test/bntest.c:981: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `BN_mod_exp_recp`.
Showing all 22 steps of the trace


test/bntest.c:999:14: Call
997.           }
998.   
999.           if (!TEST_int_ge(kronecker = BN_kronecker(a, b, ctx), -1))
                     ^
1000.               goto err;
1001.           /* we actually need BN_kronecker(a, |b|) */

crypto/bn/bn_kron.c:17:1: Parameter `ctx->stack.depth`
  15.   
  16.   /* Returns -2 for errors because both -1 and 0 are valid results. */
  17. > int BN_kronecker(const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
  18.   {
  19.       int i;

crypto/bn/bn_kron.c:35:5: Call
  33.       bn_check_top(b);
  34.   
  35.       BN_CTX_start(ctx);
            ^
  36.       A = BN_CTX_get(ctx);
  37.       B = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:181:1: Parameter `ctx->stack.depth`
    179.   }
    180.   
    181. > void BN_CTX_start(BN_CTX *ctx)
    182.   {
    183.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_kron.c:135:5: Call
  133.       }
  134.    end:
  135.       BN_CTX_end(ctx);
             ^
  136.       if (err)
  137.           return -2;

crypto/bn/bn_ctx.c:195:1: Parameter `ctx->stack.depth`
    193.   }
    194.   
    195. > void BN_CTX_end(BN_CTX *ctx)
    196.   {
    197.       CTXDBG_ENTRY("BN_CTX_end", ctx);

test/bntest.c:981:14: Call
979.           BN_set_negative(b, 0);
980.   
981.           if (!TEST_true(BN_mod_exp_recp(r, a, t, b, ctx)))
                    ^
982.               goto err;
983.           BN_set_negative(b, 1);

crypto/bn/bn_exp.c:161:1: Parameter `ctx->stack.depth`
  159.   }
  160.   
  161. > int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
  162.                       const BIGNUM *m, BN_CTX *ctx)
  163.   {

crypto/bn/bn_exp.c:191:5: Call
  189.       }
  190.   
  191.       BN_CTX_start(ctx);
             ^
  192.       aa = BN_CTX_get(ctx);
  193.       val[0] = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:181:1: Parameter `ctx->stack.depth`
    179.   }
    180.   
    181. > void BN_CTX_start(BN_CTX *ctx)
    182.   {
    183.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_exp.c:210:10: Call
  208.       }
  209.   
  210.       if (!BN_nnmod(val[0], a, m, ctx))
                  ^
  211.           goto err;               /* 1 */
  212.       if (BN_is_zero(val[0])) {

crypto/bn/bn_mod.c:13:1: Parameter `ctx->stack.depth`
    11.   #include "bn_lcl.h"
    12.   
    13. > int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
    14.   {
    15.       /*

crypto/bn/bn_mod.c:20:11: Call
    18.        */
    19.   
    20.       if (!(BN_mod(r, m, d, ctx)))
                    ^
    21.           return 0;
    22.       if (!r->neg)

crypto/bn/bn_div.c:137:1: Parameter `ctx->stack.depth`
      135.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
      136.    */
      137. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
      138.              BN_CTX *ctx)
      139.   {

crypto/bn/bn_div.c:190:5: Call
      188.       }
      189.   
      190.       BN_CTX_start(ctx);
                 ^
      191.       res = (dv == NULL) ? BN_CTX_get(ctx) : dv;
      192.       tmp = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:181:1: Parameter `ctx->stack.depth`
        179.   }
        180.   
        181. > void BN_CTX_start(BN_CTX *ctx)
        182.   {
        183.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_div.c:410:5: Call
      408.       if (no_branch)
      409.           bn_correct_top(res);
      410.       BN_CTX_end(ctx);
                 ^
      411.       return 1;
      412.    err:

crypto/bn/bn_ctx.c:195:1: Parameter `ctx->stack.depth`
        193.   }
        194.   
        195. > void BN_CTX_end(BN_CTX *ctx)
        196.   {
        197.       CTXDBG_ENTRY("BN_CTX_end", ctx);

crypto/bn/bn_ctx.c:201:27: Call
        199.           ctx->err_stack--;
        200.       else {
        201.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                         ^
        202.           /* Does this stack frame have anything to release? */
        203.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:274:1: <LHS trace>
272.   }
273.   
274. > static unsigned int BN_STACK_pop(BN_STACK *st)
275.   {
276.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:274:1: Parameter `st->depth`
          272.   }
          273.   
          274. > static unsigned int BN_STACK_pop(BN_STACK *st)
          275.   {
          276.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:276:12: Binary operation: ([0, +oo] - 1):unsigned32 by call to `BN_mod_exp_recp` 
          274.   static unsigned int BN_STACK_pop(BN_STACK *st)
          275.   {
          276.       return st->indexes[--(st->depth)];
                            ^
          277.   }
          278.   

