crypto/ec/ec_pmeth.c:266: error: BUFFER_OVERRUN_L3
  Offset added: [8, +oo] Size: [0, 67108856] by call to `EC_KEY_dup`.
Showing all 19 steps of the trace


crypto/ec/ec_pmeth.c:223:1: Parameter `ctx->pkey->pkey.ec->group->cofactor->top`
221.   #endif
222.   
223. > static int pkey_ec_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2)
224.   {
225.       EC_PKEY_CTX *dctx = ctx->data;

crypto/ec/ec_pmeth.c:263:17: Call
261.                   return -2;
262.               /* If cofactor is 1 cofactor mode does nothing */
263.               if (BN_is_one(ec_key->group->cofactor))
                       ^
264.                   return 1;
265.               if (!dctx->co_key) {

crypto/bn/bn_lib.c:851:1: Parameter `a->top`
  849.   }
  850.   
  851. > int BN_is_one(const BIGNUM *a)
  852.   {
  853.       return BN_abs_is_word(a, 1) && !a->neg;

crypto/bn/bn_lib.c:853:12: Call
  851.   int BN_is_one(const BIGNUM *a)
  852.   {
  853.       return BN_abs_is_word(a, 1) && !a->neg;
                    ^
  854.   }
  855.   

crypto/bn/bn_lib.c:841:1: Parameter `a->top`
    839.   }
    840.   
    841. > int BN_abs_is_word(const BIGNUM *a, const BN_ULONG w)
    842.   {
    843.       return ((a->top == 1) && (a->d[0] == w)) || ((w == 0) && (a->top == 0));

crypto/ec/ec_pmeth.c:266:32: Call
264.                   return 1;
265.               if (!dctx->co_key) {
266.                   dctx->co_key = EC_KEY_dup(ec_key);
                                      ^
267.                   if (!dctx->co_key)
268.                       return 0;

crypto/ec/ec_key.c:150:1: Parameter `ec_key->group->cofactor->top`
  148.   }
  149.   
  150. > EC_KEY *EC_KEY_dup(const EC_KEY *ec_key)
  151.   {
  152.       EC_KEY *ret = EC_KEY_new_method(ec_key->engine);

crypto/ec/ec_key.c:157:9: Call
  155.           return NULL;
  156.   
  157.       if (EC_KEY_copy(ret, ec_key) == NULL) {
                 ^
  158.           EC_KEY_free(ret);
  159.           return NULL;

crypto/ec/ec_key.c:73:1: Parameter `src->group->cofactor->top`
    71.   }
    72.   
    73. > EC_KEY *EC_KEY_copy(EC_KEY *dest, const EC_KEY *src)
    74.   {
    75.       if (dest == NULL || src == NULL) {

crypto/ec/ec_key.c:98:14: Call
    96.           if (dest->group == NULL)
    97.               return NULL;
    98.           if (!EC_GROUP_copy(dest->group, src->group))
                        ^
    99.               return NULL;
    100.   

crypto/ec/ec_lib.c:130:1: Parameter `src->cofactor->top`
      128.   }
      129.   
      130. > int EC_GROUP_copy(EC_GROUP *dest, const EC_GROUP *src)
      131.   {
      132.       if (dest->meth->group_copy == 0) {

crypto/ec/ec_lib.c:208:14: Call
      206.           if (!BN_copy(dest->order, src->order))
      207.               return 0;
      208.           if (!BN_copy(dest->cofactor, src->cofactor))
                          ^
      209.               return 0;
      210.       }

crypto/bn/bn_lib.c:280:1: <Offset trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `b->top`
        278.   }
        279.   
        280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        281.   {
        282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: <Length trace>
278.   }
279.   
280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
281.   {
282.       bn_check_top(b);

crypto/bn/bn_lib.c:280:1: Parameter `*a->d`
        278.   }
        279.   
        280. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
        281.   {
        282.       bn_check_top(b);

crypto/bn/bn_lib.c:286:9: Call
        284.       if (a == b)
        285.           return a;
        286.       if (bn_wexpand(a, b->top) == NULL)
                       ^
        287.           return NULL;
        288.   

crypto/bn/bn_lib.c:942:1: Parameter `*a->d`
          940.   }
          941.   
          942. > BIGNUM *bn_wexpand(BIGNUM *a, int words)
          943.   {
          944.       return (words <= a->dmax) ? a : bn_expand2(a, words);

crypto/bn/bn_lib.c:290:9: Array access: Offset added: [8, +oo] Size: [0, 67108856] by call to `EC_KEY_dup` 
        288.   
        289.       if (b->top > 0)
        290.           memcpy(a->d, b->d, sizeof(b->d[0]) * b->top);
                       ^
        291.   
        292.       a->neg = b->neg;
