crypto/bn/bn_nist.c:461: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `BN_usub`.
Showing all 9 steps of the trace


crypto/bn/bn_nist.c:455:2: Call
453.   	mask &= 0-(size_t)carry;
454.   	res   = (BN_ULONG *)(((size_t)c_d&~mask) | ((size_t)r_d&mask));
455.   	nist_cp_bn(r_d, res, BN_NIST_224_TOP);
        ^
456.   	r->top = BN_NIST_224_TOP;
457.   	bn_correct_top(r);

crypto/bn/bn_nist.c:241:1: Parameter `*buf`
  239.   	}
  240.   
  241. > static void nist_cp_bn(BN_ULONG *buf, BN_ULONG *a, int top)
  242.   	{ 
  243.   	int i;

crypto/bn/bn_nist.c:459:6: Call
457.   	bn_correct_top(r);
458.   
459.   	if (BN_ucmp(field, r) <= 0)
            ^
460.   		{
461.   		if (!BN_usub(r, r, field)) return 0;

crypto/bn/bn_lib.c:656:1: Parameter `*b->d`
  654.   	}
  655.   
  656. > int BN_ucmp(const BIGNUM *a, const BIGNUM *b)
  657.   	{
  658.   	int i;

crypto/bn/bn_nist.c:461:8: Call
459.   	if (BN_ucmp(field, r) <= 0)
460.   		{
461.   		if (!BN_usub(r, r, field)) return 0;
              ^
462.   		}
463.   

crypto/bn/bn_add.c:166:1: <LHS trace>
164.   
165.   /* unsigned subtraction of b from a, a must be larger than b. */
166. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
167.   	{
168.   	int max,min,dif;

crypto/bn/bn_add.c:166:1: Parameter `*a->d`
  164.   
  165.   /* unsigned subtraction of b from a, a must be larger than b. */
  166. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
  167.   	{
  168.   	int max,min,dif;

crypto/bn/bn_add.c:229:4: Assignment
  227.   			{
  228.   			dif--;
  229.   			t1 = *(ap++);
            ^
  230.   			t2 = (t1-1)&BN_MASK2;
  231.   			*(rp++) = t2;

crypto/bn/bn_add.c:230:4: Binary operation: ([0, +oo] - 1):unsigned32 by call to `BN_usub` 
  228.   			dif--;
  229.   			t1 = *(ap++);
  230.   			t2 = (t1-1)&BN_MASK2;
            ^
  231.   			*(rp++) = t2;
  232.   			if (t1)

