crypto/ec/curve448/eddsa.c:192: error: INTEGER_OVERFLOW_L2
  (0 - [0, 1]):unsigned32 by call to `curve448_scalar_halve`.
Showing all 5 steps of the trace


crypto/ec/curve448/eddsa.c:184:9: Unknown value from: OPENSSL_cleanse
182.               goto err;
183.           curve448_scalar_decode_long(nonce_scalar, nonce, sizeof(nonce));
184.           OPENSSL_cleanse(nonce, sizeof(nonce));
               ^
185.       }
186.   

crypto/ec/curve448/eddsa.c:192:9: Call
190.           curve448_point_t p;
191.   
192.           curve448_scalar_halve(nonce_scalar_2, nonce_scalar);
               ^
193.           for (c = 2; c < C448_EDDSA_ENCODE_RATIO; c <<= 1) {
194.               curve448_scalar_halve(nonce_scalar_2, nonce_scalar_2);

crypto/ec/curve448/scalar.c:222:1: <RHS trace>
220.   }
221.   
222. > void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
223.   {
224.       c448_word_t mask = 0 - (a->limb[0] & 1);

crypto/ec/curve448/scalar.c:222:1: Parameter `a->limb[*]`
  220.   }
  221.   
  222. > void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
  223.   {
  224.       c448_word_t mask = 0 - (a->limb[0] & 1);

crypto/ec/curve448/scalar.c:224:5: Binary operation: (0 - [0, 1]):unsigned32 by call to `curve448_scalar_halve` 
  222.   void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
  223.   {
  224.       c448_word_t mask = 0 - (a->limb[0] & 1);
             ^
  225.       c448_dword_t chain = 0;
  226.       unsigned int i;
