crypto/rsa/rsa_ossl.c:468: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `RSA_padding_check_PKCS1_type_2`.
Showing all 8 steps of the trace


crypto/rsa/rsa_ossl.c:403:9: Call
401.   
402.       /* make data into a big number */
403.       if (BN_bin2bn(from, (int)flen, f) == NULL)
               ^
404.           goto err;
405.   

crypto/bn/bn_lib.c:372:1: Parameter `*ret->d`
  370.   }
  371.   
  372. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
  373.   {
  374.       unsigned int i, m;

crypto/rsa/rsa_ossl.c:468:13: Call
466.       switch (padding) {
467.       case RSA_PKCS1_PADDING:
468.           r = RSA_padding_check_PKCS1_type_2(to, num, buf, j, num);
                   ^
469.           break;
470.       case RSA_PKCS1_OAEP_PADDING:

crypto/rsa/rsa_pk1.c:154:1: Parameter `*from`
  152.   }
  153.   
  154. > int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen,
  155.                                      const unsigned char *from, int flen,
  156.                                      int num)

crypto/rsa/rsa_pk1.c:196:12: Call
  194.       }
  195.   
  196.       good = constant_time_is_zero(from[0]);
                    ^
  197.       good &= constant_time_eq(from[1], 2);
  198.   

include/internal/constant_time_locl.h:164:1: <LHS trace>
162.   }
163.   
164. > static ossl_inline unsigned int constant_time_is_zero(unsigned int a)
165.   {
166.       return constant_time_msb(~a & (a - 1));

include/internal/constant_time_locl.h:164:1: Parameter `a`
    162.   }
    163.   
    164. > static ossl_inline unsigned int constant_time_is_zero(unsigned int a)
    165.   {
    166.       return constant_time_msb(~a & (a - 1));

include/internal/constant_time_locl.h:166:12: Binary operation: ([0, +oo] - 1):unsigned32 by call to `RSA_padding_check_PKCS1_type_2` 
    164.   static ossl_inline unsigned int constant_time_is_zero(unsigned int a)
    165.   {
    166.       return constant_time_msb(~a & (a - 1));
                      ^
    167.   }
    168.   

