crypto/bn/bn_mul.c:687: error: INTEGER_OVERFLOW_L2
  ([0, 4294967295] + [0, max(4294967295, `*r`)]):unsigned32 by call to `bn_add_words`.
Showing all 13 steps of the trace


crypto/bn/bn_mul.c:550:1: Parameter `*r`
548.    * t needs to be n*4 is size, as does r */
549.   /* tnX may not be negative but less than n */
550. > void bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n,
551.   	     int tna, int tnb, BN_ULONG *t)
552.   	{

crypto/bn/bn_mul.c:626:3: Call
624.   		p= &(t[n2*2]);
625.   		bn_mul_recursive(&(t[n2]),t,&(t[n]),n,0,0,p);
626.   		bn_mul_recursive(r,a,b,n,0,0,p);
         ^
627.   		i=n/2;
628.   		/* If there is only a bottom half to the number,

crypto/bn/bn_mul.c:525:6: Call
  523.   	 * c1 holds the carry bits
  524.   	 */
  525.   	c1+=bn_add_words(&(r[n]),&(r[n]),&(t[n2]),n2);
              ^
  526.   	if (c1)
  527.   		{

crypto/bn/bn_asm.c:346:14: Assignment
    344.   
    345.   	assert(n >= 0);
    346.   	if (n <= 0) return((BN_ULONG)0);
                        ^
    347.   
    348.   	c=0;

crypto/bn/bn_mul.c:525:2: Assignment
  523.   	 * c1 holds the carry bits
  524.   	 */
  525.   	c1+=bn_add_words(&(r[n]),&(r[n]),&(t[n2]),n2);
          ^
  526.   	if (c1)
  527.   		{

crypto/bn/bn_mul.c:530:3: Assignment
  528.   		p= &(r[n+n2]);
  529.   		lo= *p;
  530.   		ln=(lo+c1)&BN_MASK2;
           ^
  531.   		*p=ln;
  532.   

crypto/bn/bn_mul.c:531:3: Assignment
  529.   		lo= *p;
  530.   		ln=(lo+c1)&BN_MASK2;
  531.   		*p=ln;
           ^
  532.   
  533.   		/* The overflow will stop before we over write

crypto/bn/bn_mul.c:687:11: Call
685.   	 */
686.   
687.   	c1=(int)(bn_add_words(t,r,&(r[n2]),n2));
                 ^
688.   
689.   	if (neg) /* if t[32] is negative */

crypto/bn/bn_asm.c:348:2: <LHS trace>
346.   	if (n <= 0) return((BN_ULONG)0);
347.   
348.   	c=0;
        ^
349.   #ifndef OPENSSL_SMALL_FOOTPRINT
350.   	while (n&~3)

crypto/bn/bn_asm.c:348:2: Assignment
  346.   	if (n <= 0) return((BN_ULONG)0);
  347.   
  348.   	c=0;
          ^
  349.   #ifndef OPENSSL_SMALL_FOOTPRINT
  350.   	while (n&~3)

crypto/bn/bn_asm.c:341:1: <RHS trace>
339.   	}
340.   #else /* !BN_LLONG */
341. > BN_ULONG bn_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b, size_t n)
342.           {
343.   	BN_ULONG c,l,t;

crypto/bn/bn_asm.c:341:1: Parameter `*b`
  339.   	}
  340.   #else /* !BN_LLONG */
  341. > BN_ULONG bn_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b, size_t n)
  342.           {
  343.   	BN_ULONG c,l,t;

crypto/bn/bn_asm.c:355:3: Binary operation: ([0, 4294967295] + [0, max(4294967295, *r)]):unsigned32 by call to `bn_add_words` 
  353.   		t=(t+c)&BN_MASK2;
  354.   		c=(t < c);
  355.   		l=(t+b[0])&BN_MASK2;
           ^
  356.   		c+=(l < t);
  357.   		r[0]=l;

