ssl/s3_cbc.c:191: error: INTEGER_OVERFLOW_L2
  ([0, `*rec->data`] - [0, 254]):unsigned32 by call to `constant_time_ge`.
Showing all 7 steps of the trace


ssl/s3_cbc.c:136:1: Parameter `rec->length`
134.    *   1: if the padding was valid
135.    *  -1: otherwise. */
136. > int tls1_cbc_remove_padding(const SSL* s,
137.   			    SSL3_RECORD *rec,
138.   			    unsigned block_size,

ssl/s3_cbc.c:191:24: Call
189.   	for (i = 0; i < to_check; i++)
190.   		{
191.   		unsigned char mask = constant_time_ge(padding_length, i);
                              ^
192.   		unsigned char b = rec->data[rec->length-1-i];
193.   		/* The final |padding_length+1| bytes should all have the value

ssl/s3_cbc.c:82:1: <LHS trace>
80.   
81.   /* constant_time_ge returns 0xff if a>=b and 0x00 otherwise. */
82. > static unsigned constant_time_ge(unsigned a, unsigned b)
83.   	{
84.   	a -= b;

ssl/s3_cbc.c:82:1: Parameter `a`
  80.   
  81.   /* constant_time_ge returns 0xff if a>=b and 0x00 otherwise. */
  82. > static unsigned constant_time_ge(unsigned a, unsigned b)
  83.   	{
  84.   	a -= b;

ssl/s3_cbc.c:82:1: <RHS trace>
80.   
81.   /* constant_time_ge returns 0xff if a>=b and 0x00 otherwise. */
82. > static unsigned constant_time_ge(unsigned a, unsigned b)
83.   	{
84.   	a -= b;

ssl/s3_cbc.c:82:1: Parameter `b`
  80.   
  81.   /* constant_time_ge returns 0xff if a>=b and 0x00 otherwise. */
  82. > static unsigned constant_time_ge(unsigned a, unsigned b)
  83.   	{
  84.   	a -= b;

ssl/s3_cbc.c:84:2: Binary operation: ([0, *rec->data] - [0, 254]):unsigned32 by call to `constant_time_ge` 
  82.   static unsigned constant_time_ge(unsigned a, unsigned b)
  83.   	{
  84.   	a -= b;
         ^
  85.   	return DUPLICATE_MSB_TO_ALL(~a);
  86.   	}

static unsigned constant_time_ge(unsigned a, unsigned b)
	{
	a -= b;
	return DUPLICATE_MSB_TO_ALL(~a);
	}
['int tls1_cbc_remove_padding(const SSL* s,\n\t\t\t    SSL3_RECORD *rec,\n\t\t\t    unsigned block_size,\n\t\t\t    unsigned mac_size)\n\t{\n\tunsigned padding_length, good, to_check, i;\n\tconst char has_explicit_iv =\n\t\ts->version >= TLS1_1_VERSION || s->version == DTLS1_VERSION;\n\tconst unsigned overhead = 1   +\n\t\t\t\t  mac_size +\n\t\t\t\t  (has_explicit_iv ? block_size : 0);\n\tif (overhead > rec->length)\n\t\treturn 0;\n\tpadding_length = rec->data[rec->length-1];\n\tif ( (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand)\n\t\t{\n\t\tif ((memcmp(s->s3->read_sequence, "\\0\\0\\0\\0\\0\\0\\0\\0",8) == 0) &&\n\t\t    !(padding_length & 1))\n\t\t\t{\n\t\t\ts->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;\n\t\t\t}\n\t\tif ((s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) &&\n\t\t    padding_length > 0)\n\t\t\t{\n\t\t\tpadding_length--;\n\t\t\t}\n\t\t}\n\tgood = constant_time_ge(rec->length, overhead+padding_length);\n\tto_check = 255;\n\tif (to_check > rec->length-1)\n\t\tto_check = rec->length-1;\n\tfor (i = 0; i < to_check; i++)\n\t\t{\n\t\tunsigned char mask = constant_time_ge(padding_length, i);\n\t\tunsigned char b = rec->data[rec->length-1-i];\n\t\tgood &= ~(mask&(padding_length ^ b));\n\t\t}\n\tgood &= good >> 4;\n\tgood &= good >> 2;\n\tgood &= good >> 1;\n\tgood <<= sizeof(good)*8-1;\n\tgood = DUPLICATE_MSB_TO_ALL(good);\n\trec->length -= good & (padding_length+1);\n\tif (has_explicit_iv)\n\t\t{\n\t\trec->data += block_size;\n\t\trec->input += block_size;\n\t\trec->length -= block_size;\n\t\trec->orig_len -= block_size;\n\t\t}\n\treturn (int)((good & 1) | (~good & -1));\n\t}', 'static unsigned constant_time_ge(unsigned a, unsigned b)\n\t{\n\ta -= b;\n\treturn DUPLICATE_MSB_TO_ALL(~a);\n\t}']