int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
	{
	int max,min,dif;
	register BN_ULONG t1,t2,*ap,*bp,*rp;
	int i,carry;
#if defined(IRIX_CC_BUG) && !defined(LINT)
	int dummy;
#endif
	bn_check_top(a);
	bn_check_top(b);
	max = a->top;
	min = b->top;
	dif = max - min;
	if (dif < 0)
		{
		BNerr(BN_F_BN_USUB,BN_R_ARG2_LT_ARG3);
		return(0);
		}
	if (bn_wexpand(r,max) == NULL) return(0);
	ap=a->d;
	bp=b->d;
	rp=r->d;
#if 1
	carry=0;
	for (i = min; i != 0; i--)
		{
		t1= *(ap++);
		t2= *(bp++);
		if (carry)
			{
			carry=(t1 <= t2);
			t1=(t1-t2-1)&BN_MASK2;
			}
		else
			{
			carry=(t1 < t2);
			t1=(t1-t2)&BN_MASK2;
			}
#if defined(IRIX_CC_BUG) && !defined(LINT)
		dummy=t1;
#endif
		*(rp++)=t1&BN_MASK2;
		}
#else
	carry=bn_sub_words(rp,ap,bp,min);
	ap+=min;
	bp+=min;
	rp+=min;
#endif
	if (carry)
		{
		if (!dif)
			return 0;
		while (dif)
			{
			dif--;
			t1 = *(ap++);
			t2 = (t1-1)&BN_MASK2;
			*(rp++) = t2;
			if (t1)
				break;
			}
		}
#if 0
	memcpy(rp,ap,sizeof(*rp)*(max-i));
#else
	if (rp != ap)
		{
		for (;;)
			{
			if (!dif--) break;
			rp[0]=ap[0];
			if (!dif--) break;
			rp[1]=ap[1];
			if (!dif--) break;
			rp[2]=ap[2];
			if (!dif--) break;
			rp[3]=ap[3];
			rp+=4;
			ap+=4;
			}
		}
#endif
	r->top=max;
	r->neg=0;
	bn_correct_top(r);
	return(1);
	}
['int BN_nist_mod_224(BIGNUM *r, const BIGNUM *a, const BIGNUM *field,\n\tBN_CTX *ctx)\n\t{\n\tint\ttop = a->top, i;\n\tint\tcarry;\n\tBN_ULONG *r_d, *a_d = a->d;\n\tBN_ULONG t_d[BN_NIST_224_TOP],\n\t         buf[BN_NIST_224_TOP],\n\t\t c_d[BN_NIST_224_TOP],\n\t\t*res;\n\tsize_t   mask;\n\tunion { bn_addsub_f f; size_t p; } u;\n\tfield = &_bignum_nist_p_224;\n \tif (BN_is_negative(a) || a->top > 2*BN_NIST_224_TOP)\n\t\treturn BN_nnmod(r, field, a, ctx);\n\ti = BN_ucmp(field, a);\n\tif (i == 0)\n\t\t{\n\t\tBN_zero(r);\n\t\treturn 1;\n\t\t}\n\telse if (i > 0)\n\t\treturn (r == a)? 1 : (BN_copy(r ,a) != NULL);\n\tif (r != a)\n\t\t{\n\t\tif (!bn_wexpand(r, BN_NIST_224_TOP))\n\t\t\treturn 0;\n\t\tr_d = r->d;\n\t\tnist_cp_bn(r_d, a_d, BN_NIST_224_TOP);\n\t\t}\n\telse\n\t\tr_d = a_d;\n#if BN_BITS2==64\n\tnist_cp_bn_0(t_d, a_d + (BN_NIST_224_TOP-1), top - (BN_NIST_224_TOP-1), BN_NIST_224_TOP);\n\tnist_set_224(buf, t_d, 14, 13, 12, 11, 10, 9, 8);\n\tr_d[BN_NIST_224_TOP-1] &= BN_MASK2l;\n#else\n\tnist_cp_bn_0(buf, a_d + BN_NIST_224_TOP, top - BN_NIST_224_TOP, BN_NIST_224_TOP);\n#endif\n\tnist_set_224(t_d, buf, 10, 9, 8, 7, 0, 0, 0);\n\tcarry = bn_add_words(r_d, r_d, t_d, BN_NIST_224_TOP);\n\tnist_set_224(t_d, buf, 0, 13, 12, 11, 0, 0, 0);\n\tcarry += bn_add_words(r_d, r_d, t_d, BN_NIST_224_TOP);\n\tnist_set_224(t_d, buf, 13, 12, 11, 10, 9, 8, 7);\n\tcarry -= bn_sub_words(r_d, r_d, t_d, BN_NIST_224_TOP);\n\tnist_set_224(t_d, buf, 0, 0, 0, 0, 13, 12, 11);\n\tcarry -= bn_sub_words(r_d, r_d, t_d, BN_NIST_224_TOP);\n#if BN_BITS2==64\n\tcarry = (int)(r_d[BN_NIST_224_TOP-1]>>32);\n#endif\n\tu.f = bn_sub_words;\n\tif (carry > 0)\n\t\t{\n\t\tcarry = bn_sub_words(r_d,r_d,_nist_p_224[carry-1],BN_NIST_224_TOP);\n#if BN_BITS2==64\n\t\tcarry=(int)(~(r_d[BN_NIST_224_TOP-1]>>32))&1;\n#endif\n\t\t}\n\telse if (carry < 0)\n\t\t{\n\t\tcarry = bn_add_words(r_d,r_d,_nist_p_224[-carry-1],BN_NIST_224_TOP);\n\t\tmask = 0-(size_t)carry;\n\t\tu.p = ((size_t)bn_sub_words&mask) | ((size_t)bn_add_words&~mask);\n\t\t}\n\telse\n\t\tcarry = 1;\n\tmask  = 0-(size_t)(*u.f)(c_d,r_d,_nist_p_224[0],BN_NIST_224_TOP);\n\tmask &= 0-(size_t)carry;\n\tres   = (BN_ULONG *)(((size_t)c_d&~mask) | ((size_t)r_d&mask));\n\tnist_cp_bn(r_d, res, BN_NIST_224_TOP);\n\tr->top = BN_NIST_224_TOP;\n\tbn_correct_top(r);\n\tif (BN_ucmp(field, r) <= 0)\n\t\t{\n\t\tif (!BN_usub(r, r, field)) return 0;\n\t\t}\n\treturn 1;\n\t}', 'static void nist_cp_bn(BN_ULONG *buf, BN_ULONG *a, int top)\n\t{\n\tint i;\n\tBN_ULONG *_tmp1 = (buf), *_tmp2 = (a);\n\tfor (i = (top); i != 0; i--)\n\t\t*_tmp1++ = *_tmp2++;\n\t}', 'int BN_ucmp(const BIGNUM *a, const BIGNUM *b)\n\t{\n\tint i;\n\tBN_ULONG t1,t2,*ap,*bp;\n\tbn_check_top(a);\n\tbn_check_top(b);\n\ti=a->top-b->top;\n\tif (i != 0) return(i);\n\tap=a->d;\n\tbp=b->d;\n\tfor (i=a->top-1; i>=0; i--)\n\t\t{\n\t\tt1= ap[i];\n\t\tt2= bp[i];\n\t\tif (t1 != t2)\n\t\t\treturn((t1 > t2) ? 1 : -1);\n\t\t}\n\treturn(0);\n\t}', 'int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)\n\t{\n\tint max,min,dif;\n\tregister BN_ULONG t1,t2,*ap,*bp,*rp;\n\tint i,carry;\n#if defined(IRIX_CC_BUG) && !defined(LINT)\n\tint dummy;\n#endif\n\tbn_check_top(a);\n\tbn_check_top(b);\n\tmax = a->top;\n\tmin = b->top;\n\tdif = max - min;\n\tif (dif < 0)\n\t\t{\n\t\tBNerr(BN_F_BN_USUB,BN_R_ARG2_LT_ARG3);\n\t\treturn(0);\n\t\t}\n\tif (bn_wexpand(r,max) == NULL) return(0);\n\tap=a->d;\n\tbp=b->d;\n\trp=r->d;\n#if 1\n\tcarry=0;\n\tfor (i = min; i != 0; i--)\n\t\t{\n\t\tt1= *(ap++);\n\t\tt2= *(bp++);\n\t\tif (carry)\n\t\t\t{\n\t\t\tcarry=(t1 <= t2);\n\t\t\tt1=(t1-t2-1)&BN_MASK2;\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tcarry=(t1 < t2);\n\t\t\tt1=(t1-t2)&BN_MASK2;\n\t\t\t}\n#if defined(IRIX_CC_BUG) && !defined(LINT)\n\t\tdummy=t1;\n#endif\n\t\t*(rp++)=t1&BN_MASK2;\n\t\t}\n#else\n\tcarry=bn_sub_words(rp,ap,bp,min);\n\tap+=min;\n\tbp+=min;\n\trp+=min;\n#endif\n\tif (carry)\n\t\t{\n\t\tif (!dif)\n\t\t\treturn 0;\n\t\twhile (dif)\n\t\t\t{\n\t\t\tdif--;\n\t\t\tt1 = *(ap++);\n\t\t\tt2 = (t1-1)&BN_MASK2;\n\t\t\t*(rp++) = t2;\n\t\t\tif (t1)\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n#if 0\n\tmemcpy(rp,ap,sizeof(*rp)*(max-i));\n#else\n\tif (rp != ap)\n\t\t{\n\t\tfor (;;)\n\t\t\t{\n\t\t\tif (!dif--) break;\n\t\t\trp[0]=ap[0];\n\t\t\tif (!dif--) break;\n\t\t\trp[1]=ap[1];\n\t\t\tif (!dif--) break;\n\t\t\trp[2]=ap[2];\n\t\t\tif (!dif--) break;\n\t\t\trp[3]=ap[3];\n\t\t\trp+=4;\n\t\t\tap+=4;\n\t\t\t}\n\t\t}\n#endif\n\tr->top=max;\n\tr->neg=0;\n\tbn_correct_top(r);\n\treturn(1);\n\t}']