ssl/t1_lib.c:3384: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `EVP_DecryptFinal`.
Showing all 13 steps of the trace


ssl/t1_lib.c:3383:2: Call
3381.   		return -1;
3382.   		}
3383.   	EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
         ^
3384.   	if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
3385.   		{

crypto/evp/evp_enc.c:425:1: Parameter `ctx->buf[*]`
  423.   	}
  424.   
  425. > int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,
  426.   	     const unsigned char *in, int inl)
  427.   	{

ssl/t1_lib.c:3384:6: Call
3382.   		}
3383.   	EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
3384.   	if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
             ^
3385.   		{
3386.   		EVP_CIPHER_CTX_cleanup(&ctx);

crypto/evp/evp_enc.c:486:1: Parameter `ctx->final[*]`
  484.   	}
  485.   
  486. > int EVP_DecryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
  487.   	{
  488.   	int ret;

crypto/evp/evp_enc.c:489:8: Call
  487.   	{
  488.   	int ret;
  489.   	ret = EVP_DecryptFinal_ex(ctx, out, outl);
                ^
  490.   	return ret;
  491.   	}

crypto/evp/evp_enc.c:493:1: Parameter `ctx->final[*]`
    491.   	}
    492.   
    493. > int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)
    494.   	{
    495.   	unsigned int i, b;

crypto/evp/evp_enc.c:528:3: Assignment
    526.   			}
    527.   		OPENSSL_assert(b <= sizeof ctx->final);
    528.   		pad=ctx->final[b-1];
             ^
    529.   
    530.   		padding_good = (unsigned char)(~constant_time_is_zero_8(pad));

crypto/evp/evp_enc.c:530:35: Call
    528.   		pad=ctx->final[b-1];
    529.   
    530.   		padding_good = (unsigned char)(~constant_time_is_zero_8(pad));
                                             ^
    531.   		padding_good &= constant_time_ge_8(b, pad);
    532.   

crypto/constant_time_locl.h:170:1: Parameter `a`
      168.   	}
      169.   
      170. > static inline unsigned char constant_time_is_zero_8(unsigned int a)
      171.   	{
      172.   	return (unsigned char)(constant_time_is_zero(a));

crypto/constant_time_locl.h:172:25: Call
      170.   static inline unsigned char constant_time_is_zero_8(unsigned int a)
      171.   	{
      172.   	return (unsigned char)(constant_time_is_zero(a));
                                     ^
      173.   	}
      174.   

crypto/constant_time_locl.h:165:1: <LHS trace>
163.   	}
164.   
165. > static inline unsigned int constant_time_is_zero(unsigned int a)
166.   	{
167.   	return constant_time_msb(~a & (a - 1));

crypto/constant_time_locl.h:165:1: Parameter `a`
        163.   	}
        164.   
        165. > static inline unsigned int constant_time_is_zero(unsigned int a)
        166.   	{
        167.   	return constant_time_msb(~a & (a - 1));

crypto/constant_time_locl.h:167:9: Binary operation: ([0, +oo] - 1):unsigned32 by call to `EVP_DecryptFinal` 
        165.   static inline unsigned int constant_time_is_zero(unsigned int a)
        166.   	{
        167.   	return constant_time_msb(~a & (a - 1));
                       ^
        168.   	}
        169.   

