crypto/ec/ec_mult.c:399: error: BUFFER_OVERRUN_S2
  Offset: [`num`, +oo] Size: [0, +oo].
Showing all 10 steps of the trace


crypto/ec/ec_mult.c:193:1: <Offset trace>
191.    * in the addition if scalar != NULL
192.    */
193. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
194.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
195.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:193:1: Parameter `group->extra_data->next->data->numblocks`
191.    * in the addition if scalar != NULL
192.    */
193. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
194.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
195.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:290:5: Assignment
288.       }
289.   
290.       totalnum = num + numblocks;
           ^
291.   
292.       wsize = OPENSSL_malloc(totalnum * sizeof wsize[0]);

crypto/ec/ec_mult.c:193:1: <Length trace>
191.    * in the addition if scalar != NULL
192.    */
193. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
194.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
195.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:193:1: Parameter `group->extra_data->next->data->numblocks`
191.    * in the addition if scalar != NULL
192.    */
193. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
194.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
195.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:290:5: Assignment
288.       }
289.   
290.       totalnum = num + numblocks;
           ^
291.   
292.       wsize = OPENSSL_malloc(totalnum * sizeof wsize[0]);

crypto/ec/ec_mult.c:293:16: Call
291.   
292.       wsize = OPENSSL_malloc(totalnum * sizeof wsize[0]);
293.       wNAF_len = OPENSSL_malloc(totalnum * sizeof wNAF_len[0]);
                      ^
294.       wNAF = OPENSSL_malloc((totalnum + 1) * sizeof wNAF[0]); /* includes space
295.                                                                * for pivot */

crypto/mem.c:125:9: Assignment
  123.   
  124.       if (num <= 0)
  125.           return NULL;
                 ^
  126.   
  127.       allow_customize = 0;

crypto/ec/ec_mult.c:293:5: Assignment
291.   
292.       wsize = OPENSSL_malloc(totalnum * sizeof wsize[0]);
293.       wNAF_len = OPENSSL_malloc(totalnum * sizeof wNAF_len[0]);
           ^
294.       wNAF = OPENSSL_malloc((totalnum + 1) * sizeof wNAF[0]); /* includes space
295.                                                                * for pivot */

crypto/ec/ec_mult.c:399:25: Array access: Offset: [num, +oo] Size: [0, +oo]
397.                   for (i = num; i < totalnum; i++) {
398.                       if (i < totalnum - 1) {
399.                           wNAF_len[i] = blocksize;
                               ^
400.                           if (tmp_len < blocksize) {
401.                               ECerr(EC_F_EC_WNAF_MUL, ERR_R_INTERNAL_ERROR);
