crypto/ec/ec_ameth.c:748: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `ecdh_cms_set_peerkey`.
Showing all 18 steps of the trace


crypto/ec/ec_ameth.c:748:14: Call
746.           if (!alg || !pubkey)
747.               return 0;
748.           if (!ecdh_cms_set_peerkey(pctx, alg, pubkey)) {
                    ^
749.               ECerr(EC_F_ECDH_CMS_DECRYPT, EC_R_PEER_KEY_ERROR);
750.               return 0;

crypto/ec/ec_ameth.c:589:1: Parameter `pctx->pkey->pkey.ec->group->mont_data->N.top`
  587.   #ifndef OPENSSL_NO_CMS
  588.   
  589. > static int ecdh_cms_set_peerkey(EVP_PKEY_CTX *pctx,
  590.                                   X509_ALGOR *alg, ASN1_BIT_STRING *pubkey)
  591.   {

crypto/ec/ec_ameth.c:614:14: Call
  612.           if (ecpeer == NULL)
  613.               goto err;
  614.           if (!EC_KEY_set_group(ecpeer, grp))
                      ^
  615.               goto err;
  616.       } else {

crypto/ec/ec_key.c:424:1: Parameter `group->mont_data->N.top`
    422.   }
    423.   
    424. > int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group)
    425.   {
    426.       if (key->meth->set_group != NULL && key->meth->set_group(key, group) == 0)

crypto/ec/ec_key.c:429:18: Call
    427.           return 0;
    428.       EC_GROUP_free(key->group);
    429.       key->group = EC_GROUP_dup(group);
                            ^
    430.       return (key->group == NULL) ? 0 : 1;
    431.   }

crypto/ec/ec_lib.c:231:1: Parameter `a->mont_data->N.top`
      229.   }
      230.   
      231. > EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)
      232.   {
      233.       EC_GROUP *t = NULL;

crypto/ec/ec_lib.c:241:10: Call
      239.       if ((t = EC_GROUP_new(a->meth)) == NULL)
      240.           return (NULL);
      241.       if (!EC_GROUP_copy(t, a))
                      ^
      242.           goto err;
      243.   

crypto/ec/ec_lib.c:130:1: Parameter `src->mont_data->N.top`
        128.   }
        129.   
        130. > int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
        131.   {
        132.       if (dest->meth->group_copy == 0) {

crypto/ec/ec_lib.c:181:14: Call
        179.                   return 0;
        180.           }
        181.           if (!BN_MONT_CTX_copy(dest->mont_data, src->mont_data))
                            ^
        182.               return 0;
        183.       } else {

crypto/bn/bn_mont.c:384:1: Parameter `from->N.top`
          382.   }
          383.   
          384. > BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to, BN_MONT_CTX *from)
          385.   {
          386.       if (to == from)

crypto/bn/bn_mont.c:391:10: Call
          389.       if (!BN_copy(&(to->RR), &(from->RR)))
          390.           return NULL;
          391.       if (!BN_copy(&(to->N), &(from->N)))
                          ^
          392.           return NULL;
          393.       if (!BN_copy(&(to->Ni), &(from->Ni)))

crypto/bn/bn_lib.c:323:1: <Offset trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `b->top`
            321.   }
            322.   
            323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
            324.   {
            325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: <Length trace>
321.   }
322.   
323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
324.   {
325.       bn_check_top(b);

crypto/bn/bn_lib.c:323:1: Parameter `*a->d`
            321.   }
            322.   
            323. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
            324.   {
            325.       bn_check_top(b);

crypto/bn/bn_lib.c:329:9: Call
            327.       if (a == b)
            328.           return a;
            329.       if (bn_wexpand(a, b->top) == NULL)
                           ^
            330.           return NULL;
            331.   

crypto/bn/bn_lib.c:951:1: Parameter `*a->d`
              949.   }
              950.   
              951. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
              952.   {
              953.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:333:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `ecdh_cms_set_peerkey` 
            331.   
            332.       if (b->top > 0)
            333.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                           ^
            334.   
            335.       if (BN_get_flags(b, BN_FLG_CONSTTIME) != 0)
