crypto/evp/evp_test.c:414: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `EVP_DecryptFinal_ex`.
Showing all 10 steps of the trace


crypto/evp/evp_test.c:410:6: Unknown value from: fprintf
408.   	if(!EVP_DecryptUpdate(ctx,out,&outl,ciphertext,cn))
409.   	    {
410.   	    fprintf(stderr,"Decrypt failed\n");
            ^
411.   	    ERR_print_errors_fp(stderr);
412.   	    test1_exit(6);

crypto/evp/evp_test.c:414:35: Call
412.   	    test1_exit(6);
413.   	    }
414.   	if(mode != EVP_CIPH_CCM_MODE && !EVP_DecryptFinal_ex(ctx,out+outl,&outl2))
                                         ^
415.   	    {
416.   	    fprintf(stderr,"DecryptFinal failed\n");

crypto/evp/evp_enc.c:493:1: Parameter `ctx->final[*]`
  491.   	}
  492.   
  493. > int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
  494.   	{
  495.   	unsigned int i, b;

crypto/evp/evp_enc.c:528:3: Assignment
  526.   			}
  527.   		OPENSSL_assert(b <= sizeof ctx->final);
  528.   		pad=ctx->final[b-1];
           ^
  529.   
  530.   		padding_good = (unsigned char)(~constant_time_is_zero_8(pad));

crypto/evp/evp_enc.c:530:35: Call
  528.   		pad=ctx->final[b-1];
  529.   
  530.   		padding_good = (unsigned char)(~constant_time_is_zero_8(pad));
                                           ^
  531.   		padding_good &= constant_time_ge_8(b, pad);
  532.   

crypto/constant_time_locl.h:170:1: Parameter `a`
    168.   	}
    169.   
    170. > static inline unsigned char constant_time_is_zero_8(unsigned int a)
    171.   	{
    172.   	return (unsigned char)(constant_time_is_zero(a));

crypto/constant_time_locl.h:172:25: Call
    170.   static inline unsigned char constant_time_is_zero_8(unsigned int a)
    171.   	{
    172.   	return (unsigned char)(constant_time_is_zero(a));
                                   ^
    173.   	}
    174.   

crypto/constant_time_locl.h:165:1: <LHS trace>
163.   	}
164.   
165. > static inline unsigned int constant_time_is_zero(unsigned int a)
166.   	{
167.   	return constant_time_msb(~a & (a - 1));

crypto/constant_time_locl.h:165:1: Parameter `a`
      163.   	}
      164.   
      165. > static inline unsigned int constant_time_is_zero(unsigned int a)
      166.   	{
      167.   	return constant_time_msb(~a & (a - 1));

crypto/constant_time_locl.h:167:9: Binary operation: ([0, +oo] - 1):unsigned32 by call to `EVP_DecryptFinal_ex` 
      165.   static inline unsigned int constant_time_is_zero(unsigned int a)
      166.   	{
      167.   	return constant_time_msb(~a & (a - 1));
                     ^
      168.   	}
      169.   