static unsigned int BN_STACK_pop(BN_STACK *st)
{
    return st->indexes[--(st->depth)];
}
['static int test_kronecker(void)\n{\n    BIGNUM *a = NULL, *b = NULL, *r = NULL, *t = NULL;\n    int i, legendre, kronecker, st = 0;\n    if (!TEST_ptr(a = BN_new())\n            || !TEST_ptr(b = BN_new())\n            || !TEST_ptr(r = BN_new())\n            || !TEST_ptr(t = BN_new()))\n        goto err;\n    if (!TEST_true(BN_generate_prime_ex(b, 512, 0, NULL, NULL, NULL)))\n        goto err;\n    BN_set_negative(b, rand_neg());\n    for (i = 0; i < NUM0; i++) {\n        if (!TEST_true(BN_bntest_rand(a, 512, 0, 0)))\n            goto err;\n        BN_set_negative(a, rand_neg());\n        if (!TEST_true(BN_copy(t, b)))\n            goto err;\n        BN_set_negative(t, 0);\n        if (!TEST_true(BN_sub_word(t, 1)))\n            goto err;\n        if (!TEST_true(BN_rshift1(t, t)))\n            goto err;\n        BN_set_negative(b, 0);\n        if (!TEST_true(BN_mod_exp_recp(r, a, t, b, ctx)))\n            goto err;\n        BN_set_negative(b, 1);\n        if (BN_is_word(r, 1))\n            legendre = 1;\n        else if (BN_is_zero(r))\n            legendre = 0;\n        else {\n            if (!TEST_true(BN_add_word(r, 1)))\n                goto err;\n            if (!TEST_int_eq(BN_ucmp(r, b), 0)) {\n                TEST_info("Legendre symbol computation failed");\n                goto err;\n            }\n            legendre = -1;\n        }\n        if (!TEST_int_ge(kronecker = BN_kronecker(a, b, ctx), -1))\n            goto err;\n        if (BN_is_negative(a) && BN_is_negative(b))\n            kronecker = -kronecker;\n        if (!TEST_int_eq(legendre, kronecker))\n            goto err;\n    }\n    st = 1;\n err:\n    BN_free(a);\n    BN_free(b);\n    BN_free(r);\n    BN_free(t);\n    return st;\n}', 'int BN_kronecker(const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)\n{\n    int i;\n    int ret = -2;\n    int err = 0;\n    BIGNUM *A, *B, *tmp;\n    static const int tab[8] = { 0, 1, 0, -1, 0, -1, 0, 1 };\n    bn_check_top(a);\n    bn_check_top(b);\n    BN_CTX_start(ctx);\n    A = BN_CTX_get(ctx);\n    B = BN_CTX_get(ctx);\n    if (B == NULL)\n        goto end;\n    err = !BN_copy(A, a);\n    if (err)\n        goto end;\n    err = !BN_copy(B, b);\n    if (err)\n        goto end;\n    if (BN_is_zero(B)) {\n        ret = BN_abs_is_word(A, 1);\n        goto end;\n    }\n    if (!BN_is_odd(A) && !BN_is_odd(B)) {\n        ret = 0;\n        goto end;\n    }\n    i = 0;\n    while (!BN_is_bit_set(B, i))\n        i++;\n    err = !BN_rshift(B, B, i);\n    if (err)\n        goto end;\n    if (i & 1) {\n        ret = tab[BN_lsw(A) & 7];\n    } else {\n        ret = 1;\n    }\n    if (B->neg) {\n        B->neg = 0;\n        if (A->neg)\n            ret = -ret;\n    }\n    while (1) {\n        if (BN_is_zero(A)) {\n            ret = BN_is_one(B) ? ret : 0;\n            goto end;\n        }\n        i = 0;\n        while (!BN_is_bit_set(A, i))\n            i++;\n        err = !BN_rshift(A, A, i);\n        if (err)\n            goto end;\n        if (i & 1) {\n            ret = ret * tab[BN_lsw(B) & 7];\n        }\n        if ((A->neg ? ~BN_lsw(A) : BN_lsw(A)) & BN_lsw(B) & 2)\n            ret = -ret;\n        err = !BN_nnmod(B, B, A, ctx);\n        if (err)\n            goto end;\n        tmp = A;\n        A = B;\n        B = tmp;\n        tmp->neg = 0;\n    }\n end:\n    BN_CTX_end(ctx);\n    if (err)\n        return -2;\n    else\n        return ret;\n}', 'void BN_CTX_start(BN_CTX *ctx)\n{\n    CTXDBG_ENTRY("BN_CTX_start", ctx);\n    if (ctx->err_stack || ctx->too_many)\n        ctx->err_stack++;\n    else if (!BN_STACK_push(&ctx->stack, ctx->used)) {\n        BNerr(BN_F_BN_CTX_START, BN_R_TOO_MANY_TEMPORARY_VARIABLES);\n        ctx->err_stack++;\n    }\n    CTXDBG_EXIT(ctx);\n}', 'void BN_CTX_end(BN_CTX *ctx)\n{\n    CTXDBG_ENTRY("BN_CTX_end", ctx);\n    if (ctx->err_stack)\n        ctx->err_stack--;\n    else {\n        unsigned int fp = BN_STACK_pop(&ctx->stack);\n        if (fp < ctx->used)\n            BN_POOL_release(&ctx->pool, ctx->used - fp);\n        ctx->used = fp;\n        ctx->too_many = 0;\n    }\n    CTXDBG_EXIT(ctx);\n}', 'int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,\n                    const BIGNUM *m, BN_CTX *ctx)\n{\n    int i, j, bits, ret = 0, wstart, wend, window, wvalue;\n    int start = 1;\n    BIGNUM *aa;\n    BIGNUM *val[TABLE_SIZE];\n    BN_RECP_CTX recp;\n    if (BN_get_flags(p, BN_FLG_CONSTTIME) != 0\n            || BN_get_flags(a, BN_FLG_CONSTTIME) != 0\n            || BN_get_flags(m, BN_FLG_CONSTTIME) != 0) {\n        BNerr(BN_F_BN_MOD_EXP_RECP, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);\n        return 0;\n    }\n    bits = BN_num_bits(p);\n    if (bits == 0) {\n        if (BN_is_one(m)) {\n            ret = 1;\n            BN_zero(r);\n        } else {\n            ret = BN_one(r);\n        }\n        return ret;\n    }\n    BN_CTX_start(ctx);\n    aa = BN_CTX_get(ctx);\n    val[0] = BN_CTX_get(ctx);\n    if (val[0] == NULL)\n        goto err;\n    BN_RECP_CTX_init(&recp);\n    if (m->neg) {\n        if (!BN_copy(aa, m))\n            goto err;\n        aa->neg = 0;\n        if (BN_RECP_CTX_set(&recp, aa, ctx) <= 0)\n            goto err;\n    } else {\n        if (BN_RECP_CTX_set(&recp, m, ctx) <= 0)\n            goto err;\n    }\n    if (!BN_nnmod(val[0], a, m, ctx))\n        goto err;\n    if (BN_is_zero(val[0])) {\n        BN_zero(r);\n        ret = 1;\n        goto err;\n    }\n    window = BN_window_bits_for_exponent_size(bits);\n    if (window > 1) {\n        if (!BN_mod_mul_reciprocal(aa, val[0], val[0], &recp, ctx))\n            goto err;\n        j = 1 << (window - 1);\n        for (i = 1; i < j; i++) {\n            if (((val[i] = BN_CTX_get(ctx)) == NULL) ||\n                !BN_mod_mul_reciprocal(val[i], val[i - 1], aa, &recp, ctx))\n                goto err;\n        }\n    }\n    start = 1;\n    wvalue = 0;\n    wstart = bits - 1;\n    wend = 0;\n    if (!BN_one(r))\n        goto err;\n    for (;;) {\n        if (BN_is_bit_set(p, wstart) == 0) {\n            if (!start)\n                if (!BN_mod_mul_reciprocal(r, r, r, &recp, ctx))\n                    goto err;\n            if (wstart == 0)\n                break;\n            wstart--;\n            continue;\n        }\n        j = wstart;\n        wvalue = 1;\n        wend = 0;\n        for (i = 1; i < window; i++) {\n            if (wstart - i < 0)\n                break;\n            if (BN_is_bit_set(p, wstart - i)) {\n                wvalue <<= (i - wend);\n                wvalue |= 1;\n                wend = i;\n            }\n        }\n        j = wend + 1;\n        if (!start)\n            for (i = 0; i < j; i++) {\n                if (!BN_mod_mul_reciprocal(r, r, r, &recp, ctx))\n                    goto err;\n            }\n        if (!BN_mod_mul_reciprocal(r, r, val[wvalue >> 1], &recp, ctx))\n            goto err;\n        wstart -= wend + 1;\n        wvalue = 0;\n        start = 0;\n        if (wstart < 0)\n            break;\n    }\n    ret = 1;\n err:\n    BN_CTX_end(ctx);\n    BN_RECP_CTX_free(&recp);\n    bn_check_top(r);\n    return ret;\n}', 'int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)\n{\n    if (!(BN_mod(r, m, d, ctx)))\n        return 0;\n    if (!r->neg)\n        return 1;\n    return (d->neg ? BN_sub : BN_add) (r, r, d);\n}', 'int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,\n           BN_CTX *ctx)\n{\n    int norm_shift, i, loop;\n    BIGNUM *tmp, wnum, *snum, *sdiv, *res;\n    BN_ULONG *resp, *wnump;\n    BN_ULONG d0, d1;\n    int num_n, div_n;\n    int no_branch = 0;\n    if ((num->top > 0 && num->d[num->top - 1] == 0) ||\n        (divisor->top > 0 && divisor->d[divisor->top - 1] == 0)) {\n        BNerr(BN_F_BN_DIV, BN_R_NOT_INITIALIZED);\n        return 0;\n    }\n    bn_check_top(num);\n    bn_check_top(divisor);\n    if ((BN_get_flags(num, BN_FLG_CONSTTIME) != 0)\n        || (BN_get_flags(divisor, BN_FLG_CONSTTIME) != 0)) {\n        no_branch = 1;\n    }\n    bn_check_top(dv);\n    bn_check_top(rm);\n    if (BN_is_zero(divisor)) {\n        BNerr(BN_F_BN_DIV, BN_R_DIV_BY_ZERO);\n        return 0;\n    }\n    if (!no_branch && BN_ucmp(num, divisor) < 0) {\n        if (rm != NULL) {\n            if (BN_copy(rm, num) == NULL)\n                return 0;\n        }\n        if (dv != NULL)\n            BN_zero(dv);\n        return 1;\n    }\n    BN_CTX_start(ctx);\n    res = (dv == NULL) ? BN_CTX_get(ctx) : dv;\n    tmp = BN_CTX_get(ctx);\n    snum = BN_CTX_get(ctx);\n    sdiv = BN_CTX_get(ctx);\n    if (sdiv == NULL)\n        goto err;\n    norm_shift = BN_BITS2 - ((BN_num_bits(divisor)) % BN_BITS2);\n    if (!(BN_lshift(sdiv, divisor, norm_shift)))\n        goto err;\n    sdiv->neg = 0;\n    norm_shift += BN_BITS2;\n    if (!(BN_lshift(snum, num, norm_shift)))\n        goto err;\n    snum->neg = 0;\n    if (no_branch) {\n        if (snum->top <= sdiv->top + 1) {\n            if (bn_wexpand(snum, sdiv->top + 2) == NULL)\n                goto err;\n            for (i = snum->top; i < sdiv->top + 2; i++)\n                snum->d[i] = 0;\n            snum->top = sdiv->top + 2;\n        } else {\n            if (bn_wexpand(snum, snum->top + 1) == NULL)\n                goto err;\n            snum->d[snum->top] = 0;\n            snum->top++;\n        }\n    }\n    div_n = sdiv->top;\n    num_n = snum->top;\n    loop = num_n - div_n;\n    wnum.neg = 0;\n    wnum.d = &(snum->d[loop]);\n    wnum.top = div_n;\n    wnum.dmax = snum->dmax - loop;\n    d0 = sdiv->d[div_n - 1];\n    d1 = (div_n == 1) ? 