static ossl_inline unsigned int constant_time_is_zero(unsigned int a)
{
    return constant_time_msb(~a & (a - 1));
}
['static int tls_process_cke_rsa(SSL *s, PACKET *pkt)\n{\n#ifndef OPENSSL_NO_RSA\n    unsigned char rand_premaster_secret[SSL_MAX_MASTER_KEY_LENGTH];\n    int decrypt_len;\n    unsigned char decrypt_good, version_good;\n    size_t j, padding_len;\n    PACKET enc_premaster;\n    RSA *rsa = NULL;\n    unsigned char *rsa_decrypt = NULL;\n    int ret = 0;\n    rsa = EVP_PKEY_get0_RSA(s->cert->pkeys[SSL_PKEY_RSA].privatekey);\n    if (rsa == NULL) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,\n                 SSL_R_MISSING_RSA_CERTIFICATE);\n        return 0;\n    }\n    if (s->version == SSL3_VERSION || s->version == DTLS1_BAD_VER) {\n        enc_premaster = *pkt;\n    } else {\n        if (!PACKET_get_length_prefixed_2(pkt, &enc_premaster)\n            || PACKET_remaining(pkt) != 0) {\n            SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,\n                     SSL_R_LENGTH_MISMATCH);\n            return 0;\n        }\n    }\n    if (RSA_size(rsa) < SSL_MAX_MASTER_KEY_LENGTH) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,\n                 RSA_R_KEY_SIZE_TOO_SMALL);\n        return 0;\n    }\n    rsa_decrypt = OPENSSL_malloc(RSA_size(rsa));\n    if (rsa_decrypt == NULL) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,\n                 ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    if (ssl_randbytes(s, rand_premaster_secret,\n                      sizeof(rand_premaster_secret)) <= 0) {\n        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,\n                 ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    decrypt_len = (int)RSA_private_decrypt((int)PACKET_remaining(&enc_premaster),\n                                           PACKET_data(&enc_premaster),\n                                           rsa_decrypt, rsa, RSA_NO_PADDING);\n    if (decrypt_len < 0) {\n        SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,\n                 ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    if (decrypt_len < 11 + SSL_MAX_MASTER_KEY_LENGTH) {\n        SSLfatal(s, SSL_AD_DECRYPT_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,\n                 SSL_R_DECRYPTION_FAILED);\n        goto err;\n    }\n    padding_len = decrypt_len - SSL_MAX_MASTER_KEY_LENGTH;\n    decrypt_good = constant_time_eq_int_8(rsa_decrypt[0], 0) &\n        constant_time_eq_int_8(rsa_decrypt[1], 2);\n    for (j = 2; j < padding_len - 1; j++) {\n        decrypt_good &= ~constant_time_is_zero_8(rsa_decrypt[j]);\n    }\n    decrypt_good &= constant_time_is_zero_8(rsa_decrypt[padding_len - 1]);\n    version_good =\n        constant_time_eq_8(rsa_decrypt[padding_len],\n                           (unsigned)(s->client_version >> 8));\n    version_good &=\n        constant_time_eq_8(rsa_decrypt[padding_len + 1],\n                           (unsigned)(s->client_version & 0xff));\n    if (s->options & SSL_OP_TLS_ROLLBACK_BUG) {\n        unsigned char workaround_good;\n        workaround_good = constant_time_eq_8(rsa_decrypt[padding_len],\n                                             (unsigned)(s->version >> 8));\n        workaround_good &=\n            constant_time_eq_8(rsa_decrypt[padding_len + 1],\n                               (unsigned)(s->version & 0xff));\n        version_good |= workaround_good;\n    }\n    decrypt_good &= version_good;\n    for (j = 0; j < sizeof(rand_premaster_secret); j++) {\n        rsa_decrypt[padding_len + j] =\n            constant_time_select_8(decrypt_good,\n                                   rsa_decrypt[padding_len + j],\n                                   rand_premaster_secret[j]);\n    }\n    if (!ssl_generate_master_secret(s, rsa_decrypt + padding_len,\n                                    sizeof(rand_premaster_secret), 0)) {\n        goto err;\n    }\n    ret = 1;\n err:\n    OPENSSL_free(rsa_decrypt);\n    return ret;\n#else\n    SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_PROCESS_CKE_RSA,\n             ERR_R_INTERNAL_ERROR);\n    return 0;\n#endif\n}', 'void *CRYPTO_malloc(size_t num, const char *file, int line)\n{\n    void *ret = NULL;\n    INCREMENT(malloc_count);\n    if (malloc_impl != NULL && malloc_impl != CRYPTO_malloc)\n        return malloc_impl(num, file, line);\n    if (num == 0)\n        return NULL;\n    FAILTEST();\n    allow_customize = 0;\n#ifndef OPENSSL_NO_CRYPTO_MDEBUG\n    if (call_malloc_debug) {\n        CRYPTO_mem_debug_malloc(NULL, num, 0, file, line);\n        ret = malloc(num);\n        CRYPTO_mem_debug_malloc(ret, num, 1, file, line);\n    } else {\n        ret = malloc(num);\n    }\n#else\n    (void)(file); (void)(line);\n    ret = malloc(num);\n#endif\n    return ret;\n}', 'static ossl_inline unsigned char constant_time_is_zero_8(unsigned int a)\n{\n    return (unsigned char)constant_time_is_zero(a);\n}', 'static ossl_inline unsigned int constant_time_is_zero(unsigned int a)\n{\n    return constant_time_msb(~a & (a - 1));\n}']