crypto/ec/ecdh_ossl.c:190: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `BN_CTX_end`.
Showing all 8 steps of the trace


crypto/ec/ecdh_ossl.c:109:5: Call
107.       if ((ctx = BN_CTX_new()) == NULL)
108.           goto err;
109.       BN_CTX_start(ctx);
           ^
110.       x = BN_CTX_get(ctx);
111.       y = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:236:1: Parameter `ctx->stack.depth`
  234.   }
  235.   
  236. > void BN_CTX_start(BN_CTX *ctx)
  237.   {
  238.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/ec/ecdh_ossl.c:190:9: Call
188.       EC_POINT_free(tmp);
189.       if (ctx)
190.           BN_CTX_end(ctx);
               ^
191.       BN_CTX_free(ctx);
192.       OPENSSL_free(buf);

crypto/bn/bn_ctx.c:250:1: Parameter `ctx->stack.depth`
  248.   }
  249.   
  250. > void BN_CTX_end(BN_CTX *ctx)
  251.   {
  252.       CTXDBG_ENTRY("BN_CTX_end", ctx);

crypto/bn/bn_ctx.c:256:27: Call
  254.           ctx->err_stack--;
  255.       else {
  256.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                   ^
  257.           /* Does this stack frame have anything to release? */
  258.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:326:1: <LHS trace>
324.   }
325.   
326. > static unsigned int BN_STACK_pop(BN_STACK *st)
327.   {
328.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:326:1: Parameter `st->depth`
    324.   }
    325.   
    326. > static unsigned int BN_STACK_pop(BN_STACK *st)
    327.   {
    328.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:328:12: Binary operation: ([0, +oo] - 1):unsigned32 by call to `BN_CTX_end` 
    326.   static unsigned int BN_STACK_pop(BN_STACK *st)
    327.   {
    328.       return st->indexes[--(st->depth)];
                      ^
    329.   }
    330.   

static unsigned int BN_STACK_pop(BN_STACK *st)
{
    return st->indexes[--(st->depth)];
}
['int ossl_ecdh_compute_key(void *out, size_t outlen, const EC_POINT *pub_key,\n                          EC_KEY *ecdh,\n                          void *(*KDF) (const void *in, size_t inlen,\n                                        void *out, size_t *outlen))\n{\n    BN_CTX *ctx;\n    EC_POINT *tmp = NULL;\n    BIGNUM *x = NULL, *y = NULL;\n    const BIGNUM *priv_key;\n    const EC_GROUP *group;\n    int ret = -1;\n    size_t buflen, len;\n    unsigned char *buf = NULL;\n    if (outlen > INT_MAX) {\n        ECerr(EC_F_OSSL_ECDH_COMPUTE_KEY, ERR_R_MALLOC_FAILURE);\n        return -1;\n    }\n    if ((ctx = BN_CTX_new()) == NULL)\n        goto err;\n    BN_CTX_start(ctx);\n    x = BN_CTX_get(ctx);\n    y = BN_CTX_get(ctx);\n    priv_key = EC_KEY_get0_private_key(ecdh);\n    if (priv_key == NULL) {\n        ECerr(EC_F_OSSL_ECDH_COMPUTE_KEY, EC_R_NO_PRIVATE_VALUE);\n        goto err;\n    }\n    group = EC_KEY_get0_group(ecdh);\n    if (EC_KEY_get_flags(ecdh) & EC_FLAG_COFACTOR_ECDH) {\n        if (!EC_GROUP_get_cofactor(group, x, ctx) ||\n            !BN_mul(x, x, priv_key, ctx)) {\n            ECerr(EC_F_OSSL_ECDH_COMPUTE_KEY, ERR_R_MALLOC_FAILURE);\n            goto err;\n        }\n        priv_key = x;\n    }\n    if ((tmp = EC_POINT_new(group)) == NULL) {\n        ECerr(EC_F_OSSL_ECDH_COMPUTE_KEY, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    if (!EC_POINT_mul(group, tmp, NULL, pub_key, priv_key, ctx)) {\n        ECerr(EC_F_OSSL_ECDH_COMPUTE_KEY, EC_R_POINT_ARITHMETIC_FAILURE);\n        goto err;\n    }\n    if (EC_METHOD_get_field_type(EC_GROUP_method_of(group)) ==\n        NID_X9_62_prime_field) {\n        if (!EC_POINT_get_affine_coordinates_GFp(group, tmp, x, y, ctx)) {\n            ECerr(EC_F_OSSL_ECDH_COMPUTE_KEY, EC_R_POINT_ARITHMETIC_FAILURE);\n            goto err;\n        }\n    }\n#ifndef OPENSSL_NO_EC2M\n    else {\n        if (!EC_POINT_get_affine_coordinates_GF2m(group, tmp, x, y, ctx)) {\n            ECerr(EC_F_OSSL_ECDH_COMPUTE_KEY, EC_R_POINT_ARITHMETIC_FAILURE);\n            goto err;\n        }\n    }\n#endif\n    buflen = (EC_GROUP_get_degree(group) + 7) / 8;\n    len = BN_num_bytes(x);\n    if (len > buflen) {\n        ECerr(EC_F_OSSL_ECDH_COMPUTE_KEY, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    if ((buf = OPENSSL_malloc(buflen)) == NULL) {\n        ECerr(EC_F_OSSL_ECDH_COMPUTE_KEY, ERR_R_MALLOC_FAILURE);\n        goto err;\n    }\n    memset(buf, 0, buflen - len);\n    if (len != (size_t)BN_bn2bin(x, buf + buflen - len)) {\n        ECerr(EC_F_OSSL_ECDH_COMPUTE_KEY, ERR_R_BN_LIB);\n        goto err;\n    }\n    if (KDF != 0) {\n        if (KDF(buf, buflen, out, &outlen) == NULL) {\n            ECerr(EC_F_OSSL_ECDH_COMPUTE_KEY, EC_R_KDF_FAILED);\n            goto err;\n        }\n        ret = outlen;\n    } else {\n        if (outlen > buflen)\n            outlen = buflen;\n        memcpy(out, buf, outlen);\n        ret = outlen;\n    }\n err:\n    EC_POINT_free(tmp);\n    if (ctx)\n        BN_CTX_end(ctx);\n    BN_CTX_free(ctx);\n    OPENSSL_free(buf);\n    return (ret);\n}', 'void BN_CTX_start(BN_CTX *ctx)\n{\n    CTXDBG_ENTRY("BN_CTX_start", ctx);\n    if (ctx->err_stack || ctx->too_many)\n        ctx->err_stack++;\n    else if (!BN_STACK_push(&ctx->stack, ctx->used)) {\n        BNerr(BN_F_BN_CTX_START, BN_R_TOO_MANY_TEMPORARY_VARIABLES);\n        ctx->err_stack++;\n    }\n    CTXDBG_EXIT(ctx);\n}', 'void BN_CTX_end(BN_CTX *ctx)\n{\n    CTXDBG_ENTRY("BN_CTX_end", ctx);\n    if (ctx->err_stack)\n        ctx->err_stack--;\n    else {\n        unsigned int fp = BN_STACK_pop(&ctx->stack);\n        if (fp < ctx->used)\n            BN_POOL_release(&ctx->pool, ctx->used - fp);\n        ctx->used = fp;\n        ctx->too_many = 0;\n    }\n    CTXDBG_EXIT(ctx);\n}', 'static unsigned int BN_STACK_pop(BN_STACK *st)\n{\n    return st->indexes[--(st->depth)];\n}']