static ossl_inline unsigned int constant_time_is_zero(unsigned int a)
{
    return constant_time_msb(~a & (a - 1));
}
['static int rsa_ossl_private_decrypt(int flen, const unsigned char *from,\n                                   unsigned char *to, RSA *rsa, int padding)\n{\n    BIGNUM *f, *ret;\n    int j, num = 0, r = -1;\n    unsigned char *buf = NULL;\n    BN_CTX *ctx = NULL;\n    int local_blinding = 0;\n    BIGNUM *unblind = NULL;\n    BN_BLINDING *blinding = NULL;\n    if ((ctx = BN_CTX_new()) == NULL)\n        goto err;\n    BN_CTX_start(ctx);\n    f = BN_CTX_get(ctx);\n    ret = BN_CTX_get(ctx);\n    num = BN_num_bytes(rsa->n);\n    buf = OPENSSL_malloc(num);\n    if (ret == NULL || buf == NULL) {\n        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    if (flen > num) {\n        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT,\n               RSA_R_DATA_GREATER_THAN_MOD_LEN);\n        goto err;\n    }\n    if (BN_bin2bn(from, (int)flen, f) == NULL)\n        goto err;\n    if (BN_ucmp(f, rsa->n) >= 0) {\n        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT,\n               RSA_R_DATA_TOO_LARGE_FOR_MODULUS);\n        goto err;\n    }\n    if (!(rsa->flags & RSA_FLAG_NO_BLINDING)) {\n        blinding = rsa_get_blinding(rsa, &local_blinding, ctx);\n        if (blinding == NULL) {\n            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n    }\n    if (blinding != NULL) {\n        if (!local_blinding && ((unblind = BN_CTX_get(ctx)) == NULL)) {\n            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        if (!rsa_blinding_convert(blinding, f, unblind, ctx))\n            goto err;\n    }\n    if ((rsa->flags & RSA_FLAG_EXT_PKEY) ||\n        (rsa->version == RSA_ASN1_VERSION_MULTI) ||\n        ((rsa->p != NULL) &&\n         (rsa->q != NULL) &&\n         (rsa->dmp1 != NULL) && (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) {\n        if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx))\n            goto err;\n    } else {\n        BIGNUM *d = BN_new();\n        if (d == NULL) {\n            RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        BN_with_flags(d, rsa->d, BN_FLG_CONSTTIME);\n        if (rsa->flags & RSA_FLAG_CACHE_PUBLIC)\n            if (!BN_MONT_CTX_set_locked\n                (&rsa->_method_mod_n, rsa->lock, rsa->n, ctx)) {\n                BN_free(d);\n                goto err;\n            }\n        if (!rsa->meth->bn_mod_exp(ret, f, d, rsa->n, ctx,\n                                   rsa->_method_mod_n)) {\n            BN_free(d);\n            goto err;\n        }\n        BN_free(d);\n    }\n    if (blinding)\n        if (!rsa_blinding_invert(blinding, ret, unblind, ctx))\n            goto err;\n    j = BN_bn2binpad(ret, buf, num);\n    switch (padding) {\n    case RSA_PKCS1_PADDING:\n        r = RSA_padding_check_PKCS1_type_2(to, num, buf, j, num);\n        break;\n    case RSA_PKCS1_OAEP_PADDING:\n        r = RSA_padding_check_PKCS1_OAEP(to, num, buf, j, num, NULL, 0);\n        break;\n    case RSA_SSLV23_PADDING:\n        r = RSA_padding_check_SSLv23(to, num, buf, j, num);\n        break;\n    case RSA_NO_PADDING:\n        memcpy(to, buf, (r = j));\n        break;\n    default:\n        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, RSA_R_UNKNOWN_PADDING_TYPE);\n        goto err;\n    }\n    if (r < 0)\n        RSAerr(RSA_F_RSA_OSSL_PRIVATE_DECRYPT, RSA_R_PADDING_CHECK_FAILED);\n err:\n    if (ctx != NULL)\n        BN_CTX_end(ctx);\n    BN_CTX_free(ctx);\n    OPENSSL_clear_free(buf, num);\n    return r;\n}', 'BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)\n{\n    unsigned int i, m;\n    unsigned int n;\n    BN_ULONG l;\n    BIGNUM *bn = NULL;\n    if (ret == NULL)\n        ret = bn = BN_new();\n    if (ret == NULL)\n        return NULL;\n    bn_check_top(ret);\n    for ( ; len > 0 && *s == 0; s++, len--)\n        continue;\n    n = len;\n    if (n == 0) {\n        ret->top = 0;\n        return ret;\n    }\n    i = ((n - 1) / BN_BYTES) + 1;\n    m = ((n - 1) % (BN_BYTES));\n    if (bn_wexpand(ret, (int)i) == NULL) {\n        BN_free(bn);\n        return NULL;\n    }\n    ret->top = i;\n    ret->neg = 0;\n    l = 0;\n    while (n--) {\n        l = (l << 8L) | *(s++);\n        if (m-- == 0) {\n            ret->d[--i] = l;\n            l = 0;\n            m = BN_BYTES - 1;\n        }\n    }\n    bn_correct_top(ret);\n    return ret;\n}', 'int RSA_padding_check_PKCS1_type_2(unsigned char *to, int tlen,\n                                   const unsigned char *from, int flen,\n                                   int num)\n{\n    int i;\n    unsigned char *em = NULL;\n    unsigned int good, found_zero_byte;\n    int zero_index = 0, msg_index, mlen = -1;\n    if (tlen < 0 || flen < 0)\n        return -1;\n    if (flen > num)\n        goto err;\n    if (num < 11)\n        goto err;\n    if (flen != num) {\n        em = OPENSSL_zalloc(num);\n        if (em == NULL) {\n            RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2, ERR_R_MALLOC_FAILURE);\n            return -1;\n        }\n        memcpy(em + num - flen, from, flen);\n        from = em;\n    }\n    good = constant_time_is_zero(from[0]);\n    good &= constant_time_eq(from[1], 2);\n    found_zero_byte = 0;\n    for (i = 2; i < num; i++) {\n        unsigned int equals0 = constant_time_is_zero(from[i]);\n        zero_index =\n            constant_time_select_int(~found_zero_byte & equals0, i,\n                                     zero_index);\n        found_zero_byte |= equals0;\n    }\n    good &= constant_time_ge((unsigned int)(zero_index), 2 + 8);\n    msg_index = zero_index + 1;\n    mlen = num - msg_index;\n    good &= constant_time_ge((unsigned int)(tlen), (unsigned int)(mlen));\n    if (!good) {\n        mlen = -1;\n        goto err;\n    }\n    memcpy(to, from + msg_index, mlen);\n err:\n    OPENSSL_clear_free(em, num);\n    if (mlen == -1)\n        RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_TYPE_2,\n               RSA_R_PKCS_DECODING_ERROR);\n    return mlen;\n}', 'static ossl_inline unsigned int constant_time_is_zero(unsigned int a)\n{\n    return constant_time_msb(~a & (a - 1));\n}']