crypto/rsa/rsa_pmeth.c:363: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `RSA_padding_check_PKCS1_OAEP_mgf1`.
Showing all 9 steps of the trace


crypto/rsa/rsa_pmeth.c:353:14: Call
351.       if (rctx->pad_mode == RSA_PKCS1_OAEP_PADDING) {
352.           int i;
353.           if (!setup_tbuf(rctx, ctx))
                    ^
354.               return -1;
355.           ret = RSA_private_decrypt(inlen, in, rctx->tbuf,

crypto/rsa/rsa_pmeth.c:142:17: Call
  140.       if (ctx->tbuf)
  141.           return 1;
  142.       ctx->tbuf = OPENSSL_malloc(EVP_PKEY_size(pk->pkey));
                         ^
  143.       if (ctx->tbuf == NULL)
  144.           return 0;

crypto/mem.c:124:16: Unknown value from: non-const function
    122.   
    123.       if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)
    124.           return malloc_impl(num, file, line);
                          ^
    125.   
    126.       if (num <= 0)

crypto/rsa/rsa_pmeth.c:363:15: Call
361.                   break;
362.           }
363.           ret = RSA_padding_check_PKCS1_OAEP_mgf1(out, ret, rctx->tbuf + i,
                     ^
364.                                                   ret - i, ret,
365.                                                   rctx->oaep_label,

crypto/rsa/rsa_oaep.c:111:1: Parameter `*from`
  109.   }
  110.   
  111. > int RSA_padding_check_PKCS1_OAEP_mgf1(unsigned char *to, int tlen,
  112.                                         const unsigned char *from, int flen,
  113.                                         int num, const unsigned char *param,

crypto/rsa/rsa_oaep.c:172:12: Call
  170.        * Optimal Asymmetric Encryption Padding (OAEP) [...]", CRYPTO 2001).
  171.        */
  172.       good = constant_time_is_zero(em[0]);
                    ^
  173.   
  174.       maskedseed = em + 1;

include/internal/constant_time_locl.h:165:1: <LHS trace>
163.   }
164.   
165. > static ossl_inline unsigned int constant_time_is_zero(unsigned int a)
166.   {
167.       return constant_time_msb(~a & (a - 1));

include/internal/constant_time_locl.h:165:1: Parameter `a`
    163.   }
    164.   
    165. > static ossl_inline unsigned int constant_time_is_zero(unsigned int a)
    166.   {
    167.       return constant_time_msb(~a & (a - 1));

include/internal/constant_time_locl.h:167:12: Binary operation: ([0, +oo] - 1):unsigned32 by call to `RSA_padding_check_PKCS1_OAEP_mgf1` 
    165.   static ossl_inline unsigned int constant_time_is_zero(unsigned int a)
    166.   {
    167.       return constant_time_msb(~a & (a - 1));
                      ^
    168.   }
    169.   

