crypto/bn/bn_add.c:39: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned64 by call to `BN_usub`.
Showing all 8 steps of the trace


crypto/bn/bn_add.c:14:1: Parameter `*b->d`
12.   
13.   /* r can == a or b */
14. > int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
15.   {
16.       const BIGNUM *tmp;

crypto/bn/bn_add.c:38:13: Call
36.           /* we are now a - b */
37.   
38.           if (BN_ucmp(a, b) < 0) {
                  ^
39.               if (!BN_usub(r, b, a))
40.                   return (0);

crypto/bn/bn_lib.c:623:1: Parameter `*b->d`
  621.   }
  622.   
  623. > int BN_ucmp(const BIGNUM *a, const BIGNUM *b)
  624.   {
  625.       int i;

crypto/bn/bn_add.c:39:18: Call
37.   
38.           if (BN_ucmp(a, b) < 0) {
39.               if (!BN_usub(r, b, a))
                       ^
40.                   return (0);
41.               r->neg = 1;

crypto/bn/bn_add.c:117:1: <LHS trace>
115.   
116.   /* unsigned subtraction of b from a, a must be larger than b. */
117. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
118.   {
119.       int max, min, dif;

crypto/bn/bn_add.c:117:1: Parameter `*a->d`
  115.   
  116.   /* unsigned subtraction of b from a, a must be larger than b. */
  117. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
  118.   {
  119.       int max, min, dif;

crypto/bn/bn_add.c:169:13: Assignment
  167.           while (dif) {
  168.               dif--;
  169.               t1 = *(ap++);
                     ^
  170.               t2 = (t1 - 1) & BN_MASK2;
  171.               *(rp++) = t2;

crypto/bn/bn_add.c:170:13: Binary operation: ([0, +oo] - 1):unsigned64 by call to `BN_usub` 
  168.               dif--;
  169.               t1 = *(ap++);
  170.               t2 = (t1 - 1) & BN_MASK2;
                     ^
  171.               *(rp++) = t2;
  172.               if (t1)

int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
{
    int max, min, dif;
    register BN_ULONG t1, t2, *rp;
    register const BN_ULONG *ap, *bp;
    int i, carry;
    bn_check_top(a);
    bn_check_top(b);
    max = a->top;
    min = b->top;
    dif = max - min;
    if (dif < 0) {
        BNerr(BN_F_BN_USUB, BN_R_ARG2_LT_ARG3);
        return (0);
    }
    if (bn_wexpand(r, max) == NULL)
        return (0);
    ap = a->d;
    bp = b->d;
    rp = r->d;
#if 1
    carry = 0;
    for (i = min; i != 0; i--) {
        t1 = *(ap++);
        t2 = *(bp++);
        if (carry) {
            carry = (t1 <= t2);
            t1 = (t1 - t2 - 1) & BN_MASK2;
        } else {
            carry = (t1 < t2);
            t1 = (t1 - t2) & BN_MASK2;
        }
        *(rp++) = t1 & BN_MASK2;
    }
#else
    carry = bn_sub_words(rp, ap, bp, min);
    ap += min;
    bp += min;
    rp += min;
#endif
    if (carry) {
        if (!dif)
            return 0;
        while (dif) {
            dif--;
            t1 = *(ap++);
            t2 = (t1 - 1) & BN_MASK2;
            *(rp++) = t2;
            if (t1)
                break;
        }
    }
    if (dif && ap != rp)
        memcpy(rp, ap, sizeof(*rp) * dif);
    r->top = max;
    r->neg = 0;
    bn_correct_top(r);
    return (1);
}
['int BN_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)\n{\n    const BIGNUM *tmp;\n    int a_neg = a->neg, ret;\n    bn_check_top(a);\n    bn_check_top(b);\n    if (a_neg ^ b->neg) {\n        if (a_neg) {\n            tmp = a;\n            a = b;\n            b = tmp;\n        }\n        if (BN_ucmp(a, b) < 0) {\n            if (!BN_usub(r, b, a))\n                return (0);\n            r->neg = 1;\n        } else {\n            if (!BN_usub(r, a, b))\n                return (0);\n            r->neg = 0;\n        }\n        return (1);\n    }\n    ret = BN_uadd(r, a, b);\n    r->neg = a_neg;\n    bn_check_top(r);\n    return ret;\n}', 'int BN_ucmp(const BIGNUM *a, const BIGNUM *b)\n{\n    int i;\n    BN_ULONG t1, t2, *ap, *bp;\n    bn_check_top(a);\n    bn_check_top(b);\n    i = a->top - b->top;\n    if (i != 0)\n        return (i);\n    ap = a->d;\n    bp = b->d;\n    for (i = a->top - 1; i >= 0; i--) {\n        t1 = ap[i];\n        t2 = bp[i];\n        if (t1 != t2)\n            return ((t1 > t2) ? 1 : -1);\n    }\n    return (0);\n}', 'int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)\n{\n    int max, min, dif;\n    register BN_ULONG t1, t2, *rp;\n    register const BN_ULONG *ap, *bp;\n    int i, carry;\n    bn_check_top(a);\n    bn_check_top(b);\n    max = a->top;\n    min = b->top;\n    dif = max - min;\n    if (dif < 0) {\n        BNerr(BN_F_BN_USUB, BN_R_ARG2_LT_ARG3);\n        return (0);\n    }\n    if (bn_wexpand(r, max) == NULL)\n        return (0);\n    ap = a->d;\n    bp = b->d;\n    rp = r->d;\n#if 1\n    carry = 0;\n    for (i = min; i != 0; i--) {\n        t1 = *(ap++);\n        t2 = *(bp++);\n        if (carry) {\n            carry = (t1 <= t2);\n            t1 = (t1 - t2 - 1) & BN_MASK2;\n        } else {\n            carry = (t1 < t2);\n            t1 = (t1 - t2) & BN_MASK2;\n        }\n        *(rp++) = t1 & BN_MASK2;\n    }\n#else\n    carry = bn_sub_words(rp, ap, bp, min);\n    ap += min;\n    bp += min;\n    rp += min;\n#endif\n    if (carry) {\n        if (!dif)\n            return 0;\n        while (dif) {\n            dif--;\n            t1 = *(ap++);\n            t2 = (t1 - 1) & BN_MASK2;\n            *(rp++) = t2;\n            if (t1)\n                break;\n        }\n    }\n    if (dif && ap != rp)\n        memcpy(rp, ap, sizeof(*rp) * dif);\n    r->top = max;\n    r->neg = 0;\n    bn_correct_top(r);\n    return (1);\n}']