crypto/ec/curve448/eddsa.c:185: error: INTEGER_OVERFLOW_L2
  (0 - [0, 1]):unsigned64 by call to `curve448_scalar_halve`.
Showing all 6 steps of the trace


crypto/ec/curve448/eddsa.c:176:9: Call
174.           if (!EVP_DigestFinalXOF(hashctx, nonce, sizeof(nonce)))
175.               goto err;
176.           curve448_scalar_decode_long(nonce_scalar, nonce, sizeof(nonce));
               ^
177.           OPENSSL_cleanse(nonce, sizeof(nonce));
178.       }

crypto/ec/curve448/scalar.c:173:1: Parameter `s->limb[*]`
  171.   }
  172.   
  173. > void curve448_scalar_decode_long(curve448_scalar_t s,
  174.                                    const unsigned char *ser, size_t ser_len)
  175.   {

crypto/ec/curve448/eddsa.c:185:9: Call
183.           curve448_point_t p;
184.   
185.           curve448_scalar_halve(nonce_scalar_2, nonce_scalar);
               ^
186.           for (c = 2; c < C448_EDDSA_ENCODE_RATIO; c <<= 1)
187.               curve448_scalar_halve(nonce_scalar_2, nonce_scalar_2);

crypto/ec/curve448/scalar.c:221:1: <RHS trace>
219.   }
220.   
221. > void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
222.   {
223.       c448_word_t mask = 0 - (a->limb[0] & 1);

crypto/ec/curve448/scalar.c:221:1: Parameter `a->limb[*]`
  219.   }
  220.   
  221. > void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
  222.   {
  223.       c448_word_t mask = 0 - (a->limb[0] & 1);

crypto/ec/curve448/scalar.c:223:5: Binary operation: (0 - [0, 1]):unsigned64 by call to `curve448_scalar_halve` 
  221.   void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
  222.   {
  223.       c448_word_t mask = 0 - (a->limb[0] & 1);
             ^
  224.       c448_dword_t chain = 0;
  225.       unsigned int i;

