crypto/ec/ec_pmeth.c:403: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `EC_KEY_set_group`.
Showing all 14 steps of the trace


crypto/ec/ec_pmeth.c:403:17: Call
401.       if (ec == NULL)
402.           return 0;
403.       if (!(ret = EC_KEY_set_group(ec, dctx->gen_group))
                       ^
404.           || !ossl_assert(ret = EVP_PKEY_assign_EC_KEY(pkey, ec)))
405.           EC_KEY_free(ec);

crypto/ec/ec_key.c:424:1: Parameter `group->cofactor->top`
  422.   }
  423.   
  424. > int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group)
  425.   {
  426.       if (key->meth->set_group != NULL && key->meth->set_group(key, group) == 0)

crypto/ec/ec_key.c:429:18: Call
  427.           return 0;
  428.       EC_GROUP_free(key->group);
  429.       key->group = EC_GROUP_dup(group);
                          ^
  430.       return (key->group == NULL) ? 0 : 1;
  431.   }

crypto/ec/ec_lib.c:233:1: Parameter `a->cofactor->top`
    231.   }
    232.   
    233. > EC_GROUP *EC_GROUP_dup(const EC_GROUP *a)
    234.   {
    235.       EC_GROUP *t = NULL;

crypto/ec/ec_lib.c:243:10: Call
    241.       if ((t = EC_GROUP_new(a->meth)) == NULL)
    242.           return NULL;
    243.       if (!EC_GROUP_copy(t, a))
                    ^
    244.           goto err;
    245.   

crypto/ec/ec_lib.c:130:1: Parameter `src->cofactor->top`
      128.   }
      129.   
      130. > int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
      131.   {
      132.       if (dest->meth->group_copy == 0) {

crypto/ec/ec_lib.c:208:14: Call
      206.           if (!BN_copy(dest->order, src->order))
      207.               return 0;
      208.           if (!BN_copy(dest->cofactor, src->cofactor))
                          ^
      209.               return 0;
      210.       }

crypto/bn/bn_lib.c:280:1: <Offset trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `b->top`
        278.   }
        279.   
        280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        281.   {
        282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: <Length trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `*a->d`
        278.   }
        279.   
        280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        281.   {
        282.       bn_check_top(b);

crypto/bn/bn_lib.c:286:9: Call
        284.       if (a == b)
        285.           return a;
        286.       if (bn_wexpand(a, b->top) == NULL)
                       ^
        287.           return NULL;
        288.   

crypto/bn/bn_lib.c:942:1: Parameter `*a->d`
          940.   }
          941.   
          942. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
          943.   {
          944.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:290:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `EC_KEY_set_group` 
        288.   
        289.       if (b->top > 0)
        290.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                       ^
        291.   
        292.       a->neg = b->neg;
