crypto/rsa/rsa_eay.c:626: error: INTEGER_OVERFLOW_L2
  ([0, `rsa->n->top`] - 1):unsigned64 by call to `BN_ucmp`.
Showing all 7 steps of the trace


crypto/rsa/rsa_eay.c:611:1: Parameter `rsa->n->top`
609.   
610.   /* signature verification */
611. > static int RSA_eay_public_decrypt(int flen, const unsigned char *from,
612.   	     unsigned char *to, RSA *rsa, int padding)
613.   	{

crypto/rsa/rsa_eay.c:620:6: Call
618.   	BN_CTX *ctx=NULL;
619.   
620.   	if (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)
            ^
621.   		{
622.   		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_MODULUS_TOO_LARGE);

crypto/bn/bn_lib.c:248:1: Parameter `a->top`
  246.   	}
  247.   
  248. > int BN_num_bits(const BIGNUM *a)
  249.   	{
  250.   	int i = a->top - 1;

crypto/rsa/rsa_eay.c:626:6: Call
624.   		}
625.   
626.   	if (BN_ucmp(rsa->n, rsa->e) <= 0)
            ^
627.   		{
628.   		RSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);

crypto/bn/bn_lib.c:656:1: <LHS trace>
654.   	}
655.   
656. > int BN_ucmp(const BIGNUM *a, const BIGNUM *b)
657.   	{
658.   	int i;

crypto/bn/bn_lib.c:656:1: Parameter `a->top`
  654.   	}
  655.   
  656. > int BN_ucmp(const BIGNUM *a, const BIGNUM *b)
  657.   	{
  658.   	int i;

crypto/bn/bn_lib.c:668:7: Binary operation: ([0, rsa->n->top] - 1):unsigned64 by call to `BN_ucmp` 
  666.   	ap=a->d;
  667.   	bp=b->d;
  668.   	for (i=a->top-1; i>=0; i--)
               ^
  669.   		{
  670.   		t1= ap[i];

int BN_ucmp(const BIGNUM *a, const BIGNUM *b)
	{
	int i;
	BN_ULONG t1,t2,*ap,*bp;
	bn_check_top(a);
	bn_check_top(b);
	i=a->top-b->top;
	if (i != 0) return(i);
	ap=a->d;
	bp=b->d;
	for (i=a->top-1; i>=0; i--)
		{
		t1= ap[i];
		t2= bp[i];
		if (t1 != t2)
			return((t1 > t2) ? 1 : -1);
		}
	return(0);
	}
['static int RSA_eay_public_decrypt(int flen, const unsigned char *from,\n\t     unsigned char *to, RSA *rsa, int padding)\n\t{\n\tBIGNUM *f,*ret;\n\tint i,num=0,r= -1;\n\tunsigned char *p;\n\tunsigned char *buf=NULL;\n\tBN_CTX *ctx=NULL;\n\tif (BN_num_bits(rsa->n) > OPENSSL_RSA_MAX_MODULUS_BITS)\n\t\t{\n\t\tRSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_MODULUS_TOO_LARGE);\n\t\treturn -1;\n\t\t}\n\tif (BN_ucmp(rsa->n, rsa->e) <= 0)\n\t\t{\n\t\tRSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);\n\t\treturn -1;\n\t\t}\n\tif (BN_num_bits(rsa->n) > OPENSSL_RSA_SMALL_MODULUS_BITS)\n\t\t{\n\t\tif (BN_num_bits(rsa->e) > OPENSSL_RSA_MAX_PUBEXP_BITS)\n\t\t\t{\n\t\t\tRSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT, RSA_R_BAD_E_VALUE);\n\t\t\treturn -1;\n\t\t\t}\n\t\t}\n\tif((ctx = BN_CTX_new()) == NULL) goto err;\n\tBN_CTX_start(ctx);\n\tf = BN_CTX_get(ctx);\n\tret = BN_CTX_get(ctx);\n\tnum=BN_num_bytes(rsa->n);\n\tbuf = OPENSSL_malloc(num);\n\tif(!f || !ret || !buf)\n\t\t{\n\t\tRSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,ERR_R_MALLOC_FAILURE);\n\t\tgoto err;\n\t\t}\n\tif (flen > num)\n\t\t{\n\t\tRSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_GREATER_THAN_MOD_LEN);\n\t\tgoto err;\n\t\t}\n\tif (BN_bin2bn(from,flen,f) == NULL) goto err;\n\tif (BN_ucmp(f, rsa->n) >= 0)\n\t\t{\n\t\tRSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_DATA_TOO_LARGE_FOR_MODULUS);\n\t\tgoto err;\n\t\t}\n\tif (rsa->flags & RSA_FLAG_CACHE_PUBLIC)\n\t\tif (!BN_MONT_CTX_set_locked(&rsa->_method_mod_n, CRYPTO_LOCK_RSA, rsa->n, ctx))\n\t\t\tgoto err;\n\tif (!rsa->meth->bn_mod_exp(ret,f,rsa->e,rsa->n,ctx,\n\t\trsa->_method_mod_n)) goto err;\n\tif ((padding == RSA_X931_PADDING) && ((ret->d[0] & 0xf) != 12))\n\t\tBN_sub(ret, rsa->n, ret);\n\tp=buf;\n\ti=BN_bn2bin(ret,p);\n\tswitch (padding)\n\t\t{\n\tcase RSA_PKCS1_PADDING:\n\t\tr=RSA_padding_check_PKCS1_type_1(to,num,buf,i,num);\n\t\tbreak;\n\tcase RSA_X931_PADDING:\n\t\tr=RSA_padding_check_X931(to,num,buf,i,num);\n\t\tbreak;\n\tcase RSA_NO_PADDING:\n\t\tr=RSA_padding_check_none(to,num,buf,i,num);\n\t\tbreak;\n\tdefault:\n\t\tRSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_UNKNOWN_PADDING_TYPE);\n\t\tgoto err;\n\t\t}\n\tif (r < 0)\n\t\tRSAerr(RSA_F_RSA_EAY_PUBLIC_DECRYPT,RSA_R_PADDING_CHECK_FAILED);\nerr:\n\tif (ctx != NULL)\n\t\t{\n\t\tBN_CTX_end(ctx);\n\t\tBN_CTX_free(ctx);\n\t\t}\n\tif (buf != NULL)\n\t\t{\n\t\tOPENSSL_cleanse(buf,num);\n\t\tOPENSSL_free(buf);\n\t\t}\n\treturn(r);\n\t}', 'int BN_num_bits(const BIGNUM *a)\n\t{\n\tint i = a->top - 1;\n\tbn_check_top(a);\n\tif (BN_is_zero(a)) return 0;\n\treturn ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));\n\t}', 'int BN_ucmp(const BIGNUM *a, const BIGNUM *b)\n\t{\n\tint i;\n\tBN_ULONG t1,t2,*ap,*bp;\n\tbn_check_top(a);\n\tbn_check_top(b);\n\ti=a->top-b->top;\n\tif (i != 0) return(i);\n\tap=a->d;\n\tbp=b->d;\n\tfor (i=a->top-1; i>=0; i--)\n\t\t{\n\t\tt1= ap[i];\n\t\tt2= bp[i];\n\t\tif (t1 != t2)\n\t\t\treturn((t1 > t2) ? 1 : -1);\n\t\t}\n\treturn(0);\n\t}']