crypto/rsa/rsa_eay.c:605: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `RSA_padding_check_PKCS1_OAEP`.
Showing all 13 steps of the trace


crypto/rsa/rsa_eay.c:561:14: Unknown value from: non-const function
559.            (rsa->q != NULL) &&
560.            (rsa->dmp1 != NULL) && (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) {
561.           if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx))
                    ^
562.               goto err;
563.       } else {

crypto/rsa/rsa_eay.c:598:9: Call
596.   
597.       p = buf;
598.       j = BN_bn2bin(ret, p);      /* j is only used with no-padding mode */
               ^
599.   
600.       switch (padding) {

crypto/bn/bn_lib.c:590:1: Parameter `*a->d`
  588.   
  589.   /* ignore negative */
  590. > int BN_bn2bin(const BIGNUM *a, unsigned char *to)
  591.   {
  592.       int n, i;

crypto/bn/bn_lib.c:596:13: Call
  594.   
  595.       bn_check_top(a);
  596.       n = i = BN_num_bytes(a);
                     ^
  597.       while (i--) {
  598.           l = a->d[i / BN_BYTES];

crypto/bn/bn_lib.c:216:1: Parameter `*a->d`
    214.   }
    215.   
    216. > int BN_num_bits(const BIGNUM *a)
    217.   {
    218.       int i = a->top - 1;

crypto/rsa/rsa_eay.c:605:13: Call
603.           break;
604.       case RSA_PKCS1_OAEP_PADDING:
605.           r = RSA_padding_check_PKCS1_OAEP(to, num, buf, j, num, NULL, 0);
                   ^
606.           break;
607.       case RSA_SSLV23_PADDING:

crypto/rsa/rsa_oaep.c:104:1: Parameter `*from`
  102.   }
  103.   
  104. > int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,
  105.                                    const unsigned char *from, int flen, int num,
  106.                                    const unsigned char *param, int plen)

crypto/rsa/rsa_oaep.c:108:12: Call
  106.                                    const unsigned char *param, int plen)
  107.   {
  108.       return RSA_padding_check_PKCS1_OAEP_mgf1(to, tlen, from, flen, num,
                    ^
  109.                                                param, plen, NULL, NULL);
  110.   }

crypto/rsa/rsa_oaep.c:112:1: Parameter `*from`
    110.   }
    111.   
    112. > int RSA_padding_check_PKCS1_OAEP_mgf1(unsigned char *to, int tlen,
    113.                                         const unsigned char *from, int flen,
    114.                                         int num, const unsigned char *param,

crypto/rsa/rsa_oaep.c:173:12: Call
    171.        * Optimal Asymmetric Encryption Padding (OAEP) [...]", CRYPTO 2001).
    172.        */
    173.       good = constant_time_is_zero(em[0]);
                      ^
    174.   
    175.       maskedseed = em + 1;

crypto/constant_time_locl.h:158:1: <LHS trace>
156.   }
157.   
158. > static inline unsigned int constant_time_is_zero(unsigned int a)
159.   {
160.       return constant_time_msb(~a & (a - 1));

crypto/constant_time_locl.h:158:1: Parameter `a`
      156.   }
      157.   
      158. > static inline unsigned int constant_time_is_zero(unsigned int a)
      159.   {
      160.       return constant_time_msb(~a & (a - 1));

crypto/constant_time_locl.h:160:12: Binary operation: ([0, +oo] - 1):unsigned32 by call to `RSA_padding_check_PKCS1_OAEP` 
      158.   static inline unsigned int constant_time_is_zero(unsigned int a)
      159.   {
      160.       return constant_time_msb(~a & (a - 1));
                        ^
      161.   }
      162.   

