crypto/ec/ec2_smpl.c:630: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_copy`.
Showing all 10 steps of the trace


crypto/ec/ec2_smpl.c:623:9: Call
621.   
622.       BN_CTX_start(ctx);
623.       x = BN_CTX_get(ctx);
               ^
624.       y = BN_CTX_get(ctx);
625.       if (y == NULL)

crypto/bn/bn_ctx.c:229:5: Call
  227.       }
  228.       /* OK, make sure the returned bignum is "zero" */
  229.       BN_zero(ret);
             ^
  230.       /* clear BN_FLG_CONSTTIME if leaked from previous frames */
  231.       ret->flags &= (~BN_FLG_CONSTTIME);

crypto/bn/bn_lib.c:366:15: Assignment
    364.       a->neg = 0;
    365.       a->d[0] = w;
    366.       a->top = (w ? 1 : 0);
                         ^
    367.       a->flags &= ~BN_FLG_FIXED_TOP;
    368.       bn_check_top(a);

crypto/bn/bn_lib.c:366:5: Assignment
    364.       a->neg = 0;
    365.       a->d[0] = w;
    366.       a->top = (w ? 1 : 0);
               ^
    367.       a->flags &= ~BN_FLG_FIXED_TOP;
    368.       bn_check_top(a);

crypto/ec/ec2_smpl.c:630:10: Call
628.       if (!EC_POINT_get_affine_coordinates(group, point, x, y, ctx))
629.           goto err;
630.       if (!BN_copy(point->X, x))
                ^
631.           goto err;
632.       if (!BN_copy(point->Y, y))

crypto/bn/bn_lib.c:281:1: <Offset trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `b->top`
  279.   }
  280.   
  281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  282.   {
  283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: <Length trace>
279.   }
280.   
281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
282.   {
283.       bn_check_top(b);

crypto/bn/bn_lib.c:281:1: Parameter `*b->d`
  279.   }
  280.   
  281. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  282.   {
  283.       bn_check_top(b);

crypto/bn/bn_lib.c:291:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_copy` 
  289.   
  290.       if (b->top > 0)
  291.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                 ^
  292.   
  293.       a->neg = b->neg;
