crypto/rsa/rsa_oaep.c:264: error: INTEGER_OVERFLOW_L2
  (0 - [0, 1]):unsigned64 by call to `err_clear_last_constant_time`.
Showing all 7 steps of the trace


crypto/rsa/rsa_oaep.c:209:5: Assignment
207.       good &= constant_time_is_zero(CRYPTO_memcmp(db, phash, mdlen));
208.   
209.       found_one_byte = 0;
           ^
210.       for (i = mdlen; i < dblen; i++) {
211.           /*

crypto/rsa/rsa_oaep.c:222:5: Assignment
220.       }
221.   
222.       good &= found_one_byte;
           ^
223.   
224.       /*

crypto/rsa/rsa_oaep.c:235:5: Assignment
233.        * For good measure, do this check in constant tine as well.
234.        */
235.       good &= constant_time_ge(tlen, mlen);
           ^
236.   
237.       /*

crypto/rsa/rsa_oaep.c:264:5: Call
262.       RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1,
263.              RSA_R_OAEP_DECODING_ERROR);
264.       err_clear_last_constant_time(1 & good);
           ^
265.    cleanup:
266.       OPENSSL_cleanse(seed, sizeof(seed));

crypto/err/err.c:883:1: <RHS trace>
881.   }
882.   
883. > void err_clear_last_constant_time(int clear)
884.   {
885.       ERR_STATE *es;

crypto/err/err.c:883:1: Parameter `clear`
  881.   }
  882.   
  883. > void err_clear_last_constant_time(int clear)
  884.   {
  885.       ERR_STATE *es;

crypto/err/err.c:895:5: Binary operation: (0 - [0, 1]):unsigned64 by call to `err_clear_last_constant_time` 
  893.   
  894.       es->err_flags[top] &= ~(0 - clear);
  895.       es->err_buffer[top] &= ~(0UL - clear);
             ^
  896.       es->err_file[top] = (const char *)((uintptr_t)es->err_file[top] &
  897.                                          ~((uintptr_t)0 - clear));

void err_clear_last_constant_time(int clear)
{
    ERR_STATE *es;
    int top;
    es = ERR_get_state();
    if (es == NULL)
        return;
    top = es->top;
    es->err_flags[top] &= ~(0 - clear);
    es->err_buffer[top] &= ~(0UL - clear);
    es->err_file[top] = (const char *)((uintptr_t)es->err_file[top] &
                                       ~((uintptr_t)0 - clear));
    es->err_line[top] |= 0 - clear;
    es->top = (top + ERR_NUM_ERRORS - clear) % ERR_NUM_ERRORS;
}
['int RSA_padding_check_PKCS1_OAEP_mgf1(unsigned char *to, int tlen,\n                                      const unsigned char *from, int flen,\n                                      int num, const unsigned char *param,\n                                      int plen, const EVP_MD *md,\n                                      const EVP_MD *mgf1md)\n{\n    int i, dblen = 0, mlen = -1, one_index = 0, msg_index;\n    unsigned int good = 0, found_one_byte, mask;\n    const unsigned char *maskedseed, *maskeddb;\n    unsigned char *db = NULL, *em = NULL, seed[EVP_MAX_MD_SIZE],\n        phash[EVP_MAX_MD_SIZE];\n    int mdlen;\n    if (md == NULL)\n        md = EVP_sha1();\n    if (mgf1md == NULL)\n        mgf1md = md;\n    mdlen = EVP_MD_size(md);\n    if (tlen <= 0 || flen <= 0)\n        return -1;\n    if (num < flen || num < 2 * mdlen + 2) {\n        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1,\n               RSA_R_OAEP_DECODING_ERROR);\n        return -1;\n    }\n    dblen = num - mdlen - 1;\n    db = OPENSSL_malloc(dblen);\n    if (db == NULL) {\n        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1, ERR_R_MALLOC_FAILURE);\n        goto cleanup;\n    }\n    em = OPENSSL_malloc(num);\n    if (em == NULL) {\n        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1,\n               ERR_R_MALLOC_FAILURE);\n        goto cleanup;\n    }\n    for (from += flen, em += num, i = 0; i < num; i++) {\n        mask = ~constant_time_is_zero(flen);\n        flen -= 1 & mask;\n        from -= 1 & mask;\n        *--em = *from & mask;\n    }\n    from = em;\n    good = constant_time_is_zero(from[0]);\n    maskedseed = from + 1;\n    maskeddb = from + 1 + mdlen;\n    if (PKCS1_MGF1(seed, mdlen, maskeddb, dblen, mgf1md))\n        goto cleanup;\n    for (i = 0; i < mdlen; i++)\n        seed[i] ^= maskedseed[i];\n    if (PKCS1_MGF1(db, dblen, seed, mdlen, mgf1md))\n        goto cleanup;\n    for (i = 0; i < dblen; i++)\n        db[i] ^= maskeddb[i];\n    if (!EVP_Digest((void *)param, plen, phash, NULL, md, NULL))\n        goto cleanup;\n    good &= constant_time_is_zero(CRYPTO_memcmp(db, phash, mdlen));\n    found_one_byte = 0;\n    for (i = mdlen; i < dblen; i++) {\n        unsigned int equals1 = constant_time_eq(db[i], 1);\n        unsigned int equals0 = constant_time_is_zero(db[i]);\n        one_index = constant_time_select_int(~found_one_byte & equals1,\n                                             i, one_index);\n        found_one_byte |= equals1;\n        good &= (found_one_byte | equals0);\n    }\n    good &= found_one_byte;\n    msg_index = one_index + 1;\n    mlen = dblen - msg_index;\n    good &= constant_time_ge(tlen, mlen);\n    tlen = constant_time_select_int(constant_time_lt(dblen, tlen), dblen, tlen);\n    msg_index = constant_time_select_int(good, msg_index, dblen - tlen);\n    mlen = dblen - msg_index;\n    for (from = db + msg_index, mask = good, i = 0; i < tlen; i++) {\n        unsigned int equals = constant_time_eq(i, mlen);\n        from -= dblen & equals;\n        mask &= mask ^ equals;\n        to[i] = constant_time_select_8(mask, from[i], to[i]);\n    }\n    RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1,\n           RSA_R_OAEP_DECODING_ERROR);\n    err_clear_last_constant_time(1 & good);\n cleanup:\n    OPENSSL_cleanse(seed, sizeof(seed));\n    OPENSSL_clear_free(db, dblen);\n    OPENSSL_clear_free(em, num);\n    return constant_time_select_int(good, mlen, -1);\n}', 'void err_clear_last_constant_time(int clear)\n{\n    ERR_STATE *es;\n    int top;\n    es = ERR_get_state();\n    if (es == NULL)\n        return;\n    top = es->top;\n    es->err_flags[top] &= ~(0 - clear);\n    es->err_buffer[top] &= ~(0UL - clear);\n    es->err_file[top] = (const char *)((uintptr_t)es->err_file[top] &\n                                       ~((uintptr_t)0 - clear));\n    es->err_line[top] |= 0 - clear;\n    es->top = (top + ERR_NUM_ERRORS - clear) % ERR_NUM_ERRORS;\n}']