crypto/ec/ec_curve.c:3098: error: BUFFER_OVERRUN_L3
  Offset: 0 Size: [0, 8388607] by call to `BN_set_word`.
Showing all 7 steps of the trace


crypto/ec/ec_curve.c:3061:23: Call
3059.       if (curve.meth != 0) {
3060.           meth = curve.meth();
3061.           if (((group = EC_GROUP_new(meth)) == NULL) ||
                              ^
3062.               (!(group->meth->group_set_curve(group, p, a, b, ctx)))) {
3063.               ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_EC_LIB);

crypto/ec/ec_lib.c:106:5: Call
  104.   
  105.    err:
  106.       BN_free(ret->order);
             ^
  107.       BN_free(ret->cofactor);
  108.       OPENSSL_free(ret);

crypto/bn/bn_lib.c:252:1: Parameter `*a->d`
    250.   }
    251.   
    252. > void BN_free(BIGNUM *a)
    253.   {
    254.       if (a == NULL)

crypto/ec/ec_curve.c:3098:13: Call
3096.       }
3097.       if ((order = BN_bin2bn(params + 5 * param_len, param_len, NULL)) == NULL
3098.           || !BN_set_word(x, (BN_ULONG)data->cofactor)) {
                    ^
3099.           ECerr(EC_F_EC_GROUP_NEW_FROM_DATA, ERR_R_BN_LIB);
3100.           goto err;

crypto/bn/bn_lib.c:530:1: <Length trace>
528.   }
529.   
530. > int BN_set_word(BIGNUM *a, BN_ULONG w)
531.   {
532.       bn_check_top(a);

crypto/bn/bn_lib.c:530:1: Parameter `*a->d`
  528.   }
  529.   
  530. > int BN_set_word(BIGNUM *a, BN_ULONG w)
  531.   {
  532.       bn_check_top(a);

crypto/bn/bn_lib.c:536:5: Array access: Offset: 0 Size: [0, 8388607] by call to `BN_set_word` 
  534.           return (0);
  535.       a->neg = 0;
  536.       a->d[0] = w;
             ^
  537.       a->top = (w ? 1 : 0);
  538.       bn_check_top(a);
