crypto/ec/ec_pmeth.c:63: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `EC_GROUP_dup`.
Showing all 12 steps of the trace


crypto/ec/ec_pmeth.c:63:27: Call
61.       dctx = dst->data;
62.       if (sctx->gen_group) {
63.           dctx->gen_group = EC_GROUP_dup(sctx->gen_group);
                                ^
64.           if (!dctx->gen_group)
65.               return 0;

crypto/ec/ec_lib.c:231:1: Parameter `a->cofactor->top`
  229.   }
  230.   
  231. > EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)
  232.   {
  233.       EC_GROUP *t = NULL;

crypto/ec/ec_lib.c:241:10: Call
  239.       if ((t = EC_GROUP_new(a->meth)) == NULL)
  240.           return NULL;
  241.       if (!EC_GROUP_copy(t, a))
                  ^
  242.           goto err;
  243.   

crypto/ec/ec_lib.c:130:1: Parameter `src->cofactor->top`
    128.   }
    129.   
    130. > int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
    131.   {
    132.       if (dest->meth->group_copy == 0) {

crypto/ec/ec_lib.c:206:14: Call
    204.           if (!BN_copy(dest->order, src->order))
    205.               return 0;
    206.           if (!BN_copy(dest->cofactor, src->cofactor))
                        ^
    207.               return 0;
    208.       }

crypto/bn/bn_lib.c:312:1: <Offset trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `b->top`
      310.   }
      311.   
      312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      313.   {
      314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: <Length trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `*a->d`
      310.   }
      311.   
      312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      313.   {
      314.       bn_check_top(b);

crypto/bn/bn_lib.c:318:9: Call
      316.       if (a == b)
      317.           return a;
      318.       if (bn_wexpand(a, b->top) == NULL)
                     ^
      319.           return NULL;
      320.   

crypto/bn/bn_lib.c:940:1: Parameter `*a->d`
        938.   }
        939.   
        940. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
        941.   {
        942.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:322:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `EC_GROUP_dup` 
      320.   
      321.       if (b->top > 0)
      322.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      323.   
      324.       if (BN_get_flags(b, BN_FLG_CONSTTIME) != 0)
