ssl/statem/statem_srvr.c:2205: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `constant_time_is_zero_8`.
Showing all 8 steps of the trace


ssl/statem/statem_srvr.c:2160:19: Call
2158.       }
2159.   
2160.       rsa_decrypt = OPENSSL_malloc(RSA_size(rsa));
                          ^
2161.       if (rsa_decrypt == NULL) {
2162.           *al = SSL_AD_INTERNAL_ERROR;

crypto/mem.c:76:16: Unknown value from: non-const function
  74.   
  75.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
  76.           return malloc_impl(num, file, line);
                       ^
  77.   
  78.       if (num <= 0)

ssl/statem/statem_srvr.c:2205:26: Call
2203.           constant_time_eq_int_8(rsa_decrypt[1], 2);
2204.       for (j = 2; j < padding_len - 1; j++) {
2205.           decrypt_good &= ~constant_time_is_zero_8(rsa_decrypt[j]);
                                 ^
2206.       }
2207.       decrypt_good &= constant_time_is_zero_8(rsa_decrypt[padding_len - 1]);

include/internal/constant_time_locl.h:134:1: Parameter `a`
  132.   }
  133.   
  134. > static ossl_inline unsigned char constant_time_is_zero_8(unsigned int a)
  135.   {
  136.       return (unsigned char)(constant_time_is_zero(a));

include/internal/constant_time_locl.h:136:28: Call
  134.   static ossl_inline unsigned char constant_time_is_zero_8(unsigned int a)
  135.   {
  136.       return (unsigned char)(constant_time_is_zero(a));
                                    ^
  137.   }
  138.   

include/internal/constant_time_locl.h:129:1: <LHS trace>
127.   }
128.   
129. > static ossl_inline unsigned int constant_time_is_zero(unsigned int a)
130.   {
131.       return constant_time_msb(~a & (a - 1));

include/internal/constant_time_locl.h:129:1: Parameter `a`
    127.   }
    128.   
    129. > static ossl_inline unsigned int constant_time_is_zero(unsigned int a)
    130.   {
    131.       return constant_time_msb(~a & (a - 1));

include/internal/constant_time_locl.h:131:12: Binary operation: ([0, +oo] - 1):unsigned32 by call to `constant_time_is_zero_8` 
    129.   static ossl_inline unsigned int constant_time_is_zero(unsigned int a)
    130.   {
    131.       return constant_time_msb(~a & (a - 1));
                      ^
    132.   }
    133.   

static ossl_inline unsigned int constant_time_is_zero(unsigned int a)
{
    return constant_time_msb(~a & (a - 1));
}
['static int tls_process_cke_rsa(SSL *s, PACKET *pkt, int *al)\n{\n#ifndef OPENSSL_NO_RSA\n    unsigned char rand_premaster_secret[SSL_MAX_MASTER_KEY_LENGTH];\n    int decrypt_len;\n    unsigned char decrypt_good, version_good;\n    size_t j, padding_len;\n    PACKET enc_premaster;\n    RSA *rsa = NULL;\n    unsigned char *rsa_decrypt = NULL;\n    int ret = 0;\n    rsa = EVP_PKEY_get0_RSA(s->cert->pkeys[SSL_PKEY_RSA_ENC].privatekey);\n    if (rsa == NULL) {\n        *al = SSL_AD_HANDSHAKE_FAILURE;\n        SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_MISSING_RSA_CERTIFICATE);\n        return 0;\n    }\n    if (s->version == SSL3_VERSION || s->version == DTLS1_BAD_VER) {\n        enc_premaster = *pkt;\n    } else {\n        if (!PACKET_get_length_prefixed_2(pkt, &enc_premaster)\n            || PACKET_remaining(pkt) != 0) {\n            *al = SSL_AD_DECODE_ERROR;\n            SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_LENGTH_MISMATCH);\n            return 0;\n        }\n    }\n    if (RSA_size(rsa) < SSL_MAX_MASTER_KEY_LENGTH) {\n        *al = SSL_AD_INTERNAL_ERROR;\n        SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, RSA_R_KEY_SIZE_TOO_SMALL);\n        return 0;\n    }\n    rsa_decrypt = OPENSSL_malloc(RSA_size(rsa));\n    if (rsa_decrypt == NULL) {\n        *al = SSL_AD_INTERNAL_ERROR;\n        SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    if (RAND_bytes(rand_premaster_secret, sizeof(rand_premaster_secret)) <= 0)\n        goto err;\n    decrypt_len = RSA_private_decrypt(PACKET_remaining(&enc_premaster),\n                                      PACKET_data(&enc_premaster),\n                                      rsa_decrypt, rsa, RSA_NO_PADDING);\n    if (decrypt_len < 0)\n        goto err;\n    if (decrypt_len < 11 + SSL_MAX_MASTER_KEY_LENGTH) {\n        *al = SSL_AD_DECRYPT_ERROR;\n        SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, SSL_R_DECRYPTION_FAILED);\n        goto err;\n    }\n    padding_len = decrypt_len - SSL_MAX_MASTER_KEY_LENGTH;\n    decrypt_good = constant_time_eq_int_8(rsa_decrypt[0], 0) &\n        constant_time_eq_int_8(rsa_decrypt[1], 2);\n    for (j = 2; j < padding_len - 1; j++) {\n        decrypt_good &= ~constant_time_is_zero_8(rsa_decrypt[j]);\n    }\n    decrypt_good &= constant_time_is_zero_8(rsa_decrypt[padding_len - 1]);\n    version_good =\n        constant_time_eq_8(rsa_decrypt[padding_len],\n                           (unsigned)(s->client_version >> 8));\n    version_good &=\n        constant_time_eq_8(rsa_decrypt[padding_len + 1],\n                           (unsigned)(s->client_version & 0xff));\n    if (s->options & SSL_OP_TLS_ROLLBACK_BUG) {\n        unsigned char workaround_good;\n        workaround_good = constant_time_eq_8(rsa_decrypt[padding_len],\n                                             (unsigned)(s->version >> 8));\n        workaround_good &=\n            constant_time_eq_8(rsa_decrypt[padding_len + 1],\n                               (unsigned)(s->version & 0xff));\n        version_good |= workaround_good;\n    }\n    decrypt_good &= version_good;\n    for (j = 0; j < sizeof(rand_premaster_secret); j++) {\n        rsa_decrypt[padding_len + j] =\n            constant_time_select_8(decrypt_good,\n                                   rsa_decrypt[padding_len + j],\n                                   rand_premaster_secret[j]);\n    }\n    if (!ssl_generate_master_secret(s, rsa_decrypt + padding_len,\n                                    sizeof(rand_premaster_secret), 0)) {\n        *al = SSL_AD_INTERNAL_ERROR;\n        SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    ret = 1;\n err:\n    OPENSSL_free(rsa_decrypt);\n    return ret;\n#else\n    *al = SSL_AD_INTERNAL_ERROR;\n    SSLerr(SSL_F_TLS_PROCESS_CKE_RSA, ERR_R_INTERNAL_ERROR);\n    return 0;\n#endif\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    osslargused(file); osslargused(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}', 'static ossl_inline unsigned char constant_time_is_zero_8(unsigned int a)\n{\n    return (unsigned char)(constant_time_is_zero(a));\n}', 'static ossl_inline unsigned int constant_time_is_zero(unsigned int a)\n{\n    return constant_time_msb(~a & (a - 1));\n}']