crypto/ec/curve448/curve448.c:508: error: INTEGER_OVERFLOW_L2
  (0 - [0, 1]):unsigned32 by call to `curve448_scalar_halve`.
Showing all 6 steps of the trace


crypto/ec/curve448/curve448.c:504:5: Call
502.       scalar2[X_PRIVATE_BYTES - 1] |= 1 << ((X_PRIVATE_BITS + 7) % 8);
503.   
504.       curve448_scalar_decode_long(the_scalar, scalar2, sizeof(scalar2));
           ^
505.   
506.       /* Compensate for the encoding ratio */

crypto/ec/curve448/scalar.c:174:1: Parameter `s->limb[*]`
  172.   }
  173.   
  174. > void curve448_scalar_decode_long(curve448_scalar_t s,
  175.                                    const unsigned char *ser, size_t ser_len)
  176.   {

crypto/ec/curve448/curve448.c:508:9: Call
506.       /* Compensate for the encoding ratio */
507.       for (i = 1; i < X448_ENCODE_RATIO; i <<= 1) {
508.           curve448_scalar_halve(the_scalar, the_scalar);
               ^
509.       }
510.       curve448_precomputed_scalarmul(p, curve448_precomputed_base, the_scalar);

crypto/ec/curve448/scalar.c:222:1: <RHS trace>
220.   }
221.   
222. > void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
223.   {
224.       c448_word_t mask = 0 - (a->limb[0] & 1);

crypto/ec/curve448/scalar.c:222:1: Parameter `a->limb[*]`
  220.   }
  221.   
  222. > void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
  223.   {
  224.       c448_word_t mask = 0 - (a->limb[0] & 1);

crypto/ec/curve448/scalar.c:224:5: Binary operation: (0 - [0, 1]):unsigned32 by call to `curve448_scalar_halve` 
  222.   void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
  223.   {
  224.       c448_word_t mask = 0 - (a->limb[0] & 1);
             ^
  225.       c448_dword_t chain = 0;
  226.       unsigned int i;
