crypto/rsa/rsa_pk1.c:239: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 10):unsigned32 by call to `constant_time_ge`.
Showing all 9 steps of the trace


crypto/rsa/rsa_pk1.c:192:2: Assignment
190.   	unsigned char *em = NULL;
191.   	unsigned int good, found_zero_byte;
192.   	int zero_index = 0, msg_index, mlen = -1;
        ^
193.   
194.           if (tlen < 0 || flen < 0)

crypto/rsa/rsa_pk1.c:239:10: Call
237.   	 * also fails.
238.   	 */
239.   	good &= constant_time_ge((unsigned int)(zero_index), 2 + 8);
                ^
240.   
241.   	/* Skip the zero byte. This is incorrect if we never found a zero-byte

crypto/constant_time_locl.h:145:1: Parameter `a`
  143.   	}
  144.   
  145. > static inline unsigned int constant_time_ge(unsigned int a, unsigned int b)
  146.   	{
  147.   	return ~constant_time_lt(a, b);

crypto/constant_time_locl.h:147:10: Call
  145.   static inline unsigned int constant_time_ge(unsigned int a, unsigned int b)
  146.   	{
  147.   	return ~constant_time_lt(a, b);
                  ^
  148.   	}
  149.   

crypto/constant_time_locl.h:135:1: <LHS trace>
133.   	}
134.   
135. > static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
136.   	{
137.   	return constant_time_msb(a^((a^b)|((a-b)^b)));

crypto/constant_time_locl.h:135:1: Parameter `a`
    133.   	}
    134.   
    135. > static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
    136.   	{
    137.   	return constant_time_msb(a^((a^b)|((a-b)^b)));

crypto/constant_time_locl.h:135:1: <RHS trace>
133.   	}
134.   
135. > static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
136.   	{
137.   	return constant_time_msb(a^((a^b)|((a-b)^b)));

crypto/constant_time_locl.h:135:1: Parameter `b`
    133.   	}
    134.   
    135. > static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
    136.   	{
    137.   	return constant_time_msb(a^((a^b)|((a-b)^b)));

crypto/constant_time_locl.h:137:9: Binary operation: ([0, +oo] - 10):unsigned32 by call to `constant_time_ge` 
    135.   static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
    136.   	{
    137.   	return constant_time_msb(a^((a^b)|((a-b)^b)));
                   ^
    138.   	}
    139.   

static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
	{
	return constant_time_msb(a^((a^b)|((a-b)^b)));
	}
['int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen,\n\t     const unsigned char *from, int flen, int num)\n\t{\n\tint i;\n\tunsigned char *em = NULL;\n\tunsigned int good, found_zero_byte;\n\tint zero_index = 0, msg_index, mlen = -1;\n        if (tlen < 0 || flen < 0)\n\t\treturn -1;\n\tif (flen > num)\n\t\tgoto err;\n\tif (num < 11)\n\t\tgoto err;\n\tem = OPENSSL_malloc(num);\n\tif (em == NULL)\n\t\t{\n\t\tRSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, ERR_R_MALLOC_FAILURE);\n\t\treturn -1;\n\t\t}\n\tmemset(em, 0, num);\n\tmemcpy(em + num - flen, from, flen);\n\tgood = constant_time_is_zero(em[0]);\n\tgood &= constant_time_eq(em[1], 2);\n\tfound_zero_byte = 0;\n\tfor (i = 2; i < num; i++)\n\t\t{\n\t\tunsigned int equals0 = constant_time_is_zero(em[i]);\n\t\tzero_index = constant_time_select_int(~found_zero_byte & equals0, i, zero_index);\n\t\tfound_zero_byte |= equals0;\n\t\t}\n\tgood &= constant_time_ge((unsigned int)(zero_index), 2 + 8);\n\tmsg_index = zero_index + 1;\n\tmlen = num - msg_index;\n\tgood &= constant_time_ge((unsigned int)(tlen), (unsigned int)(mlen));\n\tif (!good)\n\t\t{\n\t\tmlen = -1;\n\t\tgoto err;\n\t\t}\n\tmemcpy(to, em + msg_index, mlen);\nerr:\n\tif (em != NULL)\n\t\tOPENSSL_free(em);\n\tif (mlen == -1)\n\t\tRSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, RSA_R_PKCS_DECODING_ERROR);\n\treturn mlen;\n\t}', 'static inline unsigned int constant_time_ge(unsigned int a, unsigned int b)\n\t{\n\treturn ~constant_time_lt(a, b);\n\t}', 'static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)\n\t{\n\treturn constant_time_msb(a^((a^b)|((a-b)^b)));\n\t}']