crypto/ec/curve25519.c:5432: error: INTEGER_OVERFLOW_L2
  (128 - [113, 380]):unsigned64 by call to `SHA512_Final`.
Showing all 14 steps of the trace


crypto/ec/curve25519.c:5428:3: Call
5426.     fe_neg(A.T, A.T);
5427.   
5428.     SHA512_Init(&hash_ctx);
          ^
5429.     SHA512_Update(&hash_ctx, r, 32);
5430.     SHA512_Update(&hash_ctx, public_key, 32);

crypto/sha/sha512.c:130:5: Assignment
  128.       c->Nl = 0;
  129.       c->Nh = 0;
  130.       c->num = 0;
             ^
  131.       c->md_len = SHA512_DIGEST_LENGTH;
  132.       return 1;

crypto/ec/curve25519.c:5429:3: Call
5427.   
5428.     SHA512_Init(&hash_ctx);
5429.     SHA512_Update(&hash_ctx, r, 32);
          ^
5430.     SHA512_Update(&hash_ctx, public_key, 32);
5431.     SHA512_Update(&hash_ctx, message, message_len);

crypto/sha/sha512.c:264:1: Parameter `c->num`
  262.   }
  263.   
  264. > int SHA512_Update(SHA512_CTX *c, const void *_data, size_t len)
  265.   {
  266.       SHA_LONG64 l;

crypto/ec/curve25519.c:5430:3: Call
5428.     SHA512_Init(&hash_ctx);
5429.     SHA512_Update(&hash_ctx, r, 32);
5430.     SHA512_Update(&hash_ctx, public_key, 32);
          ^
5431.     SHA512_Update(&hash_ctx, message, message_len);
5432.     SHA512_Final(h, &hash_ctx);

crypto/sha/sha512.c:264:1: Parameter `c->num`
  262.   }
  263.   
  264. > int SHA512_Update(SHA512_CTX *c, const void *_data, size_t len)
  265.   {
  266.       SHA_LONG64 l;

crypto/ec/curve25519.c:5431:3: Call
5429.     SHA512_Update(&hash_ctx, r, 32);
5430.     SHA512_Update(&hash_ctx, public_key, 32);
5431.     SHA512_Update(&hash_ctx, message, message_len);
          ^
5432.     SHA512_Final(h, &hash_ctx);
5433.   

crypto/sha/sha512.c:264:1: Parameter `c->num`
  262.   }
  263.   
  264. > int SHA512_Update(SHA512_CTX *c, const void *_data, size_t len)
  265.   {
  266.       SHA_LONG64 l;

crypto/ec/curve25519.c:5432:3: Call
5430.     SHA512_Update(&hash_ctx, public_key, 32);
5431.     SHA512_Update(&hash_ctx, message, message_len);
5432.     SHA512_Final(h, &hash_ctx);
          ^
5433.   
5434.     x25519_sc_reduce(h);

crypto/sha/sha512.c:140:1: <RHS trace>
138.   void sha512_block_data_order(SHA512_CTX *ctx, const void *in, size_t num);
139.   
140. > int SHA512_Final(unsigned char *md, SHA512_CTX *c)
141.   {
142.       unsigned char *p = (unsigned char *)c->u.p;

crypto/sha/sha512.c:140:1: Parameter `c->num`
  138.   void sha512_block_data_order(SHA512_CTX *ctx, const void *in, size_t num);
  139.   
  140. > int SHA512_Final(unsigned char *md, SHA512_CTX *c)
  141.   {
  142.       unsigned char *p = (unsigned char *)c->u.p;

crypto/sha/sha512.c:143:5: Assignment
  141.   {
  142.       unsigned char *p = (unsigned char *)c->u.p;
  143.       size_t n = c->num;
             ^
  144.   
  145.       p[n] = 0x80;                /* There always is a room for one */

crypto/sha/sha512.c:146:5: Assignment
  144.   
  145.       p[n] = 0x80;                /* There always is a room for one */
  146.       n++;
             ^
  147.       if (n > (sizeof(c->u) - 16)) {
  148.           memset(p + n, 0, sizeof(c->u) - n);

crypto/sha/sha512.c:148:9: Binary operation: (128 - [113, 380]):unsigned64 by call to `SHA512_Final` 
  146.       n++;
  147.       if (n > (sizeof(c->u) - 16)) {
  148.           memset(p + n, 0, sizeof(c->u) - n);
                 ^
  149.           n = 0;
  150.           sha512_block_data_order(c, p, 1);
