crypto/pem/pvkfmt.c:529: error: INTEGER_OVERFLOW_L2
  ([0, `pk->pkey.rsa->dmq1->top`] - 1):unsigned64 by call to `write_rsa`.
Showing all 9 steps of the trace


crypto/pem/pvkfmt.c:483:1: Parameter `pk->pkey.rsa->dmq1->top`
481.   static void write_dsa(unsigned char **out, DSA *dsa, int ispub);
482.   	
483. > static int do_i2b(unsigned char **out, EVP_PKEY *pk, int ispub)
484.   	{
485.   	unsigned char *p;

crypto/pem/pvkfmt.c:529:3: Call
527.   		write_dsa(&p, pk->pkey.dsa, ispub);
528.   	else
529.   		write_rsa(&p, pk->pkey.rsa, ispub);
         ^
530.   	if (!noinc)
531.   		*out += outlen;

crypto/pem/pvkfmt.c:610:1: Parameter `rsa->dmq1->top`
  608.   
  609.   
  610. > static void write_rsa(unsigned char **out, RSA *rsa, int ispub)
  611.   	{
  612.   	int nbyte, hnbyte;

crypto/pem/pvkfmt.c:622:2: Call
  620.   	write_lebn(out, rsa->q, hnbyte);
  621.   	write_lebn(out, rsa->dmp1, hnbyte);
  622.   	write_lebn(out, rsa->dmq1, hnbyte);
          ^
  623.   	write_lebn(out, rsa->iqmp, hnbyte);
  624.   	write_lebn(out, rsa->d, nbyte);

crypto/pem/pvkfmt.c:449:1: Parameter `bn->top`
    447.   	}
    448.   
    449. > static void write_lebn(unsigned char **out, const BIGNUM *bn, int len)
    450.   	{
    451.   	int nb, i;

crypto/pem/pvkfmt.c:453:7: Call
    451.   	int nb, i;
    452.   	unsigned char *p = *out, *q, c;
    453.   	nb = BN_num_bytes(bn);
                 ^
    454.   	BN_bn2bin(bn, p);
    455.   	q = p + nb - 1;

crypto/bn/bn_lib.c:248:1: <LHS trace>
246.   	}
247.   
248. > int BN_num_bits(const BIGNUM *a)
249.   	{
250.   	int i = a->top - 1;

crypto/bn/bn_lib.c:248:1: Parameter `a->top`
      246.   	}
      247.   
      248. > int BN_num_bits(const BIGNUM *a)
      249.   	{
      250.   	int i = a->top - 1;

crypto/bn/bn_lib.c:250:2: Binary operation: ([0, pk->pkey.rsa->dmq1->top] - 1):unsigned64 by call to `write_rsa` 
      248.   int BN_num_bits(const BIGNUM *a)
      249.   	{
      250.   	int i = a->top - 1;
              ^
      251.   	bn_check_top(a);
      252.   

int BN_num_bits(const BIGNUM *a)
	{
	int i = a->top - 1;
	bn_check_top(a);
	if (BN_is_zero(a)) return 0;
	return ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));
	}
['static int do_i2b(unsigned char **out, EVP_PKEY *pk, int ispub)\n\t{\n\tunsigned char *p;\n\tunsigned int bitlen, magic = 0, keyalg;\n\tint outlen, noinc = 0;\n\tif (pk->type == EVP_PKEY_DSA)\n\t\t{\n\t\tbitlen = check_bitlen_dsa(pk->pkey.dsa, ispub, &magic);\n\t\tkeyalg = MS_KEYALG_DSS_SIGN;\n\t\t}\n\telse if (pk->type == EVP_PKEY_RSA)\n\t\t{\n\t\tbitlen = check_bitlen_rsa(pk->pkey.rsa, ispub, &magic);\n\t\tkeyalg = MS_KEYALG_RSA_KEYX;\n\t\t}\n\telse\n\t\treturn -1;\n\tif (bitlen == 0)\n\t\treturn -1;\n\toutlen = 16 + blob_length(bitlen,\n\t\t\tkeyalg == MS_KEYALG_DSS_SIGN ? 1 : 0, ispub);\n\tif (out == NULL)\n\t\treturn outlen;\n\tif (*out)\n\t\tp = *out;\n\telse\n\t\t{\n\t\tp = OPENSSL_malloc(outlen);\n\t\tif (!p)\n\t\t\treturn -1;\n\t\t*out = p;\n\t\tnoinc = 1;\n\t\t}\n\tif (ispub)\n\t\t*p++ = MS_PUBLICKEYBLOB;\n\telse\n\t\t*p++ = MS_PRIVATEKEYBLOB;\n\t*p++ = 0x2;\n\t*p++ = 0;\n\t*p++ = 0;\n\twrite_ledword(&p, keyalg);\n\twrite_ledword(&p, magic);\n\twrite_ledword(&p, bitlen);\n\tif (keyalg == MS_KEYALG_DSS_SIGN)\n\t\twrite_dsa(&p, pk->pkey.dsa, ispub);\n\telse\n\t\twrite_rsa(&p, pk->pkey.rsa, ispub);\n\tif (!noinc)\n\t\t*out += outlen;\n\treturn outlen;\n\t}', 'static void write_rsa(unsigned char **out, RSA *rsa, int ispub)\n\t{\n\tint nbyte, hnbyte;\n\tnbyte = BN_num_bytes(rsa->n);\n\thnbyte = (BN_num_bits(rsa->n) + 15) >> 4;\n\twrite_lebn(out, rsa->e, 4);\n\twrite_lebn(out, rsa->n, -1);\n\tif (ispub)\n\t\treturn;\n\twrite_lebn(out, rsa->p, hnbyte);\n\twrite_lebn(out, rsa->q, hnbyte);\n\twrite_lebn(out, rsa->dmp1, hnbyte);\n\twrite_lebn(out, rsa->dmq1, hnbyte);\n\twrite_lebn(out, rsa->iqmp, hnbyte);\n\twrite_lebn(out, rsa->d, nbyte);\n\t}', 'static void write_lebn(unsigned char **out, const BIGNUM *bn, int len)\n\t{\n\tint nb, i;\n\tunsigned char *p = *out, *q, c;\n\tnb = BN_num_bytes(bn);\n\tBN_bn2bin(bn, p);\n\tq = p + nb - 1;\n\tfor (i = 0; i < nb/2; i++)\n\t\t{\n\t\tc = *p;\n\t\t*p++ = *q;\n\t\t*q-- = c;\n\t\t}\n\t*out += nb;\n\tif (len > 0)\n\t\t{\n\t\tlen -= nb;\n\t\tif (len > 0)\n\t\t\t{\n\t\t\tmemset(*out, 0, len);\n\t\t\t*out += len;\n\t\t\t}\n\t\t}\n\t}', 'int BN_num_bits(const BIGNUM *a)\n\t{\n\tint i = a->top - 1;\n\tbn_check_top(a);\n\tif (BN_is_zero(a)) return 0;\n\treturn ((i*BN_BITS2) + BN_num_bits_word(a->d[i]));\n\t}']