static inline unsigned int constant_time_is_zero(unsigned int a)
	{
	return constant_time_msb(~a & (a - 1));
	}
['static void test1(const EVP_CIPHER *c,const unsigned char *key,int kn,\n\t\t  const unsigned char *iv,int in,\n\t\t  const unsigned char *plaintext,int pn,\n\t\t  const unsigned char *ciphertext,int cn,\n\t\t  const unsigned char *aad,int an,\n\t\t  const unsigned char *tag,int tn,\n\t\t  int encdec)\n    {\n    EVP_CIPHER_CTX *ctx = NULL;\n    unsigned char out[4096];\n    int outl,outl2,mode;\n    printf("Testing cipher %s%s\\n",EVP_CIPHER_name(c),\n\t   (encdec == 1 ? "(encrypt)" : (encdec == 0 ? "(decrypt)" : "(encrypt/decrypt)")));\n    hexdump(stdout,"Key",key,kn);\n    if(in)\n\thexdump(stdout,"IV",iv,in);\n    hexdump(stdout,"Plaintext",plaintext,pn);\n    hexdump(stdout,"Ciphertext",ciphertext,cn);\n    if (an)\n    \thexdump(stdout,"AAD",aad,an);\n    if (tn)\n    \thexdump(stdout,"Tag",tag,tn);\n    mode = EVP_CIPHER_mode(c);\n    if(kn != EVP_CIPHER_key_length(c))\n\t{\n\tfprintf(stderr,"Key length doesn\'t match, got %d expected %lu\\n",kn,\n\t\t(unsigned long)EVP_CIPHER_key_length(c));\n\ttest1_exit(5);\n\t}\n    ctx = EVP_CIPHER_CTX_new();\n    EVP_CIPHER_CTX_set_flags(ctx,EVP_CIPHER_CTX_FLAG_WRAP_ALLOW);\n    if (encdec != 0)\n        {\n\tif (mode == EVP_CIPH_GCM_MODE)\n\t    {\n\t    if(!EVP_EncryptInit_ex(ctx,c,NULL,NULL,NULL))\n\t        {\n\t\tfprintf(stderr,"EncryptInit failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(10);\n\t\t}\n\t    if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, in, NULL))\n\t        {\n\t\tfprintf(stderr,"IV length set failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(11);\n\t\t}\n\t    if(!EVP_EncryptInit_ex(ctx,NULL,NULL,key,iv))\n\t        {\n\t\tfprintf(stderr,"Key/IV set failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(12);\n\t\t}\n\t    if (an && !EVP_EncryptUpdate(ctx,NULL,&outl,aad,an))\n\t        {\n\t\tfprintf(stderr,"AAD set failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(13);\n\t\t}\n\t    }\n\telse if (mode == EVP_CIPH_CCM_MODE)\n\t    {\n\t    if(!EVP_EncryptInit_ex(ctx,c,NULL,NULL,NULL))\n\t        {\n\t\tfprintf(stderr,"EncryptInit failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(10);\n\t\t}\n\t    if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_SET_IVLEN, in, NULL))\n\t        {\n\t\tfprintf(stderr,"IV length set failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(11);\n\t\t}\n\t    if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_SET_TAG, tn, NULL))\n\t        {\n\t\tfprintf(stderr,"Tag length set failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(11);\n\t\t}\n\t    if(!EVP_EncryptInit_ex(ctx,NULL,NULL,key,iv))\n\t        {\n\t\tfprintf(stderr,"Key/IV set failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(12);\n\t\t}\n\t    if (!EVP_EncryptUpdate(ctx,NULL,&outl,NULL,pn))\n\t        {\n\t\tfprintf(stderr,"Plaintext length set failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(12);\n\t\t}\n\t    if (an && !EVP_EncryptUpdate(ctx,NULL,&outl,aad,an))\n\t        {\n\t\tfprintf(stderr,"AAD set failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(13);\n\t\t}\n\t    }\n\telse if (mode == EVP_CIPH_WRAP_MODE)\n\t    {\n\t    if(!EVP_EncryptInit_ex(ctx,c,NULL,key,in ? iv : NULL))\n\t        {\n\t\tfprintf(stderr,"EncryptInit failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(10);\n\t\t}\n\t    }\n\telse if(!EVP_EncryptInit_ex(ctx,c,NULL,key,iv))\n\t    {\n\t    fprintf(stderr,"EncryptInit failed\\n");\n\t    ERR_print_errors_fp(stderr);\n\t    test1_exit(10);\n\t    }\n\tEVP_CIPHER_CTX_set_padding(ctx,0);\n\ttest_ctx_replace(&ctx);\n\tif(!EVP_EncryptUpdate(ctx,out,&outl,plaintext,pn))\n\t    {\n\t    fprintf(stderr,"Encrypt failed\\n");\n\t    ERR_print_errors_fp(stderr);\n\t    test1_exit(6);\n\t    }\n\tif(!EVP_EncryptFinal_ex(ctx,out+outl,&outl2))\n\t    {\n\t    fprintf(stderr,"EncryptFinal failed\\n");\n\t    ERR_print_errors_fp(stderr);\n\t    test1_exit(7);\n\t    }\n\tif(outl+outl2 != cn)\n\t    {\n\t    fprintf(stderr,"Ciphertext length mismatch got %d expected %d\\n",\n\t\t    outl+outl2,cn);\n\t    test1_exit(8);\n\t    }\n\tif(memcmp(out,ciphertext,cn))\n\t    {\n\t    fprintf(stderr,"Ciphertext mismatch\\n");\n\t    hexdump(stderr,"Got",out,cn);\n\t    hexdump(stderr,"Expected",ciphertext,cn);\n\t    test1_exit(9);\n\t    }\n\tif (mode == EVP_CIPH_GCM_MODE || mode == EVP_CIPH_CCM_MODE)\n\t    {\n\t    unsigned char rtag[16];\n\t    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, tn, rtag))\n\t        {\n\t\tfprintf(stderr,"Get tag failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(14);\n\t\t}\n\t    if (memcmp(rtag, tag, tn))\n\t\t{\n\t\tfprintf(stderr,"Tag mismatch\\n");\n\t\thexdump(stderr,"Got",rtag,tn);\n\t\thexdump(stderr,"Expected",tag,tn);\n\t\ttest1_exit(9);\n\t    \t}\n\t    }\n\t}\n    if (encdec <= 0)\n        {\n\tif (mode == EVP_CIPH_GCM_MODE)\n\t    {\n\t    if(!EVP_DecryptInit_ex(ctx,c,NULL,NULL,NULL))\n\t        {\n\t\tfprintf(stderr,"EncryptInit failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(10);\n\t\t}\n\t    if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, in, NULL))\n\t        {\n\t\tfprintf(stderr,"IV length set failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(11);\n\t\t}\n\t    if(!EVP_DecryptInit_ex(ctx,NULL,NULL,key,iv))\n\t        {\n\t\tfprintf(stderr,"Key/IV set failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(12);\n\t\t}\n\t    if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, tn, (void *)tag))\n\t        {\n\t\tfprintf(stderr,"Set tag failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(14);\n\t\t}\n\t    if (an && !EVP_DecryptUpdate(ctx,NULL,&outl,aad,an))\n\t        {\n\t\tfprintf(stderr,"AAD set failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(13);\n\t\t}\n\t    }\n\telse if (mode == EVP_CIPH_CCM_MODE)\n\t    {\n\t    if(!EVP_DecryptInit_ex(ctx,c,NULL,NULL,NULL))\n\t        {\n\t\tfprintf(stderr,"DecryptInit failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(10);\n\t\t}\n\t    if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_SET_IVLEN, in, NULL))\n\t        {\n\t\tfprintf(stderr,"IV length set failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(11);\n\t\t}\n\t    if(!