This buffer is statically sized.  But the function takes a keylen arg that is used later and not restricted to EVP_MAX_KEY_LENGTH.  It will happily overflow this later on.