crypto/rsa/rsa_oaep.c:264: error: INTEGER_OVERFLOW_L2
  (0 - [0, 1]):unsigned64 by call to `err_clear_last_constant_time`.
Showing all 7 steps of the trace


crypto/rsa/rsa_oaep.c:208:5: Assignment
206.       good &= constant_time_is_zero(CRYPTO_memcmp(db, phash, mdlen));
207.   
208.       found_one_byte = 0;
           ^
209.       for (i = mdlen; i < dblen; i++) {
210.           /*

crypto/rsa/rsa_oaep.c:221:5: Assignment
219.       }
220.   
221.       good &= found_one_byte;
           ^
222.   
223.       /*

crypto/rsa/rsa_oaep.c:234:5: Assignment
232.        * For good measure, do this check in constant time as well.
233.        */
234.       good &= constant_time_ge(tlen, mlen);
           ^
235.   
236.       /*

crypto/rsa/rsa_oaep.c:264:5: Call
262.       RSAerr(RSA_F_RSA_PADDING_CHECK_PKCS1_OAEP_MGF1,
263.              RSA_R_OAEP_DECODING_ERROR);
264.       err_clear_last_constant_time(1 & good);
           ^
265.    cleanup:
266.       OPENSSL_cleanse(seed, sizeof(seed));

crypto/err/err.c:936:1: <RHS trace>
934.   #endif
935.   
936. > void err_clear_last_constant_time(int clear)
937.   {
938.       ERR_STATE *es;

crypto/err/err.c:936:1: Parameter `clear`
  934.   #endif
  935.   
  936. > void err_clear_last_constant_time(int clear)
  937.   {
  938.       ERR_STATE *es;

crypto/err/err.c:948:5: Binary operation: (0 - [0, 1]):unsigned64 by call to `err_clear_last_constant_time` 
  946.   
  947.       es->err_flags[top] &= ~(0 - clear);
  948.       es->err_buffer[top] &= ~(0UL - clear);
             ^
  949.       es->err_file[top] = (const char *)((UINTPTR_T)es->err_file[top] &
  950.                                          ~((UINTPTR_T)0 - clear));