static inline unsigned int constant_time_is_zero(unsigned int a)
	{
	return constant_time_msb(~a & (a - 1));
	}
['static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,\n\t\t\t\tconst unsigned char *sess_id, int sesslen,\n\t\t\t\tSSL_SESSION **psess)\n\t{\n\tSSL_SESSION *sess;\n\tunsigned char *sdec;\n\tconst unsigned char *p;\n\tint slen, mlen, renew_ticket = 0;\n\tunsigned char tick_hmac[EVP_MAX_MD_SIZE];\n\tHMAC_CTX hctx;\n\tEVP_CIPHER_CTX ctx;\n\tSSL_CTX *tctx = s->initial_ctx;\n\tif (eticklen < 48)\n\t\treturn 2;\n\tHMAC_CTX_init(&hctx);\n\tEVP_CIPHER_CTX_init(&ctx);\n\tif (tctx->tlsext_ticket_key_cb)\n\t\t{\n\t\tunsigned char *nctick = (unsigned char *)etick;\n\t\tint rv = tctx->tlsext_ticket_key_cb(s, nctick, nctick + 16,\n\t\t\t\t\t\t\t&ctx, &hctx, 0);\n\t\tif (rv < 0)\n\t\t\treturn -1;\n\t\tif (rv == 0)\n\t\t\treturn 2;\n\t\tif (rv == 2)\n\t\t\trenew_ticket = 1;\n\t\t}\n\telse\n\t\t{\n\t\tif (memcmp(etick, tctx->tlsext_tick_key_name, 16))\n\t\t\treturn 2;\n\t\tHMAC_Init_ex(&hctx, tctx->tlsext_tick_hmac_key, 16,\n\t\t\t\t\ttlsext_tick_md(), NULL);\n\t\tEVP_DecryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL,\n\t\t\t\ttctx->tlsext_tick_aes_key, etick + 16);\n\t\t}\n\tmlen = HMAC_size(&hctx);\n\tif (mlen < 0)\n\t\t{\n\t\tEVP_CIPHER_CTX_cleanup(&ctx);\n\t\treturn -1;\n\t\t}\n\teticklen -= mlen;\n\tHMAC_Update(&hctx, etick, eticklen);\n\tHMAC_Final(&hctx, tick_hmac, NULL);\n\tHMAC_CTX_cleanup(&hctx);\n\tif (CRYPTO_memcmp(tick_hmac, etick + eticklen, mlen))\n\t\treturn 2;\n\tp = etick + 16 + EVP_CIPHER_CTX_iv_length(&ctx);\n\teticklen -= 16 + EVP_CIPHER_CTX_iv_length(&ctx);\n\tsdec = OPENSSL_malloc(eticklen);\n\tif (!sdec)\n\t\t{\n\t\tEVP_CIPHER_CTX_cleanup(&ctx);\n\t\treturn -1;\n\t\t}\n\tEVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);\n\tif (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)\n\t\t{\n\t\tEVP_CIPHER_CTX_cleanup(&ctx);\n\t\tOPENSSL_free(sdec);\n\t\treturn 2;\n\t\t}\n\tslen += mlen;\n\tEVP_CIPHER_CTX_cleanup(&ctx);\n\tp = sdec;\n\tsess = d2i_SSL_SESSION(NULL, &p, slen);\n\tOPENSSL_free(sdec);\n\tif (sess)\n\t\t{\n\t\tif (sesslen)\n\t\t\tmemcpy(sess->session_id, sess_id, sesslen);\n\t\tsess->session_id_length = sesslen;\n\t\t*psess = sess;\n\t\tif (renew_ticket)\n\t\t\treturn 4;\n\t\telse\n\t\t\treturn 3;\n\t\t}\n        ERR_clear_error();\n\treturn 2;\n\t}', 'int EVP_DecryptUpdate(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl,\n\t     const unsigned char *in, int inl)\n\t{\n\tint fix_len;\n\tunsigned int b;\n\tif (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER)\n\t\t{\n\t\tfix_len = ctx->cipher->do_cipher(ctx, out, in, inl);\n\t\tif (fix_len < 