crypto/ec/ecdsa_ossl.c:490: error: INTEGER_OVERFLOW_L2
  (0 - [0, max(1, `eckey->group->order->top`)]):unsigned64 by call to `EC_POINT_mul`.
Showing all 24 steps of the trace


crypto/ec/ecdsa_ossl.c:400:1: Parameter `eckey->group->order->top`
398.   }
399.   
400. > int ossl_ecdsa_verify_sig(const unsigned char *dgst, int dgst_len,
401.                             const ECDSA_SIG *sig, EC_KEY *eckey)
402.   {

crypto/ec/ecdsa_ossl.c:460:9: Call
458.       }
459.       /* digest -> m */
460.       i = BN_num_bits(order);
               ^
461.       /*
462.        * Need to truncate digest if it is too long: first truncate whole bytes.

crypto/bn/bn_lib.c:139:9: Call
  137.       bn_check_top(a);
  138.   
  139.       if (BN_is_zero(a))
                 ^
  140.           return 0;
  141.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));

crypto/bn/bn_lib.c:845:1: Parameter `a->top`
    843.   }
    844.   
    845. > int BN_is_zero(const BIGNUM *a)
    846.   {
    847.       return a->top == 0;

crypto/ec/ecdsa_ossl.c:476:10: Call
474.       }
475.       /* u1 = m * tmp mod order */
476.       if (!BN_mod_mul(u1, m, u2, order, ctx)) {
                ^
477.           ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
478.           goto err;

crypto/bn/bn_mod.c:73:1: Parameter `m->top`
  71.   
  72.   /* slow but works */
  73. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
  74.                  BN_CTX *ctx)
  75.   {

crypto/ec/ecdsa_ossl.c:481:10: Call
479.       }
480.       /* u2 = r * w mod q */
481.       if (!BN_mod_mul(u2, sig->r, u2, order, ctx)) {
                ^
482.           ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
483.           goto err;

crypto/bn/bn_mod.c:73:1: Parameter `m->top`
  71.   
  72.   /* slow but works */
  73. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
  74.                  BN_CTX *ctx)
  75.   {

crypto/ec/ecdsa_ossl.c:490:10: Call
488.           goto err;
489.       }
490.       if (!EC_POINT_mul(group, point, u1, pub_key, u2, ctx)) {
                ^
491.           ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);
492.           goto err;

crypto/ec/ec_lib.c:929:1: Parameter `group->order->top`
  927.   }
  928.   
  929. > int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
  930.                    const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
  931.   {

crypto/ec/ec_lib.c:940:12: Call
  938.       scalars[0] = p_scalar;
  939.   
  940.       return EC_POINTs_mul(group, r, g_scalar,
                    ^
  941.                            (point != NULL
  942.                             && p_scalar != NULL), points, scalars, ctx);

crypto/ec/ec_lib.c:918:1: Parameter `group->order->top`
    916.    */
    917.   
    918. > int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
    919.                     size_t num, const EC_POINT *points[],
    920.                     const BIGNUM *scalars[], BN_CTX *ctx)

crypto/ec/ec_lib.c:924:16: Call
    922.       if (group->meth->mul == 0)
    923.           /* use default */
    924.           return ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
                          ^
    925.   
    926.       return group->meth->mul(group, r, scalar, num, points, scalars, ctx);

crypto/ec/ec_mult.c:354:1: Parameter `group->order->top`
      352.    * in the addition if scalar != NULL
      353.    */
      354. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
      355.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
      356.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:405:16: Call
      403.            * constant time version.
      404.            */
      405.           return ec_mul_consttime(group, r, scalar, NULL, ctx);
                            ^
      406.       }
      407.       if ((scalar == NULL) && (num == 1)) {

crypto/ec/ec_mult.c:131:1: Parameter `group->order->top`
        129.    * Returns 1 on success, 0 otherwise.
        130.    */
        131. > static int ec_mul_consttime(const EC_GROUP *group, EC_POINT *r,
        132.                               const BIGNUM *scalar, const EC_POINT *point,
        133.                               BN_CTX *ctx)

crypto/ec/ec_mult.c:165:23: Call
        163.       lambda = BN_CTX_get(ctx);
        164.       k = BN_CTX_get(ctx);
        165.       if (k == NULL || !BN_mul(cardinality, group->order, group->cofactor, ctx))
                                     ^
        166.           goto err;
        167.   

crypto/bn/bn_mul.c:497:1: Parameter `a->top`
          495.   #endif                          /* BN_RECURSION */
          496.   
          497. > int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
          498.   {
          499.       int ret = 0;

crypto/bn/bn_mul.c:514:5: Assignment
          512.       bn_check_top(r);
          513.   
          514.       al = a->top;
                     ^
          515.       bl = b->top;
          516.   

crypto/bn/bn_mul.c:561:21: Call
          559.                */
          560.               if (i >= 0) {
          561.                   j = BN_num_bits_word((BN_ULONG)al);
                                     ^
          562.               }
          563.               if (i == -1) {

crypto/bn/bn_lib.c:89:1: <RHS trace>
87.   }
88.   
89. > int BN_num_bits_word(BN_ULONG l)
90.   {
91.       BN_ULONG x, mask;

crypto/bn/bn_lib.c:89:1: Parameter `l`
            87.   }
            88.   
            89. > int BN_num_bits_word(BN_ULONG l)
            90.   {
            91.       BN_ULONG x, mask;

crypto/bn/bn_lib.c:95:5: Assignment
            93.   
            94.   #if BN_BITS2 > 32
            95.       x = l >> 32;
                      ^
            96.       mask = (0 - x) & BN_MASK2;
            97.       mask = (0 - (mask >> (BN_BITS2 - 1)));

crypto/bn/bn_lib.c:96:5: Binary operation: (0 - [0, max(1, eckey->group->order->top)]):unsigned64 by call to `EC_POINT_mul` 
            94.   #if BN_BITS2 > 32
            95.       x = l >> 32;
            96.       mask = (0 - x) & BN_MASK2;
                      ^
            97.       mask = (0 - (mask >> (BN_BITS2 - 1)));
            98.       bits += 32 & mask;
