crypto/ec/curve448/curve448.c:370: error: INTEGER_OVERFLOW_L2
  ([0, `*enc`] - 1):unsigned64 by call to `word_is_zero`.
Showing all 5 steps of the trace


crypto/ec/curve448/curve448.c:355:1: Parameter `*enc`
353.   
354.   
355. > decaf_error_t curve448_point_decode_like_eddsa_and_mul_by_ratio (
356.       curve448_point_t p,
357.       const uint8_t enc[DECAF_EDDSA_448_PUBLIC_BYTES]

crypto/ec/curve448/curve448.c:370:13: Call
368.       succ = gf_deserialize(p->y, enc2, 1, 0);
369.   #if 0 == 0
370.       succ &= word_is_zero(enc2[DECAF_EDDSA_448_PRIVATE_BYTES-1]);
                   ^
371.   #endif
372.   

crypto/ec/curve448/arch_32/arch_intrinsics.h:10:1: <LHS trace>
8.   #define ARCH_WORD_BITS 32
9.   
10. > static __inline__ __attribute((always_inline,unused))
11.   uint32_t word_is_zero(uint32_t a) {
12.       /* let's hope the compiler isn't clever enough to optimize this. */

crypto/ec/curve448/arch_32/arch_intrinsics.h:10:1: Parameter `a`
  8.   #define ARCH_WORD_BITS 32
  9.   
  10. > static __inline__ __attribute((always_inline,unused))
  11.   uint32_t word_is_zero(uint32_t a) {
  12.       /* let's hope the compiler isn't clever enough to optimize this. */

crypto/ec/curve448/arch_32/arch_intrinsics.h:13:5: Binary operation: ([0, *enc] - 1):unsigned64 by call to `word_is_zero` 
  11.   uint32_t word_is_zero(uint32_t a) {
  12.       /* let's hope the compiler isn't clever enough to optimize this. */
  13.       return (((uint64_t)a)-1)>>32;
            ^
  14.   }
  15.   

static __inline__ __attribute((always_inline,unused))
uint32_t word_is_zero(uint32_t a) {
    return (((uint64_t)a)-1)>>32;
}
['decaf_error_t curve448_point_decode_like_eddsa_and_mul_by_ratio (\n    curve448_point_t p,\n    const uint8_t enc[DECAF_EDDSA_448_PUBLIC_BYTES]\n) {\n    uint8_t enc2[DECAF_EDDSA_448_PUBLIC_BYTES];\n    mask_t low;\n    mask_t succ;\n    memcpy(enc2,enc,sizeof(enc2));\n    low = ~word_is_zero(enc2[DECAF_EDDSA_448_PRIVATE_BYTES-1] & 0x80);\n    enc2[DECAF_EDDSA_448_PRIVATE_BYTES-1] &= ~0x80;\n    succ = gf_deserialize(p->y, enc2, 1, 0);\n#if 0 == 0\n    succ &= word_is_zero(enc2[DECAF_EDDSA_448_PRIVATE_BYTES-1]);\n#endif\n    gf_sqr(p->x,p->y);\n    gf_sub(p->z,ONE,p->x);\n    gf_mulw(p->t,p->x,EDWARDS_D);\n    gf_sub(p->t,ONE,p->t);\n    gf_mul(p->x,p->z,p->t);\n    succ &= gf_isr(p->t,p->x);\n    gf_mul(p->x,p->t,p->z);\n    gf_cond_neg(p->x,gf_lobit(p->x)^low);\n    gf_copy(p->z,ONE);\n    {\n        gf a, b, c, d;\n        gf_sqr ( c, p->x );\n        gf_sqr ( a, p->y );\n        gf_add ( d, c, a );\n        gf_add ( p->t, p->y, p->x );\n        gf_sqr ( b, p->t );\n        gf_sub ( b, b, d );\n        gf_sub ( p->t, a, c );\n        gf_sqr ( p->x, p->z );\n        gf_add ( p->z, p->x, p->x );\n        gf_sub ( a, p->z, d );\n        gf_mul ( p->x, a, b );\n        gf_mul ( p->z, p->t, a );\n        gf_mul ( p->y, p->t, d );\n        gf_mul ( p->t, b, d );\n        OPENSSL_cleanse(a,sizeof(a));\n        OPENSSL_cleanse(b,sizeof(b));\n        OPENSSL_cleanse(c,sizeof(c));\n        OPENSSL_cleanse(d,sizeof(d));\n    }\n    OPENSSL_cleanse(enc2,sizeof(enc2));\n    assert(curve448_point_valid(p) || ~succ);\n    return decaf_succeed_if(mask_to_bool(succ));\n}', 'static __inline__ __attribute((always_inline,unused))\nuint32_t word_is_zero(uint32_t a) {\n    return (((uint64_t)a)-1)>>32;\n}']