crypto/ec/ec2_mult.c:285: error: INTEGER_OVERFLOW_L2
  ([0, 9223372036854775808] - 1):unsigned64 by call to `BN_consttime_swap`.
Showing all 5 steps of the trace


crypto/ec/ec2_mult.c:277:3: Assignment
275.   		{
276.   		i--;
277.   		mask = BN_TBIT;
         ^
278.   		}
279.   

crypto/ec/ec2_mult.c:285:4: Call
283.   		while (mask)
284.   			{
285.   			BN_consttime_swap(word & mask, x1, x2, bn_get_top(group->field));
          ^
286.   			BN_consttime_swap(word & mask, z1, z2, bn_get_top(group->field));
287.   			if (!gf2m_Madd(group, point->X, x2, z2, x1, z1, ctx)) goto err;

crypto/bn/bn_lib.c:788:1: <LHS trace>
786.    * a and b cannot be the same number
787.    */
788. > void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
789.   	{
790.   	BN_ULONG t;

crypto/bn/bn_lib.c:788:1: Parameter `condition`
  786.    * a and b cannot be the same number
  787.    */
  788. > void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
  789.   	{
  790.   	BN_ULONG t;

crypto/bn/bn_lib.c:800:2: Binary operation: ([0, 9223372036854775808] - 1):unsigned64 by call to `BN_consttime_swap` 
  798.   	assert(sizeof(BN_ULONG) >= sizeof(int));
  799.   
  800.   	condition = ((condition - 1) >> (BN_BITS2 - 1)) - 1;
          ^
  801.   
  802.   	t = (a->top^b->top) & condition;

