crypto/bn/bn_rsa_fips186_4.c:289: error: INTEGER_OVERFLOW_L2
  (0 - [0, max(1, `r2->top`)]):unsigned64 by call to `BN_mul`.
Showing all 22 steps of the trace


crypto/bn/bn_rsa_fips186_4.c:253:1: Parameter `r2->top`
251.    *     Y, X, r1, r2, e are not NULL.
252.    */
253. > int bn_rsa_fips186_4_derive_prime(BIGNUM *Y, BIGNUM *X, const BIGNUM *Xin,
254.                                     const BIGNUM *r1, const BIGNUM *r2, int nlen,
255.                                     const BIGNUM *e, BN_CTX *ctx, BN_GENCB *cb)

crypto/bn/bn_rsa_fips186_4.c:280:16: Call
278.       if (!(BN_lshift1(r1x2, r1)
279.               /* (Step 1) GCD(2r1, r2) = 1 */
280.               && BN_gcd(tmp, r1x2, r2, ctx)
                      ^
281.               && BN_is_one(tmp)
282.               /* (Step 2) R = ((r2^-1 mod 2r1) * r2) - ((2r1^-1 mod r2)*2r1) */

crypto/bn/bn_gcd.c:15:1: Parameter `in_b->top`
  13.   static BIGNUM *euclid(BIGNUM *a, BIGNUM *b);
  14.   
  15. > int BN_gcd(BIGNUM *r, const BIGNUM *in_a, const BIGNUM *in_b, BN_CTX *ctx)
  16.   {
  17.       BIGNUM *a, *b, *t;

crypto/bn/bn_rsa_fips186_4.c:283:16: Call
281.               && BN_is_one(tmp)
282.               /* (Step 2) R = ((r2^-1 mod 2r1) * r2) - ((2r1^-1 mod r2)*2r1) */
283.               && BN_mod_inverse(R, r2, r1x2, ctx)
                      ^
284.               && BN_mul(R, R, r2, ctx) /* R = (r2^-1 mod 2r1) * r2 */
285.               && BN_mod_inverse(tmp, r1x2, r2, ctx)

crypto/bn/bn_gcd.c:124:1: Parameter `a->top`
  122.                                           BN_CTX *ctx);
  123.   
  124. > BIGNUM *BN_mod_inverse(BIGNUM *in,
  125.                          const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
  126.   {

crypto/bn/bn_gcd.c:129:10: Call
  127.       BIGNUM *rv;
  128.       int noinv;
  129.       rv = int_bn_mod_inverse(in, a, n, ctx, &noinv);
                  ^
  130.       if (noinv)
  131.           BNerr(BN_F_BN_MOD_INVERSE, BN_R_NO_INVERSE);

crypto/bn/bn_gcd.c:135:1: Parameter `a->top`
    133.   }
    134.   
    135. > BIGNUM *int_bn_mod_inverse(BIGNUM *in,
    136.                              const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx,
    137.                              int *pnoinv)

crypto/bn/bn_rsa_fips186_4.c:285:16: Call
283.               && BN_mod_inverse(R, r2, r1x2, ctx)
284.               && BN_mul(R, R, r2, ctx) /* R = (r2^-1 mod 2r1) * r2 */
285.               && BN_mod_inverse(tmp, r1x2, r2, ctx)
                      ^
286.               && BN_mul(tmp, tmp, r1x2, ctx) /* tmp = (2r1^-1 mod r2)*2r1 */
287.               && BN_sub(R, R, tmp)

crypto/bn/bn_gcd.c:124:1: Parameter `n->top`
  122.                                           BN_CTX *ctx);
  123.   
  124. > BIGNUM *BN_mod_inverse(BIGNUM *in,
  125.                          const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
  126.   {

crypto/bn/bn_gcd.c:129:10: Call
  127.       BIGNUM *rv;
  128.       int noinv;
  129.       rv = int_bn_mod_inverse(in, a, n, ctx, &noinv);
                  ^
  130.       if (noinv)
  131.           BNerr(BN_F_BN_MOD_INVERSE, BN_R_NO_INVERSE);

crypto/bn/bn_gcd.c:144:33: Call
    142.   
    143.       /* This is invalid input so we don't worry about constant time here */
    144.       if (BN_abs_is_word(n, 1) || BN_is_zero(n)) {
                                           ^
    145.           if (pnoinv != NULL)
    146.               *pnoinv = 1;

crypto/bn/bn_lib.c:864:1: Parameter `a->top`
      862.   }
      863.   
      864. > int BN_is_zero(const BIGNUM *a)
      865.   {
      866.       return a->top == 0;

crypto/bn/bn_rsa_fips186_4.c:289:16: Call
287.               && BN_sub(R, R, tmp)
288.               /* Calculate 2r1r2 */
289.               && BN_mul(r1r2x2, r1x2, r2, ctx)))
                      ^
290.           goto err;
291.       /* Make positive by adding the modulus */

crypto/bn/bn_mul.c:497:1: Parameter `b->top`
  495.   #endif                          /* BN_RECURSION */
  496.   
  497. > int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
  498.   {
  499.       int ret = bn_mul_fixed_top(r, a, b, ctx);

crypto/bn/bn_mul.c:499:15: Call
  497.   int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
  498.   {
  499.       int ret = bn_mul_fixed_top(r, a, b, ctx);
                       ^
  500.   
  501.       bn_correct_top(r);

crypto/bn/bn_mul.c:507:1: Parameter `b->top`
    505.   }
    506.   
    507. > int bn_mul_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
    508.   {
    509.       int ret = 0;

crypto/bn/bn_mul.c:525:5: Assignment
    523.   
    524.       al = a->top;
    525.       bl = b->top;
               ^
    526.   
    527.       if ((al == 0) || (bl == 0)) {

crypto/bn/bn_mul.c:574:21: Call
    572.               }
    573.               if (i == -1) {
    574.                   j = BN_num_bits_word((BN_ULONG)bl);
                               ^
    575.               }
    576.               j = 1 << (j - 1);

crypto/bn/bn_lib.c:90:1: <RHS trace>
88.   }
89.   
90. > int BN_num_bits_word(BN_ULONG l)
91.   {
92.       BN_ULONG x, mask;

crypto/bn/bn_lib.c:90:1: Parameter `l`
      88.   }
      89.   
      90. > int BN_num_bits_word(BN_ULONG l)
      91.   {
      92.       BN_ULONG x, mask;

crypto/bn/bn_lib.c:96:5: Assignment
      94.   
      95.   #if BN_BITS2 > 32
      96.       x = l >> 32;
                ^
      97.       mask = (0 - x) & BN_MASK2;
      98.       mask = (0 - (mask >> (BN_BITS2 - 1)));

crypto/bn/bn_lib.c:97:5: Binary operation: (0 - [0, max(1, r2->top)]):unsigned64 by call to `BN_mul` 
      95.   #if BN_BITS2 > 32
      96.       x = l >> 32;
      97.       mask = (0 - x) & BN_MASK2;
                 ^
      98.       mask = (0 - (mask >> (BN_BITS2 - 1)));
      99.       bits += 32 & mask;