BN_ULONG bn_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b, size_t n)
        {
	BN_ULONG c,l,t;
	assert(n >= 0);
	if (n <= 0) return((BN_ULONG)0);
	c=0;
#ifndef OPENSSL_SMALL_FOOTPRINT
	while (n&~3)
		{
		t=a[0];
		t=(t+c)&BN_MASK2;
		c=(t < c);
		l=(t+b[0])&BN_MASK2;
		c+=(l < t);
		r[0]=l;
		t=a[1];
		t=(t+c)&BN_MASK2;
		c=(t < c);
		l=(t+b[1])&BN_MASK2;
		c+=(l < t);
		r[1]=l;
		t=a[2];
		t=(t+c)&BN_MASK2;
		c=(t < c);
		l=(t+b[2])&BN_MASK2;
		c+=(l < t);
		r[2]=l;
		t=a[3];
		t=(t+c)&BN_MASK2;
		c=(t < c);
		l=(t+b[3])&BN_MASK2;
		c+=(l < t);
		r[3]=l;
		a+=4; b+=4; r+=4; n-=4;
		}
#endif
	while(n)
		{
		t=a[0];
		t=(t+c)&BN_MASK2;
		c=(t < c);
		l=(t+b[0])&BN_MASK2;
		c+=(l < t);
		r[0]=l;
		a++; b++; r++; n--;
		}
	return((BN_ULONG)c);
	}
['void bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n,\n\t     int tna, int tnb, BN_ULONG *t)\n\t{\n\tint i,j,n2=n*2;\n\tint c1,c2,neg,zero;\n\tBN_ULONG ln,lo,*p;\n# ifdef BN_COUNT\n\tfprintf(stderr," bn_mul_part_recursive (%d%+d) * (%d%+d)\\n",\n\t\tn, tna, n, tnb);\n# endif\n\tif (n < 8)\n\t\t{\n\t\tbn_mul_normal(r,a,n+tna,b,n+tnb);\n\t\treturn;\n\t\t}\n\tc1=bn_cmp_part_words(a,&(a[n]),tna,n-tna);\n\tc2=bn_cmp_part_words(&(b[n]),b,tnb,tnb-n);\n\tzero=neg=0;\n\tswitch (c1*3+c2)\n\t\t{\n\tcase -4:\n\t\tbn_sub_part_words(t,      &(a[n]),a,      tna,tna-n);\n\t\tbn_sub_part_words(&(t[n]),b,      &(b[n]),tnb,n-tnb);\n\t\tbreak;\n\tcase -3:\n\t\tzero=1;\n\tcase -2:\n\t\tbn_sub_part_words(t,      &(a[n]),a,      tna,tna-n);\n\t\tbn_sub_part_words(&(t[n]),&(b[n]),b,      tnb,tnb-n);\n\t\tneg=1;\n\t\tbreak;\n\tcase -1:\n\tcase 0:\n\tcase 1:\n\t\tzero=1;\n\tcase 2:\n\t\tbn_sub_part_words(t,      a,      &(a[n]),tna,n-tna);\n\t\tbn_sub_part_words(&(t[n]),b,      &(b[n]),tnb,n-tnb);\n\t\tneg=1;\n\t\tbreak;\n\tcase 3:\n\t\tzero=1;\n\tcase 4:\n\t\tbn_sub_part_words(t,      a,      &(a[n]),tna,n-tna);\n\t\tbn_sub_part_words(&(t[n]),&(b[n]),b,      tnb,tnb-n);\n\t\tbreak;\n\t\t}\n# if 0\n\tif (n == 