crypto/ec/ec_lib.c:1032: error: BUFFER_OVERRUN_L3
  Offset: [1, 2] Size: [1, +oo] by call to `EC_POINTs_mul`.
Showing all 13 steps of the trace


crypto/ec/ec_lib.c:1033:27: Assignment
1031.   
1032.       return EC_POINTs_mul(group, r, g_scalar,
1033.                            (point != NULL
                                  ^
1034.                             && p_scalar != NULL), points, scalars, ctx);
1035.   }

crypto/ec/ec_lib.c:1032:12: Call
1030.       scalars[0] = p_scalar;
1031.   
1032.       return EC_POINTs_mul(group, r, g_scalar,
                   ^
1033.                            (point != NULL
1034.                             && p_scalar != NULL), points, scalars, ctx);

crypto/ec/ec_lib.c:1010:1: Parameter `num`
  1008.    */
  1009.   
  1010. > int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
  1011.                     size_t num, const EC_POINT *points[],
  1012.                     const BIGNUM *scalars[], BN_CTX *ctx)

crypto/ec/ec_lib.c:1016:16: Call
  1014.       if (group->meth->mul == 0)
  1015.           /* use default */
  1016.           return ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
                         ^
  1017.   
  1018.       return group->meth->mul(group, r, scalar, num, points, scalars, ctx);

crypto/ec/ec_mult.c:193:1: <Offset trace>
191.    * in the addition if scalar != NULL
192.    */
193. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
194.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
195.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:193:1: Parameter `num`
    191.    * in the addition if scalar != NULL
    192.    */
    193. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
    194.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
    195.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:193:1: <Length trace>
191.    * in the addition if scalar != NULL
192.    */
193. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
194.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
195.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:193:1: Parameter `group->extra_data->next->data->numblocks`
    191.    * in the addition if scalar != NULL
    192.    */
    193. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
    194.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
    195.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:290:5: Assignment
    288.       }
    289.   
    290.       totalnum = num + numblocks;
               ^
    291.   
    292.       wsize = OPENSSL_malloc(totalnum * sizeof wsize[0]);

crypto/ec/ec_mult.c:294:12: Call
    292.       wsize = OPENSSL_malloc(totalnum * sizeof wsize[0]);
    293.       wNAF_len = OPENSSL_malloc(totalnum * sizeof wNAF_len[0]);
    294.       wNAF = OPENSSL_malloc((totalnum + 1) * sizeof wNAF[0]); /* includes space
                      ^
    295.                                                                * for pivot */
    296.       val_sub = OPENSSL_malloc(totalnum * sizeof val_sub[0]);

crypto/mem.c:125:9: Assignment
      123.   
      124.       if (num <= 0)
      125.           return NULL;
                     ^
      126.   
      127.       allow_customize = 0;

crypto/ec/ec_mult.c:294:5: Assignment
    292.       wsize = OPENSSL_malloc(totalnum * sizeof wsize[0]);
    293.       wNAF_len = OPENSSL_malloc(totalnum * sizeof wNAF_len[0]);
    294.       wNAF = OPENSSL_malloc((totalnum + 1) * sizeof wNAF[0]); /* includes space
               ^
    295.                                                                * for pivot */
    296.       val_sub = OPENSSL_malloc(totalnum * sizeof val_sub[0]);

crypto/ec/ec_mult.c:318:9: Array access: Offset: [1, 2] Size: [1, +oo] by call to `EC_POINTs_mul` 
    316.           wsize[i] = EC_window_bits_for_scalar_size(bits);
    317.           num_val += (size_t)1 << (wsize[i] - 1);
    318.           wNAF[i + 1] = NULL;     /* make sure we always have a pivot */
                   ^
    319.           wNAF[i] =
    320.               bn_compute_wNAF((i < num ? scalars[i] : scalar), wsize[i],
