN_ULONG w)
388.   {
389.       bn_check_top(a);

crypto/bn/bn_lib.c:387:1: Parameter `*a->d`
  385.   }
  386.   
  387. > int BN_set_word(BIGNUM *a, BN_ULONG w)
  388.   {
  389.       bn_check_top(a);

crypto/bn/bn_lib.c:390:9: Call
  388.   {
  389.       bn_check_top(a);
  390.       if (bn_expand(a, (int)sizeof(BN_ULONG) * 8) == NULL)
                 ^
  391.           return (0);
  392.       a->neg = 0;

crypto/bn/bn_lcl.h:651:1: Parameter `*a->d`
    649.                            const BIGNUM *add, const BIGNUM *rem, BN_CTX *ctx);
    650.   
    651. > static ossl_inline BIGNUM *bn_expand(BIGNUM *a, int bits)
    652.   {
    653.       if (bits > (INT_MAX - BN_BITS2 + 1))

crypto/bn/bn_lib.c:393:5: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_set_word` 
  391.           return (0);
  392.       a->neg = 0;
  393.       a->d[0] = w;
             ^
  394.       a->top = (w ? 1 : 0);
  395.       bn_check_top(a);