static inline unsigned int constant_time_is_zero(unsigned int a)
{
    return constant_time_msb(~a & (a - 1));
}
['static int RSA_eay_private_decrypt(int flen, const unsigned char *from,\n                                   unsigned char *to, RSA *rsa, int padding)\n{\n    BIGNUM *f, *ret;\n    int j, num = 0, r = -1;\n    unsigned char *p;\n    unsigned char *buf = NULL;\n    BN_CTX *ctx = NULL;\n    int local_blinding = 0;\n    BIGNUM *unblind = NULL;\n    BN_BLINDING *blinding = NULL;\n    if ((ctx = BN_CTX_new()) == NULL)\n        goto err;\n    BN_CTX_start(ctx);\n    f = BN_CTX_get(ctx);\n    ret = BN_CTX_get(ctx);\n    num = BN_num_bytes(rsa->n);\n    buf = OPENSSL_malloc(num);\n    if (!f || !ret || !buf) {\n        RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    if (flen > num) {\n        RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,\n               RSA_R_DATA_GREATER_THAN_MOD_LEN);\n        goto err;\n    }\n    if (BN_bin2bn(from, (int)flen, f) == NULL)\n        goto err;\n    if (BN_ucmp(f, rsa->n) >= 0) {\n        RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT,\n               RSA_R_DATA_TOO_LARGE_FOR_MODULUS);\n        goto err;\n    }\n    if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) {\n        blinding = rsa_get_blinding(rsa, &local_blinding, ctx);\n        if (blinding == NULL) {\n            RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n    }\n    if (blinding != NULL) {\n        if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL)) {\n            RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        if (!rsa_blinding_convert(blinding, f, unblind, ctx))\n            goto err;\n    }\n    if ((rsa->flags & RSA_FLAG_EXT_PKEY) ||\n        ((rsa->p != NULL) &&\n         (rsa->q != NULL) &&\n         (rsa->dmp1 != NULL) && (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) {\n        if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx))\n            goto err;\n    } else {\n        BIGNUM *d = NULL, *local_d = NULL;\n        if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME)) {\n            local_d = d = BN_new();\n            if (!d) {\n                RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);\n                goto err;\n            }\n            BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);\n        } else\n            d = rsa->d;\n        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)\n            if (!BN_MONT_CTX_set_locked\n                (&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx)) {\n                if (local_d)\n                    BN_free(local_d);\n                goto err;\n            }\n        if (!rsa->meth->bn_mod_exp(ret, f, d, rsa->n, ctx,\n                                   rsa->_method_mod_n)) {\n            if (local_d)\n                BN_free(local_d);\n            goto err;\n        }\n        if (local_d)\n            BN_free(local_d);\n    }\n    if (blinding)\n        if (!rsa_blinding_invert(blinding, ret, unblind, ctx))\n            goto err;\n    p = buf;\n    j = BN_bn2bin(ret, p);\n    switch (padding) {\n    case RSA_PKCS1_PADDING:\n        r = RSA_padding_check_PKCS1_type_2(to, num, buf, j, num);\n        break;\n    case RSA_PKCS1_OAEP_PADDING:\n        r = RSA_padding_check_PKCS1_OAEP(to, num, buf, j, num, NULL, 0);\n        break;\n    case RSA_SSLV23_PADDING:\n        r = RSA_padding_check_SSLv23(to, num, buf, j, num);\n        break;\n    case RSA_NO_PADDING:\n        r = RSA_padding_check_none(to, num, buf, j, num);\n        break;\n    default:\n        RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, RSA_R_UNKNOWN_PADDING_TYPE);\n        goto err;\n    }\n    if (r < 0)\n        RSAerr(RSA_F_RSA_EAY_PRIVATE_DECRYPT, RSA_R_PADDING_CHECK_FAILED);\n err:\n    if (ctx != NULL) {\n        BN_CTX_end(ctx);\n        