crypto/ec/curve25519.c:5430: error: INTEGER_OVERFLOW_L2
  (32 - [1, 127]):unsigned64 by call to `SHA512_Update`.
Showing all 10 steps of the trace


crypto/ec/curve25519.c:5428:3: Call
5426.     fe_neg(A.T, A.T);
5427.   
5428.     SHA512_Init(&hash_ctx);
          ^
5429.     SHA512_Update(&hash_ctx, r, 32);
5430.     SHA512_Update(&hash_ctx, public_key, 32);

crypto/sha/sha512.c:130:5: Assignment
  128.       c->Nl = 0;
  129.       c->Nh = 0;
  130.       c->num = 0;
             ^
  131.       c->md_len = SHA512_DIGEST_LENGTH;
  132.       return 1;

crypto/ec/curve25519.c:5429:3: Call
5427.   
5428.     SHA512_Init(&hash_ctx);
5429.     SHA512_Update(&hash_ctx, r, 32);
          ^
5430.     SHA512_Update(&hash_ctx, public_key, 32);
5431.     SHA512_Update(&hash_ctx, message, message_len);

crypto/sha/sha512.c:264:1: Parameter `c->num`
  262.   }
  263.   
  264. > int SHA512_Update(SHA512_CTX *c, const void *_data, size_t len)
  265.   {
  266.       SHA_LONG64 l;

crypto/ec/curve25519.c:5430:3: Call
5428.     SHA512_Init(&hash_ctx);
5429.     SHA512_Update(&hash_ctx, r, 32);
5430.     SHA512_Update(&hash_ctx, public_key, 32);
          ^
5431.     SHA512_Update(&hash_ctx, message, message_len);
5432.     SHA512_Final(h, &hash_ctx);

crypto/sha/sha512.c:264:1: <LHS trace>
262.   }
263.   
264. > int SHA512_Update(SHA512_CTX *c, const void *_data, size_t len)
265.   {
266.       SHA_LONG64 l;

crypto/sha/sha512.c:264:1: Parameter `len`
  262.   }
  263.   
  264. > int SHA512_Update(SHA512_CTX *c, const void *_data, size_t len)
  265.   {
  266.       SHA_LONG64 l;

crypto/sha/sha512.c:264:1: <RHS trace>
262.   }
263.   
264. > int SHA512_Update(SHA512_CTX *c, const void *_data, size_t len)
265.   {
266.       SHA_LONG64 l;

crypto/sha/sha512.c:264:1: Parameter `len`
  262.   }
  263.   
  264. > int SHA512_Update(SHA512_CTX *c, const void *_data, size_t len)
  265.   {
  266.       SHA_LONG64 l;

crypto/sha/sha512.c:288:13: Binary operation: (32 - [1, 127]):unsigned64 by call to `SHA512_Update` 
  286.           } else {
  287.               memcpy(p + c->num, data, n), c->num = 0;
  288.               len -= n, data += n;
                     ^
  289.               sha512_block_data_order(c, p, 1);
  290.           }

