crypto/sm2/sm2_sign.c:102: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 536870848] by call to `EC_POINT_mul`.
Showing all 19 steps of the trace


crypto/sm2/sm2_sign.c:100:9: Call
98.   
99.       for (;;) {
100.           BN_priv_rand_range(k, order);
               ^
101.   
102.           if (EC_POINT_mul(group, kG, k, NULL, NULL, ctx) == 0)

crypto/bn/bn_rand.c:184:12: Call
  182.   int BN_priv_rand_range(BIGNUM *r, const BIGNUM *range)
  183.   {
  184.       return bnrand_range(PRIVATE, r, range);
                    ^
  185.   }
  186.   

crypto/bn/bn_rand.c:113:1: Parameter `r->top`
    111.   
    112.   /* random number r:  0 <= r < range */
    113. > static int bnrand_range(BNRAND_FLAG flag, BIGNUM *r, const BIGNUM *range)
    114.   {
    115.       int n;

crypto/sm2/sm2_sign.c:102:13: Call
100.           BN_priv_rand_range(k, order);
101.   
102.           if (EC_POINT_mul(group, kG, k, NULL, NULL, ctx) == 0)
                   ^
103.               goto done;
104.   

crypto/ec/ec_lib.c:922:1: Parameter `g_scalar->top`
  920.   }
  921.   
  922. > int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
  923.                    const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
  924.   {

crypto/ec/ec_lib.c:933:12: Call
  931.       scalars[0] = p_scalar;
  932.   
  933.       return EC_POINTs_mul(group, r, g_scalar,
                    ^
  934.                            (point != NULL
  935.                             && p_scalar != NULL), points, scalars, ctx);

crypto/ec/ec_lib.c:911:1: Parameter `scalar->top`
    909.    */
    910.   
    911. > int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
    912.                     size_t num, const EC_POINT *points[],
    913.                     const BIGNUM *scalars[], BN_CTX *ctx)

crypto/ec/ec_lib.c:917:16: Call
    915.       if (group->meth->mul == 0)
    916.           /* use default */
    917.           return ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
                          ^
    918.   
    919.       return group->meth->mul(group, r, scalar, num, points, scalars, ctx);

crypto/ec/ec_mult.c:346:1: Parameter `scalar->top`
      344.    * in the addition if scalar != NULL
      345.    */
      346. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
      347.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
      348.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:388:16: Call
      386.            * constant time version.
      387.            */
      388.           return ec_mul_consttime(group, r, scalar, NULL, ctx);
                            ^
      389.       }
      390.       if ((scalar == NULL) && (num == 1)) {

crypto/ec/ec_mult.c:131:1: Parameter `scalar->top`
        129.    * Returns 1 on success, 0 otherwise.
        130.    */
        131. > static int ec_mul_consttime(const EC_GROUP *group, EC_POINT *r,
        132.                               const BIGNUM *scalar, const EC_POINT *point,
        133.                               BN_CTX *ctx)

crypto/ec/ec_mult.c:183:10: Call
        181.           goto err;
        182.   
        183.       if (!BN_copy(k, scalar))
                        ^
        184.           goto err;
        185.   

crypto/bn/bn_lib.c:285:1: <Offset trace>
283.   }
284.   
285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
286.   {
287.       bn_check_top(b);

crypto/bn/bn_lib.c:285:1: Parameter `b->top`
          283.   }
          284.   
          285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
          286.   {
          287.       bn_check_top(b);

crypto/bn/bn_lib.c:285:1: <Length trace>
283.   }
284.   
285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
286.   {
287.       bn_check_top(b);

crypto/bn/bn_lib.c:285:1: Parameter `*a->d`
          283.   }
          284.   
          285. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
          286.   {
          287.       bn_check_top(b);

crypto/bn/bn_lib.c:291:9: Call
          289.       if (a == b)
          290.           return a;
          291.       if (bn_wexpand(a, b->top) == NULL)
                         ^
          292.           return NULL;
          293.   

crypto/bn/bn_lib.c:923:1: Parameter `*a->d`
            921.   }
            922.   
            923. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
            924.   {
            925.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:295:9: Array access: Offset added: [8, +oo] Size: [0, 536870848] by call to `EC_POINT_mul` 
          293.   
          294.       if (b->top > 0)
          295.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                         ^
          296.   
          297.       a->top = b->top;