BN_CTX_free(ctx);\n    }\n    if (buf != NULL) {\n        OPENSSL_cleanse(buf, num);\n        OPENSSL_free(buf);\n    }\n    return (r);\n}', 'int BN_bn2bin(const BIGNUM *a, unsigned char *to)\n{\n    int n, i;\n    BN_ULONG l;\n    bn_check_top(a);\n    n = i = BN_num_bytes(a);\n    while (i--) {\n        l = a->d[i / BN_BYTES];\n        *(to++) = (unsigned char)(l >> (8 * (i % BN_BYTES))) & 0xff;\n    }\n    return (n);\n}', 'int BN_num_bits(const BIGNUM *a)\n{\n    int i = a->top - 1;\n    bn_check_top(a);\n    if (BN_is_zero(a))\n        return 0;\n    return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));\n}', 'int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,\n                                 const unsigned char *from, int flen, int num,\n                                 const unsigned char *param, int plen)\n{\n    return RSA_padding_check_PKCS1_OAEP_mgf1(to, tlen, from, flen, num,\n                                             param, plen, NULL, NULL);\n}', 'int RSA_padding_check_PKCS1_OAEP_mgf1(unsigned char *to, int tlen,\n                                      const unsigned char *from, int flen,\n                                      int num, const unsigned char *param,\n                                      int plen, const EVP_MD *md,\n                                      const EVP_MD *mgf1md)\n{\n    int i, dblen, mlen = -1, one_index = 0, msg_index;\n    unsigned int good, found_one_byte;\n    const unsigned char *maskedseed, *maskeddb;\n    unsigned char *db = NULL, *em = NULL, seed[EVP_MAX_MD_SIZE],\n        phash[EVP_MAX_MD_SIZE];\n    int mdlen;\n    if (md == NULL)\n        md = EVP_sha1();\n    if (mgf1md == NULL)\n        mgf1md = md;\n    mdlen = EVP_MD_size(md);\n    if (tlen <= 0 || flen <= 0)\n        return -1;\n    if (num < flen || num < 2 * mdlen + 2)\n        goto decoding_err;\n    dblen = num - mdlen - 1;\n    db = OPENSSL_malloc(dblen);\n    em = OPENSSL_malloc(num);\n    if (db == NULL || em == NULL) {\n        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1, ERR_R_MALLOC_FAILURE);\n        goto cleanup;\n    }\n    memset(em, 0, num);\n    memcpy(em + num - flen, from, flen);\n    good = constant_time_is_zero(em[0]);\n    maskedseed = em + 1;\n    maskeddb = em + 1 + mdlen;\n    if (PKCS1_MGF1(seed, mdlen, maskeddb, dblen, mgf1md))\n        goto cleanup;\n    for (i = 0; i < mdlen; i++)\n        seed[i] ^= maskedseed[i];\n    if (PKCS1_MGF1(db, dblen, seed, mdlen, mgf1md))\n        goto cleanup;\n    for (i = 0; i < dblen; i++)\n        db[i] ^= maskeddb[i];\n    if (!EVP_Digest((void *)param, plen, phash, NULL, md, NULL))\n        goto cleanup;\n    good &= constant_time_is_zero(CRYPTO_memcmp(db, phash, mdlen));\n    found_one_byte = 0;\n    for (i = mdlen; i < dblen; i++) {\n        unsigned int equals1 = constant_time_eq(db[i], 1);\n        unsigned int equals0 = constant_time_is_zero(db[i]);\n        one_index = constant_time_select_int(~found_one_byte & equals1,\n                                             i, one_index);\n        found_one_byte |= equals1;\n        good &= (found_one_byte | equals0);\n    }\n    good &= found_one_byte;\n    if (!good)\n        goto decoding_err;\n    msg_index = one_index + 1;\n    mlen = dblen - msg_index;\n    if (tlen < mlen) {\n        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1, RSA_R_DATA_TOO_LARGE);\n        mlen = -1;\n    } else {\n        memcpy(to, db + msg_index, mlen);\n        goto cleanup;\n    }\n decoding_err:\n    RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1,\n           RSA_R_OAEP_DECODING_ERROR);\n cleanup:\n    if (db != NULL)\n        OPENSSL_free(db);\n    if (em != NULL)\n        OPENSSL_free(em);\n    return mlen;\n}', 'static inline unsigned int constant_time_is_zero(unsigned int a)\n{\n    return constant_time_msb(~a & (a - 1));\n}']