void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
	{
	BN_ULONG t;
	int i;
	bn_wcheck_size(a, nwords);
	bn_wcheck_size(b, nwords);
	assert(a != b);
	assert((condition & (condition - 1)) == 0);
	assert(sizeof(BN_ULONG) >= sizeof(int));
	condition = ((condition - 1) >> (BN_BITS2 - 1)) - 1;
	t = (a->top^b->top) & condition;
	a->top ^= t;
	b->top ^= t;
#define BN_CONSTTIME_SWAP(ind) \
	do { \
		t = (a->d[ind] ^ b->d[ind]) & condition; \
		a->d[ind] ^= t; \
		b->d[ind] ^= t; \
	} while (0)
	switch (nwords) {
	default:
		for (i = 10; i < nwords; i++)
			BN_CONSTTIME_SWAP(i);
	case 10: BN_CONSTTIME_SWAP(9);
	case 9: BN_CONSTTIME_SWAP(8);
	case 8: BN_CONSTTIME_SWAP(7);
	case 7: BN_CONSTTIME_SWAP(6);
	case 6: BN_CONSTTIME_SWAP(5);
	case 5: BN_CONSTTIME_SWAP(4);
	case 4: BN_CONSTTIME_SWAP(3);
	case 3: BN_CONSTTIME_SWAP(2);
	case 2: BN_CONSTTIME_SWAP(1);
	case 1: BN_CONSTTIME_SWAP(0);
	}
#undef BN_CONSTTIME_SWAP
}
['static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,\n\tconst EC_POINT *point, BN_CTX *ctx)\n\t{\n\tBIGNUM *x1, *x2, *z1, *z2;\n\tint ret = 0, i;\n\tBN_ULONG mask,word;\n\tif (r == point)\n\t\t{\n\t\tECerr(EC_F_EC_GF2M_MONTGOMERY_POINT_MULTIPLY, EC_R_INVALID_ARGUMENT);\n\t\treturn 0;\n\t\t}\n\tif ((scalar == NULL) || BN_is_zero(scalar) || (point == NULL) ||\n\t\tEC_POINT_is_at_infinity(group, point))\n\t\t{\n\t\treturn EC_POINT_set_to_infinity(group, r);\n\t\t}\n\tif (!point->Z_is_one) return 0;\n\tBN_CTX_start(ctx);\n\tx1 = BN_CTX_get(ctx);\n\tz1 = BN_CTX_get(ctx);\n\tif (z1 == NULL) goto err;\n\tx2 = r->X;\n\tz2 = r->Y;\n\tbn_wexpand(x1, bn_get_top(group->field));\n\tbn_wexpand(z1, bn_get_top(group->field));\n\tbn_wexpand(x2, bn_get_top(group->field));\n\tbn_wexpand(z2, bn_get_top(group->field));\n\tif (!BN_GF2m_mod_arr(x1, point->X, group->poly)) goto err;\n\tif (!BN_one(z1)) goto err;\n\tif (!group->meth->field_sqr(group, z2, x1, ctx)) goto err;\n\tif (!group->meth->field_sqr(group, x2, z2, ctx)) goto err;\n\tif (!BN_GF2m_add(x2, x2, group->b)) goto err;\n\ti = bn_get_top(scalar) - 1;\n\tmask = BN_TBIT;\n\tword = bn_get_words(scalar)[i];\n\twhile (!(word & mask)) mask >>= 1;\n\tmask >>= 1;\n\tif (!mask)\n\t\t{\n\t\ti--;\n\t\tmask = BN_TBIT;\n\t\t}\n\tfor (; i >= 0; i--)\n\t\t{\n\t\tword = bn_get_words(scalar)[i];\n\t\twhile (mask)\n\t\t\t{\n\t\t\tBN_consttime_swap(word & mask, x1, x2, bn_get_top(group->field));\n\t\t\tBN_consttime_swap(word & mask, z1, z2, bn_get_top(group->field));\n\t\t\tif (!gf2m_Madd(group, point->X, x2, z2, x1, z1, ctx)) goto err;\n\t\t\tif (!gf2m_Mdouble(group, x1, z1, ctx)) goto err;\n\t\t\tBN_consttime_swap(word & mask, x1, x2, bn_get_top(group->field));\n\t\t\tBN_consttime_swap(word & mask, z1, z2, bn_get_top(group->field));\n\t\t\tmask >>= 1;\n\t\t\t}\n\t\tmask = BN_TBIT;\n\t\t}\n\ti = gf2m_Mxy(group, point->X, point->Y, x1, z1, x2, z2, ctx);\n\tif (i == 0) goto err;\n\telse if (i == 1)\n\t\t{\n\t\tif (!EC_POINT_set_to_infinity(group, r)) goto err;\n\t\t}\n\telse\n\t\t{\n\t\tif (!BN_one(r->Z)) goto err;\n\t\tr->Z_is_one = 1;\n\t\t}\n\tBN_set_negative(r->X, 0);\n\tBN_set_negative(r->Y, 0);\n\tret = 1;\n err:\n\tBN_CTX_end(ctx);\n\treturn ret;\n\t}', 'void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)\n\t{\n\tBN_ULONG t;\n\tint i;\n\tbn_wcheck_size(a, nwords);\n\tbn_wcheck_size(b, nwords);\n\tassert(a != b);\n\tassert((condition & (condition - 1)) == 0);\n\tassert(sizeof(BN_ULONG) >= sizeof(int));\n\tcondition = ((condition - 1) >> (BN_BITS2 - 1)) - 1;\n\tt = (a->top^b->top) & condition;\n\ta->top ^= t;\n\tb->top ^= t;\n#define BN_CONSTTIME_SWAP(ind) \\\n\tdo { \\\n\t\tt = (a->d[ind] ^ b->d[ind]) & condition; \\\n\t\ta->d[ind] ^= t; \\\n\t\tb->d[ind] ^= t; \\\n\t} while (0)\n\tswitch (nwords) {\n\tdefault:\n\t\tfor (i = 10; i < nwords; i++)\n\t\t\tBN_CONSTTIME_SWAP(i);\n\tcase 10: BN_CONSTTIME_SWAP(9);\n\tcase 9: BN_CONSTTIME_SWAP(8);\n\tcase 8: BN_CONSTTIME_SWAP(7);\n\tcase 7: BN_CONSTTIME_SWAP(6);\n\tcase 6: BN_CONSTTIME_SWAP(5);\n\tcase 5: BN_CONSTTIME_SWAP(4);\n\tcase 4: BN_CONSTTIME_SWAP(3);\n\tcase 3: BN_CONSTTIME_SWAP(2);\n\tcase 2: BN_CONSTTIME_SWAP(1);\n\tcase 1: BN_CONSTTIME_SWAP(0);\n\t}\n#undef BN_CONSTTIME_SWAP\n}']