test/ecdsatest.c:229: error: BUFFER_OVERRUN_L3
  Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607] by call to `BN_dec2bn`.
Showing all 14 steps of the trace


test/ecdsatest.c:209:16: Call
207.       BIO_printf(out, "testing %s: ", OBJ_nid2sn(nid));
208.       /* create the key */
209.       if ((key = EC_KEY_new_by_curve_name(nid)) == NULL)
                      ^
210.           goto x962_int_err;
211.       use_fake = 1;

crypto/ec/ec_key.c:82:18: Call
  80.       if (ret == NULL)
  81.           return NULL;
  82.       ret->group = EC_GROUP_new_by_curve_name(nid);
                         ^
  83.       if (ret->group == NULL) {
  84.           EC_KEY_free(ret);

crypto/ec/ec_curve.c:3139:19: Call
    3137.       for (i = 0; i < curve_list_length; i++)
    3138.           if (curve_list[i].nid == nid) {
    3139.               ret = ec_group_new_from_data(curve_list[i]);
                              ^
    3140.               break;
    3141.           }

crypto/ec/ec_curve.c:3102:10: Call
      3100.           goto err;
      3101.       }
      3102.       if (!EC_GROUP_set_generator(group, P, order, x)) {
                       ^
      3103.           ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);
      3104.           goto err;

crypto/ec/ec_lib.c:265:1: Parameter `group->cofactor->d`
        263.   }
        264.   
        265. > int EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
        266.                              const BIGNUM *order, const BIGNUM *cofactor)
        267.   {

test/ecdsatest.c:229:10: Call
227.       if ((r = BN_new()) == NULL || (s = BN_new()) == NULL)
228.           goto x962_int_err;
229.       if (!BN_dec2bn(&r, r_in) || !BN_dec2bn(&s, s_in))
                ^
230.           goto x962_int_err;
231.       ECDSA_SIG_get0(&sig_r, &sig_s, signature);

crypto/bn/bn_print.c:244:1: Parameter `*(*bn)->d`
  242.   }
  243.   
  244. > int BN_dec2bn(BIGNUM **bn, const char *a)
  245.   {
  246.       BIGNUM *ret = NULL;

crypto/bn/bn_print.c:277:9: Call
  275.   
  276.       /* i is the number of digests, a bit of an over expand; */
  277.       if (bn_expand(ret, i * 4) == NULL)
                 ^
  278.           goto err;
  279.   

crypto/bn/bn_lib.c:390:1: Parameter `*b->d`
    388.    */
    389.   
    390. > BIGNUM *bn_expand2(BIGNUM *b, int words)
    391.   {
    392.       bn_check_top(b);

crypto/bn/bn_lib.c:395:23: Call
    393.   
    394.       if (words > b->dmax) {
    395.           BN_ULONG *a = bn_expand_internal(b, words);
                                 ^
    396.           if (!a)
    397.               return NULL;

crypto/bn/bn_lib.c:300:1: <Length trace>
298.   /* This is used by bn_expand2() */
299.   /* The caller MUST check that words > b->dmax before calling this */
300. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
301.   {
302.       BN_ULONG *A, *a = NULL;

crypto/bn/bn_lib.c:300:1: Parameter `*b->d`
      298.   /* This is used by bn_expand2() */
      299.   /* The caller MUST check that words > b->dmax before calling this */
      300. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
      301.   {
      302.       BN_ULONG *A, *a = NULL;

crypto/bn/bn_lib.c:335:5: Assignment
      333.   
      334.   #if 1
      335.       B = b->d;
                 ^
      336.       /* Check if the previous number needs to be copied */
      337.       if (B != NULL) {

crypto/bn/bn_lib.c:352:18: Array access: Offset: [3, +oo] (⇐ [0, +oo] + 3) Size: [0, 8388607] by call to `BN_dec2bn` 
      350.               a1 = B[1];
      351.               a2 = B[2];
      352.               a3 = B[3];
                              ^
      353.               A[0] = a0;
      354.               A[1] = a1;
