crypto/ec/ec_lib.c:300: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `ec_precompute_mont_data`.
Showing all 18 steps of the trace


crypto/ec/ec_lib.c:283:14: Call
281.   
282.       if (order != NULL) {
283.           if (!BN_copy(group->order, order))
                    ^
284.               return 0;
285.       } else

crypto/bn/bn_lib.c:312:1: Parameter `a->top`
  310.   }
  311.   
  312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  313.   {
  314.       bn_check_top(b);

crypto/ec/ec_lib.c:299:9: Call
297.        * |group->mont_data| will be NULL in this case.
298.        */
299.       if (BN_is_odd(group->order)) {
               ^
300.           return ec_precompute_mont_data(group);
301.       }

crypto/bn/bn_lib.c:856:1: Parameter `a->top`
  854.   }
  855.   
  856. > int BN_is_odd(const BIGNUM *a)
  857.   {
  858.       return (a->top > 0) && (a->d[0] & 1);

crypto/ec/ec_lib.c:300:16: Call
298.        */
299.       if (BN_is_odd(group->order)) {
300.           return ec_precompute_mont_data(group);
                      ^
301.       }
302.   

crypto/ec/ec_lib.c:966:1: Parameter `group->order->top`
  964.    * returns one on success. On error it returns zero.
  965.    */
  966. > static int ec_precompute_mont_data(EC_GROUP *group)
  967.   {
  968.       BN_CTX *ctx = BN_CTX_new();

crypto/ec/ec_lib.c:981:10: Call
  979.           goto err;
  980.   
  981.       if (!BN_MONT_CTX_set(group->mont_data, group->order, ctx)) {
                  ^
  982.           BN_MONT_CTX_free(group->mont_data);
  983.           group->mont_data = NULL;

crypto/bn/bn_mont.c:247:1: Parameter `mod->top`
    245.   }
    246.   
    247. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
    248.   {
    249.       int ret = 0;

crypto/bn/bn_mont.c:252:9: Call
    250.       BIGNUM *Ri, *R;
    251.   
    252.       if (BN_is_zero(mod))
                   ^
    253.           return 0;
    254.   

crypto/bn/bn_lib.c:841:1: Parameter `a->top`
      839.   }
      840.   
      841. > int BN_is_zero(const BIGNUM *a)
      842.   {
      843.       return a->top == 0;

crypto/bn/bn_mont.c:259:10: Call
    257.           goto err;
    258.       R = &(mont->RR);            /* grab RR as a temp */
    259.       if (!BN_copy(&(mont->N), mod))
                    ^
    260.           goto err;               /* Set N */
    261.       if (BN_get_flags(mod, BN_FLG_CONSTTIME) != 0)

crypto/bn/bn_lib.c:312:1: <Offset trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `b->top`
      310.   }
      311.   
      312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      313.   {
      314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: <Length trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `*a->d`
      310.   }
      311.   
      312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
      313.   {
      314.       bn_check_top(b);

crypto/bn/bn_lib.c:318:9: Call
      316.       if (a == b)
      317.           return a;
      318.       if (bn_wexpand(a, b->top) == NULL)
                     ^
      319.           return NULL;
      320.   

crypto/bn/bn_lib.c:937:1: Parameter `*a->d`
        935.   }
        936.   
        937. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
        938.   {
        939.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:322:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `ec_precompute_mont_data` 
      320.   
      321.       if (b->top > 0)
      322.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                     ^
      323.   
      324.       a->top = b->top;
