crypto/ec/ecdsa_ossl.c:464: error: INTEGER_OVERFLOW_L2
  (0 - [0, max(1, `eckey->group->order->top`)]):unsigned64 by call to `EC_POINT_mul`.
Showing all 28 steps of the trace


crypto/ec/ecdsa_ossl.c:377:1: Parameter `eckey->group->order->top`
375.   }
376.   
377. > int ossl_ecdsa_verify_sig(const unsigned char *dgst, int dgst_len,
378.                             const ECDSA_SIG *sig, EC_KEY *eckey)
379.   {

crypto/ec/ecdsa_ossl.c:429:10: Call
427.       }
428.       /* calculate tmp1 = inv(S) mod order */
429.       if (!ec_group_do_inverse_ord(group, u2, sig->s, ctx)) {
                ^
430.           ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
431.           goto err;

crypto/ec/ec_lib.c:1074:1: Parameter `group->order->top`
  1072.    * other functionality.
  1073.    */
  1074. > int ec_group_do_inverse_ord(const EC_GROUP *group, BIGNUM *res,
  1075.                               const BIGNUM *x, BN_CTX *ctx)
  1076.   {

crypto/ec/ecdsa_ossl.c:434:9: Call
432.       }
433.       /* digest -> m */
434.       i = BN_num_bits(order);
               ^
435.       /*
436.        * Need to truncate digest if it is too long: first truncate whole bytes.

crypto/bn/bn_lib.c:140:9: Call
  138.       bn_check_top(a);
  139.   
  140.       if (BN_is_zero(a))
                 ^
  141.           return 0;
  142.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));

crypto/bn/bn_lib.c:853:1: Parameter `a->top`
    851.   }
    852.   
    853. > int BN_is_zero(const BIGNUM *a)
    854.   {
    855.       return a->top == 0;

crypto/ec/ecdsa_ossl.c:450:10: Call
448.       }
449.       /* u1 = m * tmp mod order */
450.       if (!BN_mod_mul(u1, m, u2, order, ctx)) {
                ^
451.           ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
452.           goto err;

crypto/bn/bn_mod.c:73:1: Parameter `m->top`
  71.   
  72.   /* slow but works */
  73. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
  74.                  BN_CTX *ctx)
  75.   {

crypto/ec/ecdsa_ossl.c:455:10: Call
453.       }
454.       /* u2 = r * w mod q */
455.       if (!BN_mod_mul(u2, sig->r, u2, order, ctx)) {
                ^
456.           ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
457.           goto err;

crypto/bn/bn_mod.c:73:1: Parameter `m->top`
  71.   
  72.   /* slow but works */
  73. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
  74.                  BN_CTX *ctx)
  75.   {

crypto/ec/ecdsa_ossl.c:464:10: Call
462.           goto err;
463.       }
464.       if (!EC_POINT_mul(group, point, u1, pub_key, u2, ctx)) {
                ^
465.           ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);
466.           goto err;

crypto/ec/ec_lib.c:929:1: Parameter `group->order->top`
  927.   }
  928.   
  929. > int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
  930.                    const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
  931.   {

crypto/ec/ec_lib.c:940:12: Call
  938.       scalars[0] = p_scalar;
  939.   
  940.       return EC_POINTs_mul(group, r, g_scalar,
                    ^
  941.                            (point != NULL
  942.                             && p_scalar != NULL), points, scalars, ctx);

crypto/ec/ec_lib.c:918:1: Parameter `group->order->top`
    916.    */
    917.   
    918. > int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
    919.                     size_t num, const EC_POINT *points[],
    920.                     const BIGNUM *scalars[], BN_CTX *ctx)

crypto/ec/ec_lib.c:924:16: Call
    922.       if (group->meth->mul == 0)
    923.           /* use default */
    924.           return ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
                          ^
    925.   
    926.       return group->meth->mul(group, r, scalar, num, points, scalars, ctx);

crypto/ec/ec_mult.c:401:1: Parameter `group->order->top`
      399.    * in the addition if scalar != NULL
      400.    */
      401. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
      402.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
      403.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:439:10: Call
      437.       }
      438.   
      439.       if (!BN_is_zero(group->order) && !BN_is_zero(group->cofactor)) {
                      ^
      440.           /*-
      441.            * Handle the common cases where the scalar is secret, enforcing a

crypto/bn/bn_lib.c:853:1: Parameter `a->top`
        851.   }
        852.   
        853. > int BN_is_zero(const BIGNUM *a)
        854.   {
        855.       return a->top == 0;

crypto/ec/ec_mult.c:454:20: Call
      452.                * always call the ladder version.
      453.                */
      454.               return ec_scalar_mul_ladder(group, r, scalar, NULL, ctx);
                                ^
      455.           }
      456.           if ((scalar == NULL) && (num == 1)) {

crypto/ec/ec_mult.c:133:1: Parameter `group->order->top`
        131.    * Returns 1 on success, 0 otherwise.
        132.    */
        133. > static
        134.   int ec_scalar_mul_ladder(const EC_GROUP *group, EC_POINT *r,
        135.                            const BIGNUM *scalar, const EC_POINT *point,

crypto/ec/ec_mult.c:186:10: Call
        184.       }
        185.   
        186.       if (!BN_mul(cardinality, group->order, group->cofactor, ctx)) {
                        ^
        187.           ECerr(EC_F_EC_SCALAR_MUL_LADDER, ERR_R_BN_LIB);
        188.           goto err;

crypto/bn/bn_mul.c:497:1: Parameter `a->top`
          495.   #endif                          /* BN_RECURSION */
          496.   
          497. > int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
          498.   {
          499.       int ret = 0;

crypto/bn/bn_mul.c:514:5: Assignment
          512.       bn_check_top(r);
          513.   
          514.       al = a->top;
                     ^
          515.       bl = b->top;
          516.   

crypto/bn/bn_mul.c:561:21: Call
          559.                */
          560.               if (i >= 0) {
          561.                   j = BN_num_bits_word((BN_ULONG)al);
                                     ^
          562.               }
          563.               if (i == -1) {

crypto/bn/bn_lib.c:90:1: <RHS trace>
88.   }
89.   
90. > int BN_num_bits_word(BN_ULONG l)
91.   {
92.       BN_ULONG x, mask;

crypto/bn/bn_lib.c:90:1: Parameter `l`
            88.   }
            89.   
            90. > int BN_num_bits_word(BN_ULONG l)
            91.   {
            92.       BN_ULONG x, mask;

crypto/bn/bn_lib.c:96:5: Assignment
            94.   
            95.   #if BN_BITS2 > 32
            96.       x = l >> 32;
                      ^
            97.       mask = (0 - x) & BN_MASK2;
            98.       mask = (0 - (mask >> (BN_BITS2 - 1)));

crypto/bn/bn_lib.c:97:5: Binary operation: (0 - [0, max(1, eckey->group->order->top)]):unsigned64 by call to `EC_POINT_mul` 
            95.   #if BN_BITS2 > 32
            96.       x = l >> 32;
            97.       mask = (0 - x) & BN_MASK2;
                       ^
            98.       mask = (0 - (mask >> (BN_BITS2 - 1)));
            99.       bits += 32 & mask;
