crypto/ec/curve448/curve448.c:334: error: INTEGER_OVERFLOW_L2
  ([0, `*enc`] - 1):unsigned32 by call to `constant_time_is_zero_32`.
Showing all 5 steps of the trace


crypto/ec/curve448/curve448.c:320:1: Parameter `*enc`
318.   }
319.   
320. > c448_error_t curve448_point_decode_like_eddsa_and_mul_by_ratio(
321.                                   curve448_point_t p,
322.                                   const uint8_t enc[EDDSA_448_PUBLIC_BYTES])

crypto/ec/curve448/curve448.c:334:13: Call
332.   
333.       succ = gf_deserialize(p->y, enc2, 1, 0);
334.       succ &= word_is_zero(enc2[EDDSA_448_PRIVATE_BYTES - 1]);
                   ^
335.   
336.       gf_sqr(p->x, p->y);

include/internal/constant_time_locl.h:183:1: <LHS trace>
181.   }
182.   
183. > static ossl_inline uint32_t constant_time_is_zero_32(uint32_t a)
184.   {
185.       return constant_time_msb_32(~a & (a - 1));

include/internal/constant_time_locl.h:183:1: Parameter `a`
  181.   }
  182.   
  183. > static ossl_inline uint32_t constant_time_is_zero_32(uint32_t a)
  184.   {
  185.       return constant_time_msb_32(~a & (a - 1));

include/internal/constant_time_locl.h:185:12: Binary operation: ([0, *enc] - 1):unsigned32 by call to `constant_time_is_zero_32` 
  183.   static ossl_inline uint32_t constant_time_is_zero_32(uint32_t a)
  184.   {
  185.       return constant_time_msb_32(~a & (a - 1));
                    ^
  186.   }
  187.   

static ossl_inline uint32_t constant_time_is_zero_32(uint32_t a)
{
    return constant_time_msb_32(~a & (a - 1));
}
['c448_error_t curve448_point_decode_like_eddsa_and_mul_by_ratio(\n                                curve448_point_t p,\n                                const uint8_t enc[EDDSA_448_PUBLIC_BYTES])\n{\n    uint8_t enc2[EDDSA_448_PUBLIC_BYTES];\n    mask_t low;\n    mask_t succ;\n    memcpy(enc2, enc, sizeof(enc2));\n    low = ~word_is_zero(enc2[EDDSA_448_PRIVATE_BYTES - 1] & 0x80);\n    enc2[EDDSA_448_PRIVATE_BYTES - 1] &= ~0x80;\n    succ = gf_deserialize(p->y, enc2, 1, 0);\n    succ &= word_is_zero(enc2[EDDSA_448_PRIVATE_BYTES - 1]);\n    gf_sqr(p->x, p->y);\n    gf_sub(p->z, ONE, p->x);\n    gf_mulw(p->t, p->x, EDWARDS_D);\n    gf_sub(p->t, ONE, p->t);\n    gf_mul(p->x, p->z, p->t);\n    succ &= gf_isr(p->t, p->x);\n    gf_mul(p->x, p->t, p->z);\n    gf_cond_neg(p->x, gf_lobit(p->x) ^ low);\n    gf_copy(p->z, ONE);\n    {\n        gf a, b, c, d;\n        gf_sqr(c, p->x);\n        gf_sqr(a, p->y);\n        gf_add(d, c, a);\n        gf_add(p->t, p->y, p->x);\n        gf_sqr(b, p->t);\n        gf_sub(b, b, d);\n        gf_sub(p->t, a, c);\n        gf_sqr(p->x, p->z);\n        gf_add(p->z, p->x, p->x);\n        gf_sub(a, p->z, d);\n        gf_mul(p->x, a, b);\n        gf_mul(p->z, p->t, a);\n        gf_mul(p->y, p->t, d);\n        gf_mul(p->t, b, d);\n        OPENSSL_cleanse(a, sizeof(a));\n        OPENSSL_cleanse(b, sizeof(b));\n        OPENSSL_cleanse(c, sizeof(c));\n        OPENSSL_cleanse(d, sizeof(d));\n    }\n    OPENSSL_cleanse(enc2, sizeof(enc2));\n    assert(curve448_point_valid(p) || ~succ);\n    return c448_succeed_if(mask_to_bool(succ));\n}', 'static ossl_inline uint32_t constant_time_is_zero_32(uint32_t a)\n{\n    return constant_time_msb_32(~a & (a - 1));\n}']