crypto/ec/ec_mult.c:342: error: BUFFER_OVERRUN_S2
  Offset: [`num`, +oo] Size: [0, +oo].
Showing all 10 steps of the trace


crypto/ec/ec_mult.c:125:1: <Offset trace>
123.    * in the addition if scalar != NULL
124.    */
125. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
126.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
127.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:125:1: Parameter `num`
123.    * in the addition if scalar != NULL
124.    */
125. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
126.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
127.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:219:5: Assignment
217.       }
218.   
219.       totalnum = num + numblocks;
           ^
220.   
221.       wsize = OPENSSL_malloc(totalnum * sizeof(wsize[0]));

crypto/ec/ec_mult.c:125:1: <Length trace>
123.    * in the addition if scalar != NULL
124.    */
125. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
126.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
127.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:125:1: Parameter `num`
123.    * in the addition if scalar != NULL
124.    */
125. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
126.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
127.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:219:5: Assignment
217.       }
218.   
219.       totalnum = num + numblocks;
           ^
220.   
221.       wsize = OPENSSL_malloc(totalnum * sizeof(wsize[0]));

crypto/ec/ec_mult.c:222:16: Call
220.   
221.       wsize = OPENSSL_malloc(totalnum * sizeof(wsize[0]));
222.       wNAF_len = OPENSSL_malloc(totalnum * sizeof(wNAF_len[0]));
                      ^
223.       /* include space for pivot */
224.       wNAF = OPENSSL_malloc((totalnum + 1) * sizeof(wNAF[0]));

crypto/mem.c:198:9: Assignment
  196.   
  197.       if (num == 0)
  198.           return NULL;
                 ^
  199.   
  200.       FAILTEST();

crypto/ec/ec_mult.c:222:5: Assignment
220.   
221.       wsize = OPENSSL_malloc(totalnum * sizeof(wsize[0]));
222.       wNAF_len = OPENSSL_malloc(totalnum * sizeof(wNAF_len[0]));
           ^
223.       /* include space for pivot */
224.       wNAF = OPENSSL_malloc((totalnum + 1) * sizeof(wNAF[0]));

crypto/ec/ec_mult.c:342:31: Array access: Offset: [num, +oo] Size: [0, +oo]
340.   
341.                       wNAF[i + 1] = NULL;
342.                       wNAF[i] = OPENSSL_malloc(wNAF_len[i]);
                                     ^
343.                       if (wNAF[i] == NULL) {
344.                           ECerr(EC_F_EC_WNAF_MUL, ERR_R_MALLOC_FAILURE);
