ssl/s3_cbc.c:181: error: INTEGER_OVERFLOW_L2
  ([0, `*rec->data`] - [0, 254]):unsigned32 by call to `constant_time_ge_8`.
Showing all 11 steps of the trace


ssl/s3_cbc.c:119:1: Parameter `rec->length`
117.    *  -1: otherwise.
118.    */
119. > int tls1_cbc_remove_padding(const SSL *s,
120.                               SSL3_RECORD *rec,
121.                               unsigned block_size, unsigned mac_size)

ssl/s3_cbc.c:181:30: Call
179.   
180.       for (i = 0; i < to_check; i++) {
181.           unsigned char mask = constant_time_ge_8(padding_length, i);
                                    ^
182.           unsigned char b = rec->data[rec->length - 1 - i];
183.           /*

crypto/constant_time_locl.h:153:1: Parameter `a`
  151.   }
  152.   
  153. > static inline unsigned char constant_time_ge_8(unsigned int a, unsigned int b)
  154.   {
  155.       return (unsigned char)(constant_time_ge(a, b));

crypto/constant_time_locl.h:155:28: Call
  153.   static inline unsigned char constant_time_ge_8(unsigned int a, unsigned int b)
  154.   {
  155.       return (unsigned char)(constant_time_ge(a, b));
                                    ^
  156.   }
  157.   

crypto/constant_time_locl.h:148:1: Parameter `a`
    146.   }
    147.   
    148. > static inline unsigned int constant_time_ge(unsigned int a, unsigned int b)
    149.   {
    150.       return ~constant_time_lt(a, b);

crypto/constant_time_locl.h:150:13: Call
    148.   static inline unsigned int constant_time_ge(unsigned int a, unsigned int b)
    149.   {
    150.       return ~constant_time_lt(a, b);
                       ^
    151.   }
    152.   

crypto/constant_time_locl.h:138:1: <LHS trace>
136.   }
137.   
138. > static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
139.   {
140.       return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b)));

crypto/constant_time_locl.h:138:1: Parameter `a`
      136.   }
      137.   
      138. > static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
      139.   {
      140.       return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b)));

crypto/constant_time_locl.h:138:1: <RHS trace>
136.   }
137.   
138. > static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
139.   {
140.       return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b)));

crypto/constant_time_locl.h:138:1: Parameter `b`
      136.   }
      137.   
      138. > static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
      139.   {
      140.       return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b)));

crypto/constant_time_locl.h:140:12: Binary operation: ([0, *rec->data] - [0, 254]):unsigned32 by call to `constant_time_ge_8` 
      138.   static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
      139.   {
      140.       return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b)));
                        ^
      141.   }
      142.   

static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)
{
    return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b)));
}
['int tls1_cbc_remove_padding(const SSL *s,\n                            SSL3_RECORD *rec,\n                            unsigned block_size, unsigned mac_size)\n{\n    unsigned padding_length, good, to_check, i;\n    const unsigned overhead = 1    + mac_size;\n    if (SSL_USE_EXPLICIT_IV(s)) {\n        if (overhead + block_size > rec->length)\n            return 0;\n        rec->data += block_size;\n        rec->input += block_size;\n        rec->length -= block_size;\n        rec->orig_len -= block_size;\n    } else if (overhead > rec->length)\n        return 0;\n    padding_length = rec->data[rec->length - 1];\n    if ((s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand) {\n        if ((memcmp(s->s3->read_sequence, "\\0\\0\\0\\0\\0\\0\\0\\0", 8) == 0) &&\n            !(padding_length & 1)) {\n            s->s3->flags |= TLS1_FLAGS_TLS_PADDING_BUG;\n        }\n        if ((s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) && padding_length > 0) {\n            padding_length--;\n        }\n    }\n    if (EVP_CIPHER_flags(s->enc_read_ctx->cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) {\n        rec->length -= padding_length + 1;\n        return 1;\n    }\n    good = constant_time_ge(rec->length, overhead + padding_length);\n    to_check = 255;\n    if (to_check > rec->length - 1)\n        to_check = rec->length - 1;\n    for (i = 0; i < to_check; i++) {\n        unsigned char mask = constant_time_ge_8(padding_length, i);\n        unsigned char b = rec->data[rec->length - 1 - i];\n        good &= ~(mask & (padding_length ^ b));\n    }\n    good = constant_time_eq(0xff, good & 0xff);\n    rec->length -= good & (padding_length + 1);\n    return constant_time_select_int(good, 1, -1);\n}', 'static inline unsigned char constant_time_ge_8(unsigned int a, unsigned int b)\n{\n    return (unsigned char)(constant_time_ge(a, b));\n}', 'static inline unsigned int constant_time_ge(unsigned int a, unsigned int b)\n{\n    return ~constant_time_lt(a, b);\n}', 'static inline unsigned int constant_time_lt(unsigned int a, unsigned int b)\n{\n    return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b)));\n}']