static ossl_inline unsigned int constant_time_is_zero(unsigned int a)
{
    return constant_time_msb(~a & (a - 1));
}
['static int pkey_rsa_decrypt(EVP_PKEY_CTX *ctx,\n                            unsigned char *out, size_t *outlen,\n                            const unsigned char *in, size_t inlen)\n{\n    int ret;\n    RSA_PKEY_CTX *rctx = ctx->data;\n    if (rctx->pad_mode == RSA_PKCS1_OAEP_PADDING) {\n        int i;\n        if (!setup_tbuf(rctx, ctx))\n            return -1;\n        ret = RSA_private_decrypt(inlen, in, rctx->tbuf,\n                                  ctx->pkey->pkey.rsa, RSA_NO_PADDING);\n        if (ret <= 0)\n            return ret;\n        for (i = 0; i < ret; i++) {\n            if (rctx->tbuf[i])\n                break;\n        }\n        ret = RSA_padding_check_PKCS1_OAEP_mgf1(out, ret, rctx->tbuf + i,\n                                                ret - i, ret,\n                                                rctx->oaep_label,\n                                                rctx->oaep_labellen,\n                                                rctx->md, rctx->mgf1md);\n    } else\n        ret = RSA_private_decrypt(inlen, in, out, ctx->pkey->pkey.rsa,\n                                  rctx->pad_mode);\n    if (ret < 0)\n        return ret;\n    *outlen = ret;\n    return 1;\n}', 'static int setup_tbuf(RSA_PKEY_CTX *ctx, EVP_PKEY_CTX *pk)\n{\n    if (ctx->tbuf)\n        return 1;\n    ctx->tbuf = OPENSSL_malloc(EVP_PKEY_size(pk->pkey));\n    if (ctx->tbuf == NULL)\n        return 0;\n    return 1;\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num <= 0)\n        return NULL;\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)file;\n    (void)line;\n    ret = malloc(num);\n#endif\n#ifndef OPENSSL_CPUID_OBJ\n    if (ret && (num > 2048)) {\n        extern unsigned char cleanse_ctr;\n        ((unsigned char *)ret)[0] = cleanse_ctr;\n    }\n#endif\n    return ret;\n}', 'int RSA_padding_check_PKCS1_OAEP_mgf1(unsigned char *to, int tlen,\n                                      const unsigned char *from, int flen,\n                                      int num, const unsigned char *param,\n                                      int plen, const EVP_MD *md,\n                                      const EVP_MD *mgf1md)\n{\n    int i, dblen, mlen = -1, one_index = 0, msg_index;\n    unsigned int good, found_one_byte;\n    const unsigned char *maskedseed, *maskeddb;\n    unsigned char *db = NULL, *em = NULL, seed[EVP_MAX_MD_SIZE],\n        phash[EVP_MAX_MD_SIZE];\n    int mdlen;\n    if (md == NULL)\n        md = EVP_sha1();\n    if (mgf1md == NULL)\n        mgf1md = md;\n    mdlen = EVP_MD_size(md);\n    if (tlen <= 0 || flen <= 0)\n        return -1;\n    if (num < flen || num < 2 * mdlen + 2)\n        goto decoding_err;\n    dblen = num - mdlen - 1;\n    db = OPENSSL_malloc(dblen);\n    em = OPENSSL_malloc(num);\n    if (db == NULL || em == NULL) {\n        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1, ERR_R_MALLOC_FAILURE);\n        goto cleanup;\n    }\n    memset(em, 0, num);\n    memcpy(em + num - flen, from, flen);\n    good = constant_time_is_zero(em[0]);\n    maskedseed = em + 1;\n    maskeddb = em + 1 + mdlen;\n    if (PKCS1_MGF1(seed, mdlen, maskeddb, dblen, mgf1md))\n        goto cleanup;\n    for (i = 0; i < mdlen; i++)\n        seed[i] ^= maskedseed[i];\n    if (PKCS1_MGF1(db, dblen, seed, mdlen, mgf1md))\n        goto cleanup;\n    for (i = 0; i < dblen; i++)\n        db[i] ^= maskeddb[i];\n    if (!EVP_Digest((void *)param, plen, phash, NULL, md, NULL))\n        goto cleanup;\n    good &= constant_time_is_zero(CRYPTO_memcmp(db, phash, mdlen));\n    found_one_byte = 0;\n    for (i = mdlen; i < dblen; i++) {\n        unsigned int equals1 = constant_time_eq(db[i], 1);\n        unsigned int equals0 = constant_time_is_zero(db[i]);\n        one_index = constant_time_select_int(~found_one_byte & equals1,\n                                             i, one_index);\n        found_one_byte |= equals1;\n        good &= (found_one_byte | equals0);\n    }\n    good &= found_one_byte;\n    if (!good)\n        goto decoding_err;\n    msg_index = one_index + 1;\n    mlen = dblen - msg_index;\n    if (tlen < mlen) {\n        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1, RSA_R_DATA_TOO_LARGE);\n        mlen = -1;\n    } else {\n        memcpy(to, db + msg_index, mlen);\n        goto cleanup;\n    }\n decoding_err:\n    RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1,\n           RSA_R_OAEP_DECODING_ERROR);\n cleanup:\n    OPENSSL_free(db);\n    OPENSSL_free(em);\n    return mlen;\n}', 'static ossl_inline unsigned int constant_time_is_zero(unsigned int a)\n{\n    return constant_time_msb(~a & (a - 1));\n}']