0 : sdiv->d[div_n - 2];\n    wnump = &(snum->d[num_n - 1]);\n    if (!bn_wexpand(res, (loop + 1)))\n        goto err;\n    res->neg = (num->neg ^ divisor->neg);\n    res->top = loop - no_branch;\n    resp = &(res->d[loop - 1]);\n    if (!bn_wexpand(tmp, (div_n + 1)))\n        goto err;\n    if (!no_branch) {\n        if (BN_ucmp(&wnum, sdiv) >= 0) {\n            bn_clear_top2max(&wnum);\n            bn_sub_words(wnum.d, wnum.d, sdiv->d, div_n);\n            *resp = 1;\n        } else\n            res->top--;\n    }\n    resp++;\n    if (res->top == 0)\n        res->neg = 0;\n    else\n        resp--;\n    for (i = 0; i < loop - 1; i++, wnump--) {\n        BN_ULONG q, l0;\n# if defined(BN_DIV3W) && !defined(OPENSSL_NO_ASM)\n        BN_ULONG bn_div_3_words(BN_ULONG *, BN_ULONG, BN_ULONG);\n        q = bn_div_3_words(wnump, d1, d0);\n# else\n        BN_ULONG n0, n1, rem = 0;\n        n0 = wnump[0];\n        n1 = wnump[-1];\n        if (n0 == d0)\n            q = BN_MASK2;\n        else {\n#  ifdef BN_LLONG\n            BN_ULLONG t2;\n#   if defined(BN_LLONG) && defined(BN_DIV2W) && !defined(bn_div_words)\n            q = (BN_ULONG)(((((BN_ULLONG) n0) << BN_BITS2) | n1) / d0);\n#   else\n            q = bn_div_words(n0, n1, d0);\n#   endif\n#   ifndef REMAINDER_IS_ALREADY_CALCULATED\n            rem = (n1 - q * d0) & BN_MASK2;\n#   endif\n            t2 = (BN_ULLONG) d1 *q;\n            for (;;) {\n                if (t2 <= ((((BN_ULLONG) rem) << BN_BITS2) | wnump[-2]))\n                    break;\n                q--;\n                rem += d0;\n                if (rem < d0)\n                    break;\n                t2 -= d1;\n            }\n#  else\n            BN_ULONG t2l, t2h;\n            q = bn_div_words(n0, n1, d0);\n#   ifndef REMAINDER_IS_ALREADY_CALCULATED\n            rem = (n1 - q * d0) & BN_MASK2;\n#   endif\n#   if defined(BN_UMULT_LOHI)\n            BN_UMULT_LOHI(t2l, t2h, d1, q);\n#   elif defined(BN_UMULT_HIGH)\n            t2l = d1 * q;\n            t2h = BN_UMULT_HIGH(d1, q);\n#   else\n            {\n                BN_ULONG ql, qh;\n                t2l = LBITS(d1);\n                t2h = HBITS(d1);\n                ql = LBITS(q);\n                qh = HBITS(q);\n                mul64(t2l, t2h, ql, qh);\n            }\n#   endif\n            for (;;) {\n                if ((t2h < rem) || ((t2h == rem) && (t2l <= wnump[-2])))\n                    break;\n                q--;\n                rem += d0;\n                if (rem < d0)\n                    break;\n                if (t2l < d1)\n                    t2h--;\n                t2l -= d1;\n            }\n#  endif\n        }\n# endif\n        l0 = bn_mul_words(tmp->d, sdiv->d, div_n, q);\n        tmp->d[div_n] = l0;\n        wnum.d--;\n        if (bn_sub_words(wnum.d, wnum.d, tmp->d, div_n + 1)) {\n            q--;\n            if (bn_add_words(wnum.d, wnum.d, sdiv->d, div_n))\n                (*wnump)++;\n        }\n        resp--;\n        *resp = q;\n    }\n    bn_correct_top(snum);\n    if (rm != NULL) {\n        int neg = num->neg;\n        BN_rshift(rm, snum, norm_shift);\n        if (!BN_is_zero(rm))\n            rm->neg = neg;\n        bn_check_top(rm);\n    }\n    if (no_branch)\n        bn_correct_top(res);\n    BN_CTX_end(ctx);\n    return 1;\n err:\n    bn_check_top(rm);\n    BN_CTX_end(ctx);\n    return 0;\n}', 'static unsigned int BN_STACK_pop(BN_STACK *st)\n{\n    return st->indexes[--(st->depth)];\n}']