crypto/ec/ecp_smpl.c:154: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_copy`.
Showing all 14 steps of the trace


crypto/ec/ecp_smpl.c:128:1: Parameter `p->top`
126.   }
127.   
128. > int ec_GFp_simple_group_set_curve(EC_GROUP *group,
129.                                     const BIGNUM *p, const BIGNUM *a,
130.                                     const BIGNUM *b, BN_CTX *ctx)

crypto/ec/ecp_smpl.c:137:9: Call
135.   
136.       /* p must be a prime > 3 */
137.       if (BN_num_bits(p) <= 2 || !BN_is_odd(p)) {
               ^
138.           ECerr(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE, EC_R_INVALID_FIELD);
139.           return 0;

crypto/bn/bn_lib.c:166:9: Call
  164.       bn_check_top(a);
  165.   
  166.       if (BN_is_zero(a))
                 ^
  167.           return 0;
  168.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));

crypto/bn/bn_lib.c:855:1: Parameter `a->top`
    853.   }
    854.   
    855. > int BN_is_zero(const BIGNUM *a)
    856.   {
    857.       return a->top == 0;

crypto/ec/ecp_smpl.c:137:33: Call
135.   
136.       /* p must be a prime > 3 */
137.       if (BN_num_bits(p) <= 2 || !BN_is_odd(p)) {
                                       ^
138.           ECerr(EC_F_EC_GFP_SIMPLE_GROUP_SET_CURVE, EC_R_INVALID_FIELD);
139.           return 0;

crypto/bn/bn_lib.c:870:1: Parameter `a->top`
  868.   }
  869.   
  870. > int BN_is_odd(const BIGNUM *a)
  871.   {
  872.       return (a->top > 0) && (a->d[0] & 1);

crypto/ec/ecp_smpl.c:154:10: Call
152.   
153.       /* group->field */
154.       if (!BN_copy(group->field, p))
                ^
155.           goto err;
156.       BN_set_negative(group->field, 0);

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
  321.   }
  322.   
  323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  324.   {
  325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
  321.   }
  322.   
  323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  324.   {
  325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
  327.       if (a == b)
  328.           return a;
  329.       if (bn_wexpand(a, b->top) == NULL)
                 ^
  330.           return NULL;
  331.   

crypto/bn/bn_lib.c:951:1: Parameter `*a->d`
    949.   }
    950.   
    951. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
    952.   {
    953.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `BN_copy` 
  331.   
  332.       if (b->top > 0)
  333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                 ^
  334.   
  335.       if (BN_get_flags(b, BN_FLG_CONSTTIME) != 0)
