crypto/ec/curve25519.c:4622: error: INTEGER_OVERFLOW_L2
  (128 - [1, 253]):unsigned64 by call to `SHA512_Update`.
Showing all 10 steps of the trace


crypto/ec/curve25519.c:4619:3: Call
4617.     ge_p3_tobytes(out_sig, &R);
4618.   
4619.     SHA512_Init(&hash_ctx);
          ^
4620.     SHA512_Update(&hash_ctx, out_sig, 32);
4621.     SHA512_Update(&hash_ctx, public_key, 32);

crypto/sha/sha512.c:94:5: Assignment
  92.       c->Nl = 0;
  93.       c->Nh = 0;
  94.       c->num = 0;
            ^
  95.       c->md_len = SHA512_DIGEST_LENGTH;
  96.       return 1;

crypto/ec/curve25519.c:4620:3: Call
4618.   
4619.     SHA512_Init(&hash_ctx);
4620.     SHA512_Update(&hash_ctx, out_sig, 32);
          ^
4621.     SHA512_Update(&hash_ctx, public_key, 32);
4622.     SHA512_Update(&hash_ctx, message, message_len);

crypto/sha/sha512.c:188:1: Parameter `c->num`
  186.   }
  187.   
  188. > int SHA512_Update(SHA512_CTX *c, const void *_data, size_t len)
  189.   {
  190.       SHA_LONG64 l;

crypto/ec/curve25519.c:4621:3: Call
4619.     SHA512_Init(&hash_ctx);
4620.     SHA512_Update(&hash_ctx, out_sig, 32);
4621.     SHA512_Update(&hash_ctx, public_key, 32);
          ^
4622.     SHA512_Update(&hash_ctx, message, message_len);
4623.     SHA512_Final(hram, &hash_ctx);

crypto/sha/sha512.c:188:1: Parameter `c->num`
  186.   }
  187.   
  188. > int SHA512_Update(SHA512_CTX *c, const void *_data, size_t len)
  189.   {
  190.       SHA_LONG64 l;

crypto/ec/curve25519.c:4622:3: Call
4620.     SHA512_Update(&hash_ctx, out_sig, 32);
4621.     SHA512_Update(&hash_ctx, public_key, 32);
4622.     SHA512_Update(&hash_ctx, message, message_len);
          ^
4623.     SHA512_Final(hram, &hash_ctx);
4624.   

crypto/sha/sha512.c:188:1: <RHS trace>
186.   }
187.   
188. > int SHA512_Update(SHA512_CTX *c, const void *_data, size_t len)
189.   {
190.       SHA_LONG64 l;

crypto/sha/sha512.c:188:1: Parameter `c->num`
  186.   }
  187.   
  188. > int SHA512_Update(SHA512_CTX *c, const void *_data, size_t len)
  189.   {
  190.       SHA_LONG64 l;

crypto/sha/sha512.c:205:9: Binary operation: (128 - [1, 253]):unsigned64 by call to `SHA512_Update` 
  203.   
  204.       if (c->num != 0) {
  205.           size_t n = sizeof(c->u) - c->num;
                 ^
  206.   
  207.           if (len < n) {