0)\n\t\t\t{\n\t\t\t*outl = 0;\n\t\t\treturn 0;\n\t\t\t}\n\t\telse\n\t\t\t*outl = fix_len;\n\t\treturn 1;\n\t\t}\n\tif (inl <= 0)\n\t\t{\n\t\t*outl = 0;\n\t\treturn inl == 0;\n\t\t}\n\tif (ctx->flags & EVP_CIPH_NO_PADDING)\n\t\treturn EVP_EncryptUpdate(ctx, out, outl, in, inl);\n\tb=ctx->cipher->block_size;\n\tOPENSSL_assert(b <= sizeof ctx->final);\n\tif(ctx->final_used)\n\t\t{\n\t\tmemcpy(out,ctx->final,b);\n\t\tout+=b;\n\t\tfix_len = 1;\n\t\t}\n\telse\n\t\tfix_len = 0;\n\tif(!EVP_EncryptUpdate(ctx,out,outl,in,inl))\n\t\treturn 0;\n\tif (b > 1 && !ctx->buf_len)\n\t\t{\n\t\t*outl-=b;\n\t\tctx->final_used=1;\n\t\tmemcpy(ctx->final,&out[*outl],b);\n\t\t}\n\telse\n\t\tctx->final_used = 0;\n\tif (fix_len)\n\t\t*outl += b;\n\treturn 1;\n\t}', 'int EVP_DecryptFinal(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)\n\t{\n\tint ret;\n\tret = EVP_DecryptFinal_ex(ctx, out, outl);\n\treturn ret;\n\t}', 'int EVP_DecryptFinal_ex(EVP_CIPHER_CTX *ctx, unsigned char *out, int *outl)\n\t{\n\tunsigned int i, b;\n        unsigned char pad, padding_good;\n\t*outl=0;\n\tif (ctx->cipher->flags & EVP_CIPH_FLAG_CUSTOM_CIPHER)\n\t\t{\n\t\tint ret = ctx->cipher->do_cipher(ctx, out, NULL, 0);\n\t\tif (ret < 0)\n\t\t\treturn 0;\n\t\telse\n\t\t\t*outl = ret;\n\t\treturn 1;\n\t\t}\n\tb=(unsigned int)(ctx->cipher->block_size);\n\tif (ctx->flags & EVP_CIPH_NO_PADDING)\n\t\t{\n\t\tif(ctx->buf_len)\n\t\t\t{\n\t\t\tEVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH);\n\t\t\treturn 0;\n\t\t\t}\n\t\t*outl = 0;\n\t\treturn 1;\n\t\t}\n\tif (b > 1)\n\t\t{\n\t\tif (ctx->buf_len || !ctx->final_used)\n\t\t\t{\n\t\t\tEVPerr(EVP_F_EVP_DECRYPTFINAL_EX,EVP_R_WRONG_FINAL_BLOCK_LENGTH);\n\t\t\treturn(0);\n\t\t\t}\n\t\tOPENSSL_assert(b <= sizeof ctx->final);\n\t\tpad=ctx->final[b-1];\n\t\tpadding_good = (unsigned char)(~constant_time_is_zero_8(pad));\n\t\tpadding_good &= constant_time_ge_8(b, pad);\n                for (i = 1; i < b; ++i)\n\t\t\t{\n\t\t\tunsigned char is_pad_index = constant_time_lt_8(i, pad);\n\t\t\tunsigned char pad_byte_good = constant_time_eq_8(ctx->final[b-i-1], pad);\n\t\t\tpadding_good &= constant_time_select_8(is_pad_index, pad_byte_good, 0xff);\n\t\t\t}\n\t\tfor (i = 0; i < b - 1; ++i)\n\t\t\tout[i] = ctx->final[i] & padding_good;\n\t\t*outl = padding_good & ((unsigned char)(b - pad));\n\t\treturn padding_good & 1;\n\t\t}\n\telse\n\t\t{\n\t\t*outl = 0;\n\t\treturn 1;\n\t\t}\n\t}', 'static inline unsigned char constant_time_is_zero_8(unsigned int a)\n\t{\n\treturn (unsigned char)(constant_time_is_zero(a));\n\t}', 'static inline unsigned int constant_time_is_zero(unsigned int a)\n\t{\n\treturn constant_time_msb(~a & (a - 1));\n\t}']