crypto/ec/curve448/eddsa.c:112: error: INTEGER_OVERFLOW_L2
  (0 - [0, 1]):unsigned64 by call to `curve448_scalar_halve`.
Showing all 6 steps of the trace


crypto/ec/curve448/eddsa.c:100:5: Call
98.       clamp(secret_scalar_ser);
99.   
100.       curve448_scalar_decode_long(secret_scalar, secret_scalar_ser,
           ^
101.                                   sizeof(secret_scalar_ser));
102.   

crypto/ec/curve448/scalar.c:173:1: Parameter `s->limb[*]`
  171.   }
  172.   
  173. > void curve448_scalar_decode_long(curve448_scalar_t s,
  174.                                    const unsigned char *ser, size_t ser_len)
  175.   {

crypto/ec/curve448/eddsa.c:112:9: Call
110.        */
111.       for (c = 1; c < C448_EDDSA_ENCODE_RATIO; c <<= 1)
112.           curve448_scalar_halve(secret_scalar, secret_scalar);
               ^
113.   
114.       curve448_precomputed_scalarmul(p, curve448_precomputed_base, secret_scalar);

crypto/ec/curve448/scalar.c:221:1: <RHS trace>
219.   }
220.   
221. > void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
222.   {
223.       c448_word_t mask = 0 - (a->limb[0] & 1);

crypto/ec/curve448/scalar.c:221:1: Parameter `a->limb[*]`
  219.   }
  220.   
  221. > void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
  222.   {
  223.       c448_word_t mask = 0 - (a->limb[0] & 1);

crypto/ec/curve448/scalar.c:223:5: Binary operation: (0 - [0, 1]):unsigned64 by call to `curve448_scalar_halve` 
  221.   void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
  222.   {
  223.       c448_word_t mask = 0 - (a->limb[0] & 1);
             ^
  224.       c448_dword_t chain = 0;
  225.       unsigned int i;

void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
{
    c448_word_t mask = 0 - (a->limb[0] & 1);
    c448_dword_t chain = 0;
    unsigned int i;
    for (i = 0; i < C448_SCALAR_LIMBS; i++) {
        chain = (chain + a->limb[i]) + (sc_p->limb[i] & mask);
        out->limb[i] = (c448_word_t)chain;
        chain >>= C448_WORD_BITS;
    }
    for (i = 0; i < C448_SCALAR_LIMBS - 1; i++)
        out->limb[i] = out->limb[i] >> 1 | out->limb[i + 1] << (WBITS - 1);
    out->limb[i] = out->limb[i] >> 1 | (c448_word_t)(chain << (WBITS - 1));
}
['c448_error_t c448_ed448_derive_public_key(\n                        uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],\n                        const uint8_t privkey[EDDSA_448_PRIVATE_BYTES])\n{\n    uint8_t secret_scalar_ser[EDDSA_448_PRIVATE_BYTES];\n    curve448_scalar_t secret_scalar;\n    unsigned int c;\n    curve448_point_t p;\n    if (!oneshot_hash(secret_scalar_ser, sizeof(secret_scalar_ser), privkey,\n                      EDDSA_448_PRIVATE_BYTES))\n        return C448_FAILURE;\n    clamp(secret_scalar_ser);\n    curve448_scalar_decode_long(secret_scalar, secret_scalar_ser,\n                                sizeof(secret_scalar_ser));\n    for (c = 1; c < C448_EDDSA_ENCODE_RATIO; c <<= 1)\n        curve448_scalar_halve(secret_scalar, secret_scalar);\n    curve448_precomputed_scalarmul(p, curve448_precomputed_base, secret_scalar);\n    curve448_point_mul_by_ratio_and_encode_like_eddsa(pubkey, p);\n    curve448_scalar_destroy(secret_scalar);\n    curve448_point_destroy(p);\n    OPENSSL_cleanse(secret_scalar_ser, sizeof(secret_scalar_ser));\n    return C448_SUCCESS;\n}', 'void curve448_scalar_decode_long(curve448_scalar_t s,\n                                 const unsigned char *ser, size_t ser_len)\n{\n    size_t i;\n    curve448_scalar_t t1, t2;\n    if (ser_len == 0) {\n        curve448_scalar_copy(s, curve448_scalar_zero);\n        return;\n    }\n    i = ser_len - (ser_len % C448_SCALAR_BYTES);\n    if (i == ser_len)\n        i -= C448_SCALAR_BYTES;\n    scalar_decode_short(t1, &ser[i], ser_len - i);\n    if (ser_len == sizeof(curve448_scalar_t)) {\n        assert(i == 0);\n        curve448_scalar_mul(s, t1, curve448_scalar_one);\n        curve448_scalar_destroy(t1);\n        return;\n    }\n    while (i) {\n        i -= C448_SCALAR_BYTES;\n        sc_montmul(t1, t1, sc_r2);\n        (void)curve448_scalar_decode(t2, ser + i);\n        curve448_scalar_add(t1, t1, t2);\n    }\n    curve448_scalar_copy(s, t1);\n    curve448_scalar_destroy(t1);\n    curve448_scalar_destroy(t2);\n}', 'void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)\n{\n    c448_word_t mask = 0 - (a->limb[0] & 1);\n    c448_dword_t chain = 0;\n    unsigned int i;\n    for (i = 0; i < C448_SCALAR_LIMBS; i++) {\n        chain = (chain + a->limb[i]) + (sc_p->limb[i] & mask);\n        out->limb[i] = (c448_word_t)chain;\n        chain >>= C448_WORD_BITS;\n    }\n    for (i = 0; i < C448_SCALAR_LIMBS - 1; i++)\n        out->limb[i] = out->limb[i] >> 1 | out->limb[i + 1] << (WBITS - 1);\n    out->limb[i] = out->limb[i] >> 1 | (c448_word_t)(chain << (WBITS - 1));\n}']