ssl/s3_cbc.c:180: error: INTEGER_OVERFLOW_L2
  ([0, `*rec->data`] - [0, 254]):unsigned32 by call to `constant_time_ge_8`.
Showing all 11 steps of the trace


ssl/s3_cbc.c:111:1: Parameter `rec->length`
109.    *   1: if the padding was valid
110.    *  -1: otherwise. */
111. > int tls1_cbc_remove_padding(const SSL* s,
112.   			    SSL3_RECORD *rec,
113.   			    unsigned block_size,

ssl/s3_cbc.c:180:24: Call
178.   	for (i = 0; i < to_check; i++)
179.   		{
180.   		unsigned char mask = constant_time_ge_8(padding_length, i);
                              ^
181.   		unsigned char b = rec->data[rec->length-1-i];
182.   		/* The final |padding_length+1| bytes should all have the value

crypto/constant_time_locl.h:150:1: Parameter `a`
  148.   	}
  149.   
  150. > static inline unsigned char constant_time_ge_8(unsigned int a, unsigned int b)
  151.   	{
  152.   	return (unsigned char)(constant_time_ge(a, b));

crypto/constant_time_locl.h:152:25: Call
  150.   static inline unsigned char constant_time_ge_8(unsigned int a, unsigned int b)
  151.   	{
  152.   	return (unsigned char)(constant_time_ge(a, b));
                                 ^
  153.   	}
  154.   

crypto/constant_time_locl.h:145:1: Parameter `a`
    143.   	}
    144.   
    145. > static inline unsigned int constant_time_ge(unsigned int a, unsigned int b)
    146.   	{
    147.   	return ~constant_time_lt(a, b);

crypto/constant_time_locl.h:147:10: Call
    145.   static inline unsigned int constant_time_ge(unsigned int a, unsigned int b)
    146.   	{
    147.   	return ~constant_time_lt(a, b);
                    ^
    148.   	}
    149.   

crypto/constant_time_locl.h:135:1: <LHS trace>
133.   	}
134.   
135. > static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
136.   	{
137.   	return constant_time_msb(a^((a^b)|((a-b)^b)));

crypto/constant_time_locl.h:135:1: Parameter `a`
      133.   	}
      134.   
      135. > static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
      136.   	{
      137.   	return constant_time_msb(a^((a^b)|((a-b)^b)));

crypto/constant_time_locl.h:135:1: <RHS trace>
133.   	}
134.   
135. > static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
136.   	{
137.   	return constant_time_msb(a^((a^b)|((a-b)^b)));

crypto/constant_time_locl.h:135:1: Parameter `b`
      133.   	}
      134.   
      135. > static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
      136.   	{
      137.   	return constant_time_msb(a^((a^b)|((a-b)^b)));

crypto/constant_time_locl.h:137:9: Binary operation: ([0, *rec->data] - [0, 254]):unsigned32 by call to `constant_time_ge_8` 
      135.   static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
      136.   	{
      137.   	return constant_time_msb(a^((a^b)|((a-b)^b)));
                     ^
      138.   	}
      139.   

static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
	{
	return constant_time_msb(a^((a^b)|((a-b)^b)));
	}
['int tls1_cbc_remove_padding(const SSL* s,\n\t\t\t    SSL3_RECORD *rec,\n\t\t\t    unsigned block_size,\n\t\t\t    unsigned mac_size)\n\t{\n\tunsigned padding_length, good, to_check, i;\n\tconst unsigned overhead = 1   + mac_size;\n\tif (SSL_USE_EXPLICIT_IV(s))\n\t\t{\n\t\tif (overhead + block_size > rec->length)\n\t\t\treturn 0;\n\t\trec->data += block_size;\n\t\trec->input += block_size;\n\t\trec->length -= block_size;\n\t\trec->orig_len -= block_size;\n\t\t}\n\telse if (overhead > rec->length)\n\t\treturn 0;\n\tpadding_length = rec->data[rec->length-1];\n\tif ( (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand)\n\t\t{\n\t\tif ((memcmp(s->s3->read_sequence, "\\0\\0\\0\\0\\0\\0\\0\\0",8) == 0) &&\n\t\t    !(padding_length & 1))\n\t\t\t{\n\t\t\ts->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;\n\t\t\t}\n\t\tif ((s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) &&\n\t\t    padding_length > 0)\n\t\t\t{\n\t\t\tpadding_length--;\n\t\t\t}\n\t\t}\n\tif (EVP_CIPHER_flags(s->enc_read_ctx->cipher)&EVP_CIPH_FLAG_AEAD_CIPHER)\n\t\t{\n\t\trec->length -= padding_length + 1;\n\t\treturn 1;\n\t\t}\n\tgood = constant_time_ge(rec->length, overhead+padding_length);\n\tto_check = 255;\n\tif (to_check > rec->length-1)\n\t\tto_check = rec->length-1;\n\tfor (i = 0; i < to_check; i++)\n\t\t{\n\t\tunsigned char mask = constant_time_ge_8(padding_length, i);\n\t\tunsigned char b = rec->data[rec->length-1-i];\n\t\tgood &= ~(mask&(padding_length ^ b));\n\t\t}\n\tgood = constant_time_eq(0xff, good & 0xff);\n\trec->length -= good & (padding_length+1);\n\treturn constant_time_select_int(good, 1, -1);\n\t}', 'static inline unsigned char constant_time_ge_8(unsigned int a, unsigned int b)\n\t{\n\treturn (unsigned char)(constant_time_ge(a, b));\n\t}', 'static inline unsigned int constant_time_ge(unsigned int a, unsigned int b)\n\t{\n\treturn ~constant_time_lt(a, b);\n\t}', 'static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)\n\t{\n\treturn constant_time_msb(a^((a^b)|((a-b)^b)));\n\t}']