4)\n\t\t{\n\t\tbn_mul_comba4(&(t[n2]),t,&(t[n]));\n\t\tbn_mul_comba4(r,a,b);\n\t\tbn_mul_normal(&(r[n2]),&(a[n]),tn,&(b[n]),tn);\n\t\tmemset(&(r[n2+tn*2]),0,sizeof(BN_ULONG)*(n2-tn*2));\n\t\t}\n\telse\n# endif\n\tif (n == 8)\n\t\t{\n\t\tbn_mul_comba8(&(t[n2]),t,&(t[n]));\n\t\tbn_mul_comba8(r,a,b);\n\t\tbn_mul_normal(&(r[n2]),&(a[n]),tna,&(b[n]),tnb);\n\t\tmemset(&(r[n2+tna+tnb]),0,sizeof(BN_ULONG)*(n2-tna-tnb));\n\t\t}\n\telse\n\t\t{\n\t\tp= &(t[n2*2]);\n\t\tbn_mul_recursive(&(t[n2]),t,&(t[n]),n,0,0,p);\n\t\tbn_mul_recursive(r,a,b,n,0,0,p);\n\t\ti=n/2;\n\t\tif (tna > tnb)\n\t\t\tj = tna - i;\n\t\telse\n\t\t\tj = tnb - i;\n\t\tif (j == 0)\n\t\t\t{\n\t\t\tbn_mul_recursive(&(r[n2]),&(a[n]),&(b[n]),\n\t\t\t\ti,tna-i,tnb-i,p);\n\t\t\tmemset(&(r[n2+i*2]),0,sizeof(BN_ULONG)*(n2-i*2));\n\t\t\t}\n\t\telse if (j > 0)\n\t\t\t\t{\n\t\t\t\tbn_mul_part_recursive(&(r[n2]),&(a[n]),&(b[n]),\n\t\t\t\t\ti,tna-i,tnb-i,p);\n\t\t\t\tmemset(&(r[n2+tna+tnb]),0,\n\t\t\t\t\tsizeof(BN_ULONG)*(n2-tna-tnb));\n\t\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tmemset(&(r[n2]),0,sizeof(BN_ULONG)*n2);\n\t\t\tif (tna < BN_MUL_RECURSIVE_SIZE_NORMAL\n\t\t\t\t&& tnb < BN_MUL_RECURSIVE_SIZE_NORMAL)\n\t\t\t\t{\n\t\t\t\tbn_mul_normal(&(r[n2]),&(a[n]),tna,&(b[n]),tnb);\n\t\t\t\t}\n\t\t\telse\n\t\t\t\t{\n\t\t\t\tfor (;;)\n\t\t\t\t\t{\n\t\t\t\t\ti/=2;\n\t\t\t\t\tif (i < tna || i < tnb)\n\t\t\t\t\t\t{\n\t\t\t\t\t\tbn_mul_part_recursive(&(r[n2]),\n\t\t\t\t\t\t\t&(a[n]),&(b[n]),\n\t\t\t\t\t\t\ti,tna-i,tnb-i,p);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t}\n\t\t\t\t\telse if (i == tna || i == tnb)\n\t\t\t\t\t\t{\n\t\t\t\t\t\tbn_mul_recursive(&(r[n2]),\n\t\t\t\t\t\t\t&(a[n]),&(b[n]),\n\t\t\t\t\t\t\ti,tna-i,tnb-i,p);\n\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\tc1=(int)(bn_add_words(t,r,&(r[n2]),n2));\n\tif (neg)\n\t\t{\n\t\tc1-=(int)(bn_sub_words(&(t[n2]),t,&(t[n2]),n2));\n\t\t}\n\telse\n\t\t{\n\t\tc1+=(int)(bn_add_words(&(t[n2]),&(t[n2]),t,n2));\n\t\t}\n\tc1+=(int)(bn_add_words(&(r[n]),&(r[n]),&(t[n2]),n2));\n\tif (c1)\n\t\t{\n\t\tp= &(r[n+n2]);\n\t\tlo= *p;\n\t\tln=(lo+c1)&BN_MASK2;\n\t\t*p=ln;\n\t\tif (ln < (BN_ULONG)c1)\n\t\t\t{\n\t\t\tdo\t{\n\t\t\t\tp++;\n\t\t\t\tlo= *p;\n\t\t\t\tln=(lo+1)&BN_MASK2;\n\t\t\t\t*p=ln;\n\t\t\t\t} while (ln == 0);\n\t\t\t}\n\t\t}\n\t}', 'void bn_mul_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, size_t n2,\n\t\t      int dna, int dnb, BN_ULONG *t)\n\t{\n\tint n=n2/2,c1,c2;\n\tint tna=n+dna, tnb=n+dnb;\n\tunsigned int neg,zero;\n\tBN_ULONG ln,lo,*p;\n# ifdef BN_COUNT\n\tfprintf(stderr," bn_mul_recursive %d%+d * %d%+d\\n",n2,dna,n2,dnb);\n# endif\n# ifdef BN_MUL_COMBA\n#  if 0\n\tif (n2 == 4)\n\t\t{\n\t\tbn_mul_comba4(r,a,b);\n\t\treturn;\n\t\t}\n#  endif\n\tif (n2 == 8 && dna == 0 && dnb == 0)\n\t\t{\n\t\tbn_mul_comba8(r,a,b);\n\t\treturn;\n\t\t}\n# endif\n\tif (n2 < BN_MUL_RECURSIVE_SIZE_NORMAL)\n\t\t{\n\t\tbn_mul_normal(r,a,n2+dna,b,n2+dnb);\n\t\tif ((dna + dnb) < 0)\n\t\t\tmemset(&r[2*n2 + dna + dnb], 0,\n\t\t\t\tsizeof(BN_ULONG) * -(dna + dnb));\n\t\treturn;\n\t\t}\n\tc1=bn_cmp_part_words(a,&(a[n]),tna,n-tna);\n\tc2=bn_cmp_part_words(&(b[n]),b,tnb,tnb-n);\n\tzero=neg=0;\n\tswitch (c1*3+c2)\n\t\t{\n\tcase -4:\n\t\tbn_sub_part_words(t,      &(a[n]),a,      tna,tna-n);\n\t\tbn_sub_part_words(&(t[n]),b,      &(b[n]),tnb,n-tnb);\n\t\tbreak;\n\tcase -3:\n\t\tzero=1;\n\t\tbreak;\n\tcase -2:\n\t\tbn_sub_part_words(t,      &(a[n]),a,      tna,tna-n);\n\t\tbn_sub_part_words(&(t[n]),&(b[n]),b,      tnb,tnb-n);\n\t\tneg=1;\n\t\tbreak;\n\tcase -1:\n\tcase 0:\n\tcase 1:\n\t\tzero=1;\n\t\tbreak;\n\tcase 2:\n\t\tbn_sub_part_words(t,      a,      &(a[n]),tna,n-tna);\n\t\tbn_sub_part_words(&(t[n]),b,      &(b[n]),tnb,n-tnb);\n\t\tneg=1;\n\t\tbreak;\n\tcase 3:\n\t\tzero=1;\n\t\tbreak;\n\tcase 4:\n\t\tbn_sub_part_words(t,      a,      &(a[n]),tna,n-tna);\n\t\tbn_sub_part_words(&(t[n]),&(b[n]),b,      tnb,tnb-n);\n\t\tbreak;\n\t\t}\n# ifdef BN_MUL_COMBA\n\tif (n == 4 && dna == 0 && dnb == 0)\n\t\t{\n\t\tif (!zero)\n\t\t\tbn_mul_comba4(&(t[n2]),t,&(t[n]));\n\t\telse\n\t\t\tmemset(&(t[n2]),0,8*sizeof(BN_ULONG));\n\t\tbn_mul_comba4(r,a,b);\n\t\tbn_mul_comba4(&(r[n2]),&(a[n]),&(b[n]));\n\t\t}\n\telse if (n == 8 && dna == 0 && dnb == 0)\n\t\t{\n\t\tif (!zero)\n\t\t\tbn_mul_comba8(&(t[n2]),t,&(t[n]));\n\t\telse\n\t\t\tmemset(&(t[n2]),0,16*sizeof(BN_ULONG));\n\t\tbn_mul_comba8(r,a,b);\n\t\tbn_mul_comba8(&(r[n2]),&(a[n]),&(b[n]));\n\t\t}\n\telse\n# endif\n\t\t{\n\t\tp= &(t[n2*2]);\n\t\tif (!zero)\n\t\t\tbn_mul_recursive(&(t[n2]),t,&(t[n]),n,0,0,p);\n\t\telse\n\t\t\tmemset(&(t[n2]),0,n2*sizeof(BN_ULONG));\n\t\tbn_mul_recursive(r,a,b,n,0,0,p);\n\t\tbn_mul_recursive(&(r[n2]),&(a[n]),&(b[n]),n,dna,dnb,p);\n\t\t}\n\tc1=bn_add_words(t,r,&(r[n2]),n2);\n\tif (neg)\n\t\t{\n\t\tc1-=bn_sub_words(&(t[n2]),t,&(t[n2]),n2);\n\t\t}\n\telse\n\t\t{\n\t\tc1+=bn_add_words(&(t[n2]),&(t[n2]),t,n2);\n\t\t}\n\tc1+=bn_add_words(&(r[n]),&(r[n]),&(t[n2]),n2);\n\tif (c1)\n\t\t{\n\t\tp= &(r[n+n2]);\n\t\tlo= *p;\n\t\tln=(lo+c1)&BN_MASK2;\n\t\t*p=ln;\n\t\tif (ln < (BN_ULONG)c1)\n\t\t\t{\n\t\t\tdo\t{\n\t\t\t\tp++;\n\t\t\t\tlo= *p;\n\t\t\t\tln=(lo+1)&BN_MASK2;\n\t\t\t\t*p=ln;\n\t\t\t\t} while (ln == 0);\n\t\t\t}\n\t\t}\n\t}', 'BN_ULONG bn_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b, size_t n)\n        {\n\tBN_ULONG c,l,t;\n\tassert(n >= 0);\n\tif (n <= 0) return((BN_ULONG)0);\n\tc=0;\n#ifndef OPENSSL_SMALL_FOOTPRINT\n\twhile (n&~3)\n\t\t{\n\t\tt=a[0];\n\t\tt=(t+c)&BN_MASK2;\n\t\tc=(t < c);\n\t\tl=(t+b[0])&BN_MASK2;\n\t\tc+=(l < t);\n\t\tr[0]=l;\n\t\tt=a[1];\n\t\tt=(t+c)&BN_MASK2;\n\t\tc=(t < c);\n\t\tl=(t+b[1])&BN_MASK2;\n\t\tc+=(l < t);\n\t\tr[1]=l;\n\t\tt=a[2];\n\t\tt=(t+c)&BN_MASK2;\n\t\tc=(t < c);\n\t\tl=(t+b[2])&BN_MASK2;\n\t\tc+=(l < t);\n\t\tr[2]=l;\n\t\tt=a[3];\n\t\tt=(t+c)&BN_MASK2;\n\t\tc=(t < c);\n\t\tl=(t+b[3])&BN_MASK2;\n\t\tc+=(l < t);\n\t\tr[3]=l;\n\t\ta+=4; b+=4; r+=4; n-=4;\n\t\t}\n#endif\n\twhile(n)\n\t\t{\n\t\tt=a[0];\n\t\tt=(t+c)&BN_MASK2;\n\t\tc=(t < c);\n\t\tl=(t+b[0])&BN_MASK2;\n\t\tc+=(l < t);\n\t\tr[0]=l;\n\t\ta++; b++; r++; n--;\n\t\t}\n\treturn((BN_ULONG)c);\n\t}']