void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
{
    c448_word_t mask = 0 - (a->limb[0] & 1);
    c448_dword_t chain = 0;
    unsigned int i;
    for (i = 0; i < C448_SCALAR_LIMBS; i++) {
        chain = (chain + a->limb[i]) + (sc_p->limb[i] & mask);
        out->limb[i] = (c448_word_t)chain;
        chain >>= C448_WORD_BITS;
    }
    for (i = 0; i < C448_SCALAR_LIMBS - 1; i++)
        out->limb[i] = out->limb[i] >> 1 | out->limb[i + 1] << (WBITS - 1);
    out->limb[i] = out->limb[i] >> 1 | (c448_word_t)(chain << (WBITS - 1));
}
['c448_error_t c448_ed448_sign(\n                        uint8_t signature[EDDSA_448_SIGNATURE_BYTES],\n                        const uint8_t privkey[EDDSA_448_PRIVATE_BYTES],\n                        const uint8_t pubkey[EDDSA_448_PUBLIC_BYTES],\n                        const uint8_t *message, size_t message_len,\n                        uint8_t prehashed, const uint8_t *context,\n                        size_t context_len)\n{\n    curve448_scalar_t secret_scalar;\n    EVP_MD_CTX *hashctx = EVP_MD_CTX_new();\n    c448_error_t ret = C448_FAILURE;\n    curve448_scalar_t nonce_scalar;\n    uint8_t nonce_point[EDDSA_448_PUBLIC_BYTES] = { 0 };\n    unsigned int c;\n    curve448_scalar_t challenge_scalar;\n    if (hashctx == NULL)\n        return C448_FAILURE;\n    {\n        uint8_t expanded[EDDSA_448_PRIVATE_BYTES * 2];\n        if (!oneshot_hash(expanded, sizeof(expanded), privkey,\n                          EDDSA_448_PRIVATE_BYTES))\n            goto err;\n        clamp(expanded);\n        curve448_scalar_decode_long(secret_scalar, expanded,\n                                    EDDSA_448_PRIVATE_BYTES);\n        if (!hash_init_with_dom(hashctx, prehashed, 0, context, context_len)\n                || !EVP_DigestUpdate(hashctx,\n                                     expanded + EDDSA_448_PRIVATE_BYTES,\n                                     EDDSA_448_PRIVATE_BYTES)\n                || !EVP_DigestUpdate(hashctx, message, message_len)) {\n            OPENSSL_cleanse(expanded, sizeof(expanded));\n            goto err;\n        }\n        OPENSSL_cleanse(expanded, sizeof(expanded));\n    }\n    {\n        uint8_t nonce[2 * EDDSA_448_PRIVATE_BYTES];\n        if (!EVP_DigestFinalXOF(hashctx, nonce, sizeof(nonce)))\n            goto err;\n        curve448_scalar_decode_long(nonce_scalar, nonce, sizeof(nonce));\n        OPENSSL_cleanse(nonce, sizeof(nonce));\n    }\n    {\n        curve448_scalar_t nonce_scalar_2;\n        curve448_point_t p;\n        curve448_scalar_halve(nonce_scalar_2, nonce_scalar);\n        for (c = 2; c < C448_EDDSA_ENCODE_RATIO; c <<= 1)\n            curve448_scalar_halve(nonce_scalar_2, nonce_scalar_2);\n        curve448_precomputed_scalarmul(p, curve448_precomputed_base,\n                                       nonce_scalar_2);\n        curve448_point_mul_by_ratio_and_encode_like_eddsa(nonce_point, p);\n        curve448_point_destroy(p);\n        curve448_scalar_destroy(nonce_scalar_2);\n    }\n    {\n        uint8_t challenge[2 * EDDSA_448_PRIVATE_BYTES];\n        if (!hash_init_with_dom(hashctx, prehashed, 0, context, context_len)\n                || !EVP_DigestUpdate(hashctx, nonce_point, sizeof(nonce_point))\n                || !EVP_DigestUpdate(hashctx, pubkey, EDDSA_448_PUBLIC_BYTES)\n                || !EVP_DigestUpdate(hashctx, message, message_len)\n                || !EVP_DigestFinalXOF(hashctx, challenge, sizeof(challenge)))\n            goto err;\n        curve448_scalar_decode_long(challenge_scalar, challenge,\n                                    sizeof(challenge));\n        OPENSSL_cleanse(challenge, sizeof(challenge));\n    }\n    curve448_scalar_mul(challenge_scalar, challenge_scalar, secret_scalar);\n    curve448_scalar_add(challenge_scalar, challenge_scalar, nonce_scalar);\n    OPENSSL_cleanse(signature, EDDSA_448_SIGNATURE_BYTES);\n    memcpy(signature, nonce_point, sizeof(nonce_point));\n    curve448_scalar_encode(&signature[EDDSA_448_PUBLIC_BYTES],\n                           challenge_scalar);\n    curve448_scalar_destroy(secret_scalar);\n    curve448_scalar_destroy(nonce_scalar);\n    curve448_scalar_destroy(challenge_scalar);\n    ret = C448_SUCCESS;\n err:\n    EVP_MD_CTX_free(hashctx);\n    return ret;\n}', 'void curve448_scalar_decode_long(curve448_scalar_t s,\n                                 const unsigned char *ser, size_t ser_len)\n{\n    size_t i;\n    curve448_scalar_t t1, t2;\n    if (ser_len == 0) {\n        curve448_scalar_copy(s, curve448_scalar_zero);\n        return;\n    }\n    i = ser_len - (ser_len % C448_SCALAR_BYTES);\n    if (i == ser_len)\n        i -= C448_SCALAR_BYTES;\n    scalar_decode_short(t1, &ser[i], ser_len - i);\n    if (ser_len == sizeof(curve448_scalar_t)) {\n        assert(i == 0);\n        curve448_scalar_mul(s, t1, curve448_scalar_one);\n        curve448_scalar_destroy(t1);\n        return;\n    }\n    while (i) {\n        i -= C448_SCALAR_BYTES;\n        sc_montmul(t1, t1, sc_r2);\n        (void)curve448_scalar_decode(t2, ser + i);\n        curve448_scalar_add(t1, t1, t2);\n    }\n    curve448_scalar_copy(s, t1);\n    curve448_scalar_destroy(t1);\n    curve448_scalar_destroy(t2);\n}', 'void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)\n{\n    c448_word_t mask = 0 - (a->limb[0] & 1);\n    c448_dword_t chain = 0;\n    unsigned int i;\n    for (i = 0; i < C448_SCALAR_LIMBS; i++) {\n        chain = (chain + a->limb[i]) + (sc_p->limb[i] & mask);\n        out->limb[i] = (c448_word_t)chain;\n        chain >>= C448_WORD_BITS;\n    }\n    for (i = 0; i < C448_SCALAR_LIMBS - 1; i++)\n        out->limb[i] = out->limb[i] >> 1 | out->limb[i + 1] << (WBITS - 1);\n    out->limb[i] = out->limb[i] >> 1 | (c448_word_t)(chain << (WBITS - 1));\n}']