crypto/ec/curve448/curve448.c:258: error: INTEGER_OVERFLOW_L2
  (0 - [0, 1]):unsigned32 by call to `curve448_scalar_halve`.
Showing all 6 steps of the trace


crypto/ec/curve448/curve448.c:257:5: Call
255.   
256.       curve448_scalar_t scalar1x;
257.       curve448_scalar_add(scalar1x, scalar, precomputed_scalarmul_adjustment);
           ^
258.       curve448_scalar_halve(scalar1x, scalar1x);
259.   

crypto/ec/curve448/scalar.c:123:1: Parameter `b->limb[*]`
  121.   }
  122.   
  123. > void curve448_scalar_add(curve448_scalar_t out, const curve448_scalar_t a,
  124.                            const curve448_scalar_t b)
  125.   {

crypto/ec/curve448/curve448.c:258:5: Call
256.       curve448_scalar_t scalar1x;
257.       curve448_scalar_add(scalar1x, scalar, precomputed_scalarmul_adjustment);
258.       curve448_scalar_halve(scalar1x, scalar1x);
           ^
259.   
260.       for (i = s - 1; i >= 0; i--) {

crypto/ec/curve448/scalar.c:222:1: <RHS trace>
220.   }
221.   
222. > void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
223.   {
224.       c448_word_t mask = 0 - (a->limb[0] & 1);

crypto/ec/curve448/scalar.c:222:1: Parameter `a->limb[*]`
  220.   }
  221.   
  222. > void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
  223.   {
  224.       c448_word_t mask = 0 - (a->limb[0] & 1);

crypto/ec/curve448/scalar.c:224:5: Binary operation: (0 - [0, 1]):unsigned32 by call to `curve448_scalar_halve` 
  222.   void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
  223.   {
  224.       c448_word_t mask = 0 - (a->limb[0] & 1);
             ^
  225.       c448_dword_t chain = 0;
  226.       unsigned int i;