int SHA512_Update(SHA512_CTX *c, const void *_data, size_t len)
{
    SHA_LONG64 l;
    unsigned char *p = c->u.p;
    const unsigned char *data = (const unsigned char *)_data;
    if (len == 0)
        return 1;
    l = (c->Nl + (((SHA_LONG64) len) << 3)) & U64(0xffffffffffffffff);
    if (l < c->Nl)
        c->Nh++;
    if (sizeof(len) >= 8)
        c->Nh += (((SHA_LONG64) len) >> 61);
    c->Nl = l;
    if (c->num != 0) {
        size_t n = sizeof(c->u) - c->num;
        if (len < n) {
            memcpy(p + c->num, data, len), c->num += (unsigned int)len;
            return 1;
        } else {
            memcpy(p + c->num, data, n), c->num = 0;
            len -= n, data += n;
            sha512_block_data_order(c, p, 1);
        }
    }
    if (len >= sizeof(c->u)) {
#ifndef SHA512_BLOCK_CAN_MANAGE_UNALIGNED_DATA
        if ((size_t)data % sizeof(c->u.d[0]) != 0)
            while (len >= sizeof(c->u))
                memcpy(p, data, sizeof(c->u)),
                sha512_block_data_order(c, p, 1),
                len -= sizeof(c->u), data += sizeof(c->u);
        else
#endif
            sha512_block_data_order(c, data, len / sizeof(c->u)),
            data += len, len %= sizeof(c->u), data -= len;
    }
    if (len != 0)
        memcpy(p, data, len), c->num = (int)len;
    return 1;
}
['int ED25519_verify(const uint8_t *message, size_t message_len,\n                   const uint8_t signature[64], const uint8_t public_key[32]) {\n  int i;\n  ge_p3 A;\n  const uint8_t *r, *s;\n  SHA512_CTX hash_ctx;\n  ge_p2 R;\n  uint8_t rcheck[32];\n  uint8_t h[SHA512_DIGEST_LENGTH];\n  const uint8_t l_low[16] = {\n    0xED, 0xD3, 0xF5, 0x5C, 0x1A, 0x63, 0x12, 0x58, 0xD6, 0x9C, 0xF7, 0xA2,\n    0xDE, 0xF9, 0xDE, 0x14\n  };\n  r = signature;\n  s = signature + 32;\n  if (s[31] > 0x10)\n    return 0;\n  if (s[31] == 0x10) {\n      if (memcmp(s + 16, allzeroes, sizeof(allzeroes)) != 0)\n        return 0;\n      for (i = 15; i >= 0; i--) {\n          if (s[i] < l_low[i])\n            break;\n          if (s[i] > l_low[i])\n            return 0;\n      }\n      if (i < 0)\n        return 0;\n  }\n  if (ge_frombytes_vartime(&A, public_key) != 0) {\n    return 0;\n  }\n  fe_neg(A.X, A.X);\n  fe_neg(A.T, A.T);\n  SHA512_Init(&hash_ctx);\n  SHA512_Update(&hash_ctx, r, 32);\n  SHA512_Update(&hash_ctx, public_key, 32);\n  SHA512_Update(&hash_ctx, message, message_len);\n  SHA512_Final(h, &hash_ctx);\n  x25519_sc_reduce(h);\n  ge_double_scalarmult_vartime(&R, h, &A, s);\n  ge_tobytes(rcheck, &R);\n  return CRYPTO_memcmp(rcheck, r, sizeof(rcheck)) == 0;\n}', 'int SHA512_Init(SHA512_CTX *c)\n{\n    c->h[0] = U64(0x6a09e667f3bcc908);\n    c->h[1] = U64(0xbb67ae8584caa73b);\n    c->h[2] = U64(0x3c6ef372fe94f82b);\n    c->h[3] = U64(0xa54ff53a5f1d36f1);\n    c->h[4] = U64(0x510e527fade682d1);\n    c->h[5] = U64(0x9b05688c2b3e6c1f);\n    c->h[6] = U64(0x1f83d9abfb41bd6b);\n    c->h[7] = U64(0x5be0cd19137e2179);\n    c->Nl = 0;\n    c->Nh = 0;\n    c->num = 0;\n    c->md_len = SHA512_DIGEST_LENGTH;\n    return 1;\n}', 'int SHA512_Update(SHA512_CTX *c, const void *_data, size_t len)\n{\n    SHA_LONG64 l;\n    unsigned char *p = c->u.p;\n    const unsigned char *data = (const unsigned char *)_data;\n    if (len == 0)\n        return 1;\n    l = (c->Nl + (((SHA_LONG64) len) << 3)) & U64(0xffffffffffffffff);\n    if (l < c->Nl)\n        c->Nh++;\n    if (sizeof(len) >= 8)\n        c->Nh += (((SHA_LONG64) len) >> 61);\n    c->Nl = l;\n    if (c->num != 0) {\n        size_t n = sizeof(c->u) - c->num;\n        if (len < n) {\n            memcpy(p + c->num, data, len), c->num += (unsigned int)len;\n            return 1;\n        } else {\n            memcpy(p + c->num, data, n), c->num = 0;\n            len -= n, data += n;\n            sha512_block_data_order(c, p, 1);\n        }\n    }\n    if (len >= sizeof(c->u)) {\n#ifndef SHA512_BLOCK_CAN_MANAGE_UNALIGNED_DATA\n        if ((size_t)data % sizeof(c->u.d[0]) != 0)\n            while (len >= sizeof(c->u))\n                memcpy(p, data, sizeof(c->u)),\n                sha512_block_data_order(c, p, 1),\n                len -= sizeof(c->u), data += sizeof(c->u);\n        else\n#endif\n            sha512_block_data_order(c, data, len / sizeof(c->u)),\n            data += len, len %= sizeof(c->u), data -= len;\n    }\n    if (len != 0)\n        memcpy(p, data, len), c->num = (int)len;\n    return 1;\n}']