crypto/ec/ec2_smpl.c:357: error: BUFFER_OVERRUN_L3
  Offset added: 8 Size: [0, 67108856] by call to `BN_copy`.
Showing all 10 steps of the trace


crypto/ec/ec2_smpl.c:357:28: Call
355.           goto err;
356.       BN_set_negative(point->Y, 0);
357.       if (!BN_copy(point->Z, BN_value_one()))
                                  ^
358.           goto err;
359.       BN_set_negative(point->Z, 0);

crypto/bn/bn_lib.c:84:9: Assignment
  82.       static const BN_ULONG data_one = 1L;
  83.       static const BIGNUM const_one =
  84.           { (BN_ULONG *)&data_one, 1, 1, 0, BN_FLG_STATIC_DATA };
                ^
  85.   
  86.       return &const_one;

crypto/ec/ec2_smpl.c:357:10: Call
355.           goto err;
356.       BN_set_negative(point->Y, 0);
357.       if (!BN_copy(point->Z, BN_value_one()))
                ^
358.           goto err;
359.       BN_set_negative(point->Z, 0);

crypto/bn/bn_lib.c:312:1: <Offset trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `b->top`
  310.   }
  311.   
  312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  313.   {
  314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: <Length trace>
310.   }
311.   
312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
313.   {
314.       bn_check_top(b);

crypto/bn/bn_lib.c:312:1: Parameter `*a->d`
  310.   }
  311.   
  312. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  313.   {
  314.       bn_check_top(b);

crypto/bn/bn_lib.c:318:9: Call
  316.       if (a == b)
  317.           return a;
  318.       if (bn_wexpand(a, b->top) == NULL)
                 ^
  319.           return NULL;
  320.   

crypto/bn/bn_lib.c:937:1: Parameter `*a->d`
    935.   }
    936.   
    937. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
    938.   {
    939.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:322:9: Array access: Offset added: 8 Size: [0, 67108856] by call to `BN_copy` 
  320.   
  321.       if (b->top > 0)
  322.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                 ^
  323.   
  324.       a->top = b->top;
