crypto/ec/ec_asn1.c:703: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_set_bit`.
Showing all 14 steps of the trace


crypto/ec/ec_asn1.c:621:9: Call
619.           goto err;
620.       }
621.       a = BN_bin2bn(params->curve->a->data, params->curve->a->length, NULL);
               ^
622.       if (a == NULL) {
623.           ECerr(EC_F_EC_GROUP_NEW_FROM_ECPARAMETERS, ERR_R_BN_LIB);

crypto/bn/bn_lib.c:416:9: Assignment
  414.       n = len;
  415.       if (n == 0) {
  416.           ret->top = 0;
                 ^
  417.           return ret;
  418.       }

crypto/ec/ec_asn1.c:703:18: Call
701.               if (!BN_set_bit(p, (int)char_two->m))
702.                   goto err;
703.               if (!BN_set_bit(p, (int)penta->k1))
                        ^
704.                   goto err;
705.               if (!BN_set_bit(p, (int)penta->k2))

crypto/bn/bn_lib.c:616:1: Parameter `*a->d`
  614.   }
  615.   
  616. > int BN_set_bit(BIGNUM *a, int n)
  617.   {
  618.       int i, j, k;

crypto/bn/bn_lib.c:626:13: Call
  624.       j = n % BN_BITS2;
  625.       if (a->top <= i) {
  626.           if (bn_wexpand(a, i + 1) == NULL)
                     ^
  627.               return 0;
  628.           for (k = a->top; k < i + 1; k++)

crypto/bn/bn_lib.c:940:1: Parameter `*a->d`
    938.   }
    939.   
    940. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
    941.   {
    942.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:942:37: Call
    940.   BIGNUM *bn_wexpand(BIGNUM *a, int words)
    941.   {
    942.       return (words <= a->dmax) ? a : bn_expand2(a, words);
                                               ^
    943.   }
    944.   

crypto/bn/bn_lib.c:273:1: Parameter `*b->d`
      271.    */
      272.   
      273. > BIGNUM *bn_expand2(BIGNUM *b, int words)
      274.   {
      275.       bn_check_top(b);

crypto/bn/bn_lib.c:278:23: Call
      276.   
      277.       if (words > b->dmax) {
      278.           BN_ULONG *a = bn_expand_internal(b, words);
                                   ^
      279.           if (!a)
      280.               return NULL;

crypto/bn/bn_lib.c:235:1: <Offset trace>
233.   /* This is used by bn_expand2() */
234.   /* The caller MUST check that words > b->dmax before calling this */
235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
236.   {
237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:235:1: Parameter `b->top`
        233.   /* This is used by bn_expand2() */
        234.   /* The caller MUST check that words > b->dmax before calling this */
        235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
        236.   {
        237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:235:1: <Length trace>
233.   /* This is used by bn_expand2() */
234.   /* The caller MUST check that words > b->dmax before calling this */
235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
236.   {
237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:235:1: Parameter `*b->d`
        233.   /* This is used by bn_expand2() */
        234.   /* The caller MUST check that words > b->dmax before calling this */
        235. > static BN_ULONG *bn_expand_internal(const BIGNUM *b, int words)
        236.   {
        237.       BN_ULONG *a = NULL;

crypto/bn/bn_lib.c:260:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `BN_set_bit` 
        258.       assert(b->top <= words);
        259.       if (b->top > 0)
        260.           memcpy(a, b->d, sizeof(*a) * b->top);
                       ^
        261.   
        262.       return a;