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_CCM_SET_TAG, tn, (void *)tag))\n\t        {\n\t\tfprintf(stderr,"Tag length set failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(11);\n\t\t}\n\t    if(!EVP_DecryptInit_ex(ctx,NULL,NULL,key,iv))\n\t        {\n\t\tfprintf(stderr,"Key/Nonce set failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(12);\n\t\t}\n\t    if (!EVP_DecryptUpdate(ctx,NULL,&outl,NULL,pn))\n\t        {\n\t\tfprintf(stderr,"Plaintext length set failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(12);\n\t\t}\n\t    if (an && !EVP_EncryptUpdate(ctx,NULL,&outl,aad,an))\n\t        {\n\t\tfprintf(stderr,"AAD set failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(13);\n\t\t}\n\t    }\n\telse if (mode == EVP_CIPH_WRAP_MODE)\n\t    {\n\t    if(!EVP_DecryptInit_ex(ctx,c,NULL,key,in ? iv : NULL))\n\t        {\n\t\tfprintf(stderr,"EncryptInit failed\\n");\n\t\tERR_print_errors_fp(stderr);\n\t\ttest1_exit(10);\n\t\t}\n\t    }\n\telse if(!EVP_DecryptInit_ex(ctx,c,NULL,key,iv))\n\t    {\n\t    fprintf(stderr,"DecryptInit failed\\n");\n\t    ERR_print_errors_fp(stderr);\n\t    test1_exit(11);\n\t    }\n\tEVP_CIPHER_CTX_set_padding(ctx,0);\n\ttest_ctx_replace(&ctx);\n\tif(!EVP_DecryptUpdate(ctx,out,&outl,ciphertext,cn))\n\t    {\n\t    fprintf(stderr,"Decrypt failed\\n");\n\t    ERR_print_errors_fp(stderr);\n\t    test1_exit(6);\n\t    }\n\tif(mode != EVP_CIPH_CCM_MODE && !EVP_DecryptFinal_ex(ctx,out+outl,&outl2))\n\t    {\n\t    fprintf(stderr,"DecryptFinal failed\\n");\n\t    ERR_print_errors_fp(stderr);\n\t    test1_exit(7);\n\t    }\n\tif(outl+outl2 != pn)\n\t    {\n\t    fprintf(stderr,"Plaintext length mismatch got %d expected %d\\n",\n\t\t    outl+outl2,pn);\n\t    test1_exit(8);\n\t    }\n\tif(memcmp(out,plaintext,pn))\n\t    {\n\t    fprintf(stderr,"Plaintext mismatch\\n");\n\t    hexdump(stderr,"Got",out,pn);\n\t    hexdump(stderr,"Expected",plaintext,pn);\n\t    test1_exit(9);\n\t    }\n\t}\n    EVP_CIPHER_CTX_free(ctx);\n    printf("\\n");\n    }', 'int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)\n\t{\n\tunsigned int i, b;\n        unsigned char pad, padding_good;\n\t*outl=0;\n\tif (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER)\n\t\t{\n\t\tint ret = ctx->cipher->do_cipher(ctx, out, NULL, 0);\n\t\tif (ret < 0)\n\t\t\treturn 0;\n\t\telse\n\t\t\t*outl = ret;\n\t\treturn 1;\n\t\t}\n\tb=(unsigned int)(ctx->cipher->block_size);\n\tif (ctx->flags & EVP_CIPH_NO_PADDING)\n\t\t{\n\t\tif(ctx->buf_len)\n\t\t\t{\n\t\t\tEVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH);\n\t\t\treturn 0;\n\t\t\t}\n\t\t*outl = 0;\n\t\treturn 1;\n\t\t}\n\tif (b > 1)\n\t\t{\n\t\tif (ctx->buf_len || !ctx->final_used)\n\t\t\t{\n\t\t\tEVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_WRONG_FINAL_BLOCK_LENGTH);\n\t\t\treturn(0);\n\t\t\t}\n\t\tOPENSSL_assert(b <= sizeof ctx->final);\n\t\tpad=ctx->final[b-1];\n\t\tpadding_good = (unsigned char)(~constant_time_is_zero_8(pad));\n\t\tpadding_good &= constant_time_ge_8(b, pad);\n                for (i = 1; i < b; ++i)\n\t\t\t{\n\t\t\tunsigned char is_pad_index = constant_time_lt_8(i, pad);\n\t\t\tunsigned char pad_byte_good = constant_time_eq_8(ctx->final[b-i-1], pad);\n\t\t\tpadding_good &= constant_time_select_8(is_pad_index, pad_byte_good, 0xff);\n\t\t\t}\n\t\tfor (i = 0; i < b - 1; ++i)\n\t\t\tout[i] = ctx->final[i] & padding_good;\n\t\t*outl = padding_good & ((unsigned char)(b - pad));\n\t\treturn padding_good & 1;\n\t\t}\n\telse\n\t\t{\n\t\t*outl = 0;\n\t\treturn 1;\n\t\t}\n\t}', 'static inline unsigned char constant_time_is_zero_8(unsigned int a)\n\t{\n\treturn (unsigned char)(constant_time_is_zero(a));\n\t}', 'static inline unsigned int constant_time_is_zero(unsigned int a)\n\t{\n\treturn constant_time_msb(~a & (a - 1));\n\t}']