test/ectest.c:72: error: BUFFER_OVERRUN_L3
  Offset: [1, +oo] Size: [0, 8388607] by call to `BN_add`.
Showing all 10 steps of the trace


test/ectest.c:47:10: Call
45.           goto err;
46.   
47.       if (!TEST_true(EC_GROUP_get_order(group, order, ctx))
               ^
48.           || !TEST_true(EC_POINT_mul(group, Q, order, NULL, NULL, ctx))
49.           || !TEST_true(EC_POINT_is_at_infinity(group, Q))

crypto/ec/ec_lib.c:319:1: Parameter `order->d`
  317.   }
  318.   
  319. > int EC_GROUP_get_order(const EC_GROUP *group, BIGNUM *order, BN_CTX *ctx)
  320.   {
  321.       if (group->order == NULL)

test/ectest.c:72:17: Call
70.   
71.               /* n2 = 1 + order */
72.               || !TEST_true(BN_add(n2, order, BN_value_one()))
                      ^
73.               || !TEST_true(EC_POINT_mul(group, Q, NULL, P, n2, ctx))
74.               || !TEST_int_eq(0, EC_POINT_cmp(group, Q, P, ctx))

crypto/bn/bn_add.c:14:1: Parameter `*a->d`
  12.   
  13.   /* signed add of b to a. */
  14. > int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
  15.   {
  16.       int ret, r_neg, cmp_res;

crypto/bn/bn_add.c:28:19: Call
  26.           if (cmp_res > 0) {
  27.               r_neg = a->neg;
  28.               ret = BN_usub(r, a, b);
                          ^
  29.           } else if (cmp_res < 0) {
  30.               r_neg = b->neg;

crypto/bn/bn_add.c:125:1: <Length trace>
123.   
124.   /* unsigned subtraction of b from a, a must be larger than b. */
125. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
126.   {
127.       int max, min, dif;

crypto/bn/bn_add.c:125:1: Parameter `b->top`
    123.   
    124.   /* unsigned subtraction of b from a, a must be larger than b. */
    125. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
    126.   {
    127.       int max, min, dif;

crypto/bn/bn_add.c:135:5: Assignment
    133.   
    134.       max = a->top;
    135.       min = b->top;
               ^
    136.       dif = max - min;
    137.   

crypto/bn/bn_add.c:151:5: Assignment
    149.   
    150.       borrow = bn_sub_words(rp, ap, bp, min);
    151.       ap += min;
               ^
    152.       rp += min;
    153.   

crypto/bn/bn_add.c:156:14: Array access: Offset: [1, +oo] Size: [0, 8388607] by call to `BN_add` 
    154.       while (dif) {
    155.           dif--;
    156.           t1 = *(ap++);
                        ^
    157.           t2 = (t1 - borrow) & BN_MASK2;
    158.           *(rp++) = t2;
