crypto/ec/curve25519.c:473: error: INTEGER_OVERFLOW_L2
  (0 - [0, 1]):unsigned64 by call to `fe51_cswap`.
Showing all 5 steps of the trace


crypto/ec/curve25519.c:434:5: Assignment
432.       fe51 x1, x2, z2, x3, z3, tmp0, tmp1;
433.       uint8_t e[32];
434.       unsigned swap = 0;
           ^
435.       int pos;
436.   

crypto/ec/curve25519.c:473:5: Call
471.           fe51_mul(z2, tmp1, tmp0);
472.       }
473.       fe51_cswap(x2, x3, swap);
           ^
474.       fe51_cswap(z2, z3, swap);
475.   

crypto/ec/curve25519.c:295:1: <RHS trace>
293.   }
294.   
295. > static void fe51_cswap(fe51 f, fe51 g, unsigned int b)
296.   {
297.       int i;

crypto/ec/curve25519.c:295:1: Parameter `b`
  293.   }
  294.   
  295. > static void fe51_cswap(fe51 f, fe51 g, unsigned int b)
  296.   {
  297.       int i;

crypto/ec/curve25519.c:298:5: Binary operation: (0 - [0, 1]):unsigned64 by call to `fe51_cswap` 
  296.   {
  297.       int i;
  298.       uint64_t mask = 0 - (uint64_t)b;
             ^
  299.   
  300.       for (i = 0; i < 5; i++) {

static void fe51_cswap(fe51 f, fe51 g, unsigned int b)
{
    int i;
    uint64_t mask = 0 - (uint64_t)b;
    for (i = 0; i < 5; i++) {
        int64_t x = f[i] ^ g[i];
        x &= mask;
        f[i] ^= x;
        g[i] ^= x;
    }
}
['static void x25519_scalar_mult(uint8_t out[32], const uint8_t scalar[32],\n                               const uint8_t point[32])\n{\n    fe51 x1, x2, z2, x3, z3, tmp0, tmp1;\n    uint8_t e[32];\n    unsigned swap = 0;\n    int pos;\n    memcpy(e, scalar, 32);\n    e[0]  &= 0xf8;\n    e[31] &= 0x7f;\n    e[31] |= 0x40;\n    fe51_frombytes(x1, point);\n    fe51_1(x2);\n    fe51_0(z2);\n    fe51_copy(x3, x1);\n    fe51_1(z3);\n    for (pos = 254; pos >= 0; --pos) {\n        unsigned int b = 1 & (e[pos / 8] >> (pos & 7));\n        swap ^= b;\n        fe51_cswap(x2, x3, swap);\n        fe51_cswap(z2, z3, swap);\n        swap = b;\n        fe51_sub(tmp0, x3, z3);\n        fe51_sub(tmp1, x2, z2);\n        fe51_add(x2, x2, z2);\n        fe51_add(z2, x3, z3);\n        fe51_mul(z3, tmp0, x2);\n        fe51_mul(z2, z2, tmp1);\n        fe51_sq(tmp0, tmp1);\n        fe51_sq(tmp1, x2);\n        fe51_add(x3, z3, z2);\n        fe51_sub(z2, z3, z2);\n        fe51_mul(x2, tmp1, tmp0);\n        fe51_sub(tmp1, tmp1, tmp0);\n        fe51_sq(z2, z2);\n        fe51_mul121666(z3, tmp1);\n        fe51_sq(x3, x3);\n        fe51_add(tmp0, tmp0, z3);\n        fe51_mul(z3, x1, z2);\n        fe51_mul(z2, tmp1, tmp0);\n    }\n    fe51_cswap(x2, x3, swap);\n    fe51_cswap(z2, z3, swap);\n    fe51_invert(z2, z2);\n    fe51_mul(x2, x2, z2);\n    fe51_tobytes(out, x2);\n    OPENSSL_cleanse(e, sizeof(e));\n}', 'static void fe51_cswap(fe51 f, fe51 g, unsigned int b)\n{\n    int i;\n    uint64_t mask = 0 - (uint64_t)b;\n    for (i = 0; i < 5; i++) {\n        int64_t x = f[i] ^ g[i];\n        x &= mask;\n        f[i] ^= x;\n        g[i] ^= x;\n    }\n}']