crypto/rsa/rsa_pk1.c:215: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 10):unsigned32 by call to `constant_time_ge`.
Showing all 9 steps of the trace


crypto/rsa/rsa_pk1.c:162:5: Assignment
160.       unsigned char *em = NULL;
161.       unsigned int good, found_zero_byte, mask;
162.       int zero_index = 0, msg_index, mlen = -1;
           ^
163.   
164.       if (tlen < 0 || flen < 0)

crypto/rsa/rsa_pk1.c:215:13: Call
213.        * also fails.
214.        */
215.       good &= constant_time_ge(zero_index, 2 + 8);
                   ^
216.   
217.       /*

include/internal/constant_time_locl.h:142:1: Parameter `a`
  140.   }
  141.   
  142. > static ossl_inline unsigned int constant_time_ge(unsigned int a,
  143.                                                    unsigned int b)
  144.   {

include/internal/constant_time_locl.h:145:13: Call
  143.                                                    unsigned int b)
  144.   {
  145.       return ~constant_time_lt(a, b);
                     ^
  146.   }
  147.   

include/internal/constant_time_locl.h:120:1: <LHS trace>
118.   }
119.   
120. > static ossl_inline unsigned int constant_time_lt(unsigned int a,
121.                                                    unsigned int b)
122.   {

include/internal/constant_time_locl.h:120:1: Parameter `a`
    118.   }
    119.   
    120. > static ossl_inline unsigned int constant_time_lt(unsigned int a,
    121.                                                    unsigned int b)
    122.   {

include/internal/constant_time_locl.h:120:1: <RHS trace>
118.   }
119.   
120. > static ossl_inline unsigned int constant_time_lt(unsigned int a,
121.                                                    unsigned int b)
122.   {

include/internal/constant_time_locl.h:120:1: Parameter `b`
    118.   }
    119.   
    120. > static ossl_inline unsigned int constant_time_lt(unsigned int a,
    121.                                                    unsigned int b)
    122.   {

include/internal/constant_time_locl.h:123:12: Binary operation: ([0, +oo] - 10):unsigned32 by call to `constant_time_ge` 
    121.                                                    unsigned int b)
    122.   {
    123.       return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b)));
                      ^
    124.   }
    125.   

static ossl_inline unsigned int constant_time_lt(unsigned int a,
                                                 unsigned int b)
{
    return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b)));
}
['int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen,\n                                   const unsigned char *from, int flen,\n                                   int num)\n{\n    int i;\n    unsigned char *em = NULL;\n    unsigned int good, found_zero_byte, mask;\n    int zero_index = 0, msg_index, mlen = -1;\n    if (tlen < 0 || flen < 0)\n        return -1;\n    if (flen > num || num < 11) {\n        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,\n               RSA_R_PKCS_DECODING_ERROR);\n        return -1;\n    }\n    em = OPENSSL_malloc(num);\n    if (em == NULL) {\n        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, ERR_R_MALLOC_FAILURE);\n        return -1;\n    }\n    for (from += flen, em += num, i = 0; i < num; i++) {\n        mask = ~constant_time_is_zero(flen);\n        flen -= 1 & mask;\n        from -= 1 & mask;\n        *--em = *from & mask;\n    }\n    from = em;\n    good = constant_time_is_zero(from[0]);\n    good &= constant_time_eq(from[1], 2);\n    found_zero_byte = 0;\n    for (i = 2; i < num; i++) {\n        unsigned int equals0 = constant_time_is_zero(from[i]);\n        zero_index = constant_time_select_int(~found_zero_byte & equals0,\n                                              i, zero_index);\n        found_zero_byte |= equals0;\n    }\n    good &= constant_time_ge(zero_index, 2 + 8);\n    msg_index = zero_index + 1;\n    mlen = num - msg_index;\n    good &= constant_time_ge(tlen, mlen);\n    tlen = constant_time_select_int(constant_time_lt(num, tlen), num, tlen);\n    msg_index = constant_time_select_int(good, msg_index, num - tlen);\n    mlen = num - msg_index;\n    for (from += msg_index, mask = good, i = 0; i < tlen; i++) {\n        unsigned int equals = constant_time_eq(i, mlen);\n        from -= tlen & equals;\n        mask &= mask ^ equals;\n        to[i] = constant_time_select_8(mask, from[i], to[i]);\n    }\n    OPENSSL_clear_free(em, num);\n    RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, RSA_R_PKCS_DECODING_ERROR);\n    err_clear_last_constant_time(1 & good);\n    return constant_time_select_int(good, mlen, -1);\n}', 'static ossl_inline unsigned int constant_time_ge(unsigned int a,\n                                                 unsigned int b)\n{\n    return ~constant_time_lt(a, b);\n}', 'static ossl_inline unsigned int constant_time_lt(unsigned int a,\n                                                 unsigned int b)\n{\n    return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b)));\n}']