crypto/ec/ecp_smpl.c:626: error: BUFFER_OVERRUN_L3
  Offset: [16, +oo] (⇐ 1 + [15, +oo]) Size: [0, 8388607] by call to `BN_mod_mul`.
Showing all 18 steps of the trace


crypto/ec/ecp_smpl.c:556:9: Call
554.   
555.       BN_CTX_start(ctx);
556.       Z = BN_CTX_get(ctx);
               ^
557.       Z_1 = BN_CTX_get(ctx);
558.       Z_2 = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:283:5: Call
  281.       }
  282.       /* OK, make sure the returned bignum is "zero" */
  283.       BN_zero(ret);
             ^
  284.       ctx->used++;
  285.       CTXDBG_RET(ctx, ret);

crypto/bn/bn_lib.c:520:1: Parameter `a->top`
    518.   }
    519.   
    520. > int BN_set_word(BIGNUM *a, BN_ULONG w)
    521.   {
    522.       bn_check_top(a);

crypto/ec/ecp_smpl.c:626:22: Call
624.                       goto err;
625.               } else {
626.                   if (!BN_mod_mul(Z_3, Z_2, Z_1, group->field, ctx))
                            ^
627.                       goto err;
628.               }

crypto/bn/bn_mod.c:178:1: Parameter `a->top`
  176.   
  177.   /* slow but works */
  178. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
  179.                  BN_CTX *ctx)
  180.   {

crypto/bn/bn_mod.c:192:14: Call
  190.           goto err;
  191.       if (a == b) {
  192.           if (!BN_sqr(t, a, ctx))
                      ^
  193.               goto err;
  194.       } else {

crypto/bn/bn_sqr.c:65:1: Parameter `a->top`
    63.    * I've just gone over this and it is now %20 faster on x86 - eay - 27 Jun 96
    64.    */
    65. > int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
    66.   {
    67.       int max, al;

crypto/bn/bn_sqr.c:73:5: Assignment
    71.       bn_check_top(a);
    72.   
    73.       al = a->top;
              ^
    74.       if (al <= 0) {
    75.           r->top = 0;

crypto/bn/bn_sqr.c:122:17: Call
    120.                   if (bn_wexpand(tmp, max) == NULL)
    121.                       goto err;
    122.                   bn_sqr_normal(rr->d, a->d, al, tmp->d);
                           ^
    123.               }
    124.           }

crypto/bn/bn_sqr.c:152:1: <Offset trace>
150.   
151.   /* tmp must have 2*n words */
152. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
153.   {
154.       int i, j, max;

crypto/bn/bn_sqr.c:152:1: Parameter `n`
      150.   
      151.   /* tmp must have 2*n words */
      152. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
      153.   {
      154.       int i, j, max;

crypto/bn/bn_sqr.c:163:5: Assignment
      161.       rp[0] = rp[max - 1] = 0;
      162.       rp++;
      163.       j = n;
                 ^
      164.   
      165.       if (--j > 0) {

crypto/bn/bn_sqr.c:165:9: Assignment
      163.       j = n;
      164.   
      165.       if (--j > 0) {
                     ^
      166.           ap++;
      167.           rp[j] = bn_mul_words(rp, ap, j, ap[-1]);

crypto/bn/bn_sqr.c:152:1: <Length trace>
150.   
151.   /* tmp must have 2*n words */
152. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
153.   {
154.       int i, j, max;

crypto/bn/bn_sqr.c:152:1: Parameter `*r`
      150.   
      151.   /* tmp must have 2*n words */
      152. > void bn_sqr_normal(BN_ULONG *r, const BN_ULONG *a, int n, BN_ULONG *tmp)
      153.   {
      154.       int i, j, max;

crypto/bn/bn_sqr.c:160:5: Assignment
      158.       max = n * 2;
      159.       ap = a;
      160.       rp = r;
                 ^
      161.       rp[0] = rp[max - 1] = 0;
      162.       rp++;

crypto/bn/bn_sqr.c:162:5: Assignment
      160.       rp = r;
      161.       rp[0] = rp[max - 1] = 0;
      162.       rp++;
                 ^
      163.       j = n;
      164.   

crypto/bn/bn_sqr.c:167:9: Array access: Offset: [16, +oo] (⇐ 1 + [15, +oo]) Size: [0, 8388607] by call to `BN_mod_mul` 
      165.       if (--j > 0) {
      166.           ap++;
      167.           rp[j] = bn_mul_words(rp, ap, j, ap[-1]);
                     ^
      168.           rp += 2;
      169.       }
