crypto/bn/bn_sqrt.c:148: error: INTEGER_OVERFLOW_L2
  ([0, 6+max(0, `ctx->stack.depth`)] - 1):unsigned32 by call to `BN_mod_exp`.
Showing all 39 steps of the trace


crypto/bn/bn_sqrt.c:62:1: Parameter `ctx->stack.depth`
60.   
61.   
62. > BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) 
63.   /* Returns 'ret' such that
64.    *      ret^2 == a (mod p),

crypto/bn/bn_sqrt.c:114:2: Call
112.   		}
113.   
114.   	BN_CTX_start(ctx);
        ^
115.   	A = BN_CTX_get(ctx);
116.   	b = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:257:1: Parameter `ctx->stack.depth`
  255.   	}
  256.   
  257. > void BN_CTX_start(BN_CTX *ctx)
  258.   	{
  259.   	CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_sqrt.c:128:7: Call
126.   
127.   	/* A = a mod p */
128.   	if (!BN_nnmod(A, a, p, ctx)) goto end;
             ^
129.   
130.   	/* now write  |p| - 1  as  2^e*q  where  q  is odd */

crypto/bn/bn_mod.c:127:1: Parameter `ctx->stack.depth`
  125.   
  126.   
  127. > int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
  128.   	{
  129.   	/* like BN_mod, but returns non-negative remainder

crypto/bn/bn_mod.c:132:8: Call
  130.   	 * (i.e.,  0 <= r < |d|  always holds) */
  131.   
  132.   	if (!(BN_mod(r,m,d,ctx)))
                ^
  133.   		return 0;
  134.   	if (!r->neg)

crypto/bn/bn_div.c:181:1: Parameter `ctx->stack.depth`
    179.   static int BN_div_no_branch(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
    180.           const BIGNUM *divisor, BN_CTX *ctx);
    181. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
    182.   	   BN_CTX *ctx)
    183.   	{

crypto/bn/bn_sqrt.c:148:8: Call
146.   		q->neg = 0;
147.   		if (!BN_add_word(q, 1)) goto end;
148.   		if (!BN_mod_exp(ret, A, q, p, ctx)) goto end;
              ^
149.   		err = 0;
150.   		goto vrfy;

crypto/bn/bn_exp.c:165:1: Parameter `ctx->stack.depth`
  163.   
  164.   
  165. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
  166.   	       BN_CTX *ctx)
  167.   	{

crypto/bn/bn_exp.c:221:8: Call
  219.   			{
  220.   			BN_ULONG A = a->d[0];
  221.   			ret=BN_mod_exp_mont_word(r,A,p,m,ctx,NULL);
                ^
  222.   			}
  223.   		else

crypto/bn/bn_exp.c:726:1: Parameter `ctx->stack.depth`
    724.   	}
    725.   
    726. > int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
    727.                            const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
    728.   	{

crypto/bn/bn_exp.c:781:2: Call
    779.   		}
    780.   
    781.   	BN_CTX_start(ctx);
            ^
    782.   	d = BN_CTX_get(ctx);
    783.   	r = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:257:1: Parameter `ctx->stack.depth`
      255.   	}
      256.   
      257. > void BN_CTX_start(BN_CTX *ctx)
      258.   	{
      259.   	CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_exp.c:792:8: Call
    790.   		{
    791.   		if ((mont = BN_MONT_CTX_new()) == NULL) goto err;
    792.   		if (!BN_MONT_CTX_set(mont, m, ctx)) goto err;
                  ^
    793.   		}
    794.   

crypto/bn/bn_mont.c:415:1: Parameter `ctx->stack.depth`
      413.   	}
      414.   
      415. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
      416.   	{
      417.   	int ret = 0;

crypto/bn/bn_mont.c:420:2: Call
      418.   	BIGNUM *Ri,*R;
      419.   
      420.   	BN_CTX_start(ctx);
              ^
      421.   	if((Ri = BN_CTX_get(ctx)) == NULL) goto err;
      422.   	R= &(mont->RR);					/* grab RR as a temp */

crypto/bn/bn_ctx.c:257:1: Parameter `ctx->stack.depth`
        255.   	}
        256.   
        257. > void BN_CTX_start(BN_CTX *ctx)
        258.   	{
        259.   	CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_mont.c:481:8: Call
      479.   		tmod.top = buf[0] != 0 ? 1 : 0;
      480.   							/* Ri = R^-1 mod N*/
      481.   		if ((BN_mod_inverse(Ri,R,&tmod,ctx)) == NULL)
                    ^
      482.   			goto err;
      483.   		if (!BN_lshift(Ri,Ri,BN_BITS2)) goto err; /* R*Ri */

crypto/bn/bn_gcd.c:209:1: Parameter `ctx->stack.depth`
        207.           const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx);
        208.   
        209. > BIGNUM *BN_mod_inverse(BIGNUM *in,
        210.   	const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
        211.   	{

crypto/bn/bn_gcd.c:214:7: Call
        212.   	BIGNUM *rv;
        213.   	int noinv;
        214.   	rv = int_bn_mod_inverse(in, a, n, ctx, &noinv);
                     ^
        215.   	if (noinv)
        216.   		BNerr(BN_F_BN_MOD_INVERSE,BN_R_NO_INVERSE);

crypto/bn/bn_gcd.c:220:1: Parameter `ctx->stack.depth`
          218.   	}
          219.   
          220. > BIGNUM *int_bn_mod_inverse(BIGNUM *in,
          221.   	const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx, int *pnoinv)
          222.   	{

crypto/bn/bn_gcd.c:232:10: Call
          230.   	if ((BN_get_flags(a, BN_FLG_CONSTTIME) != 0) || (BN_get_flags(n, BN_FLG_CONSTTIME) != 0))
          231.   		{
          232.   		return BN_mod_inverse_no_branch(in, a, n, ctx);
                          ^
          233.   		}
          234.   

crypto/bn/bn_gcd.c:522:1: Parameter `ctx->stack.depth`
            520.    * It does not contain branches that may leak sensitive information.
            521.    */
            522. > static BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in,
            523.   	const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
            524.   	{

crypto/bn/bn_gcd.c:534:2: Call
            532.   	bn_check_top(n);
            533.   
            534.   	BN_CTX_start(ctx);
                    ^
            535.   	A = BN_CTX_get(ctx);
            536.   	B = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:257:1: Parameter `ctx->stack.depth`
              255.   	}
              256.   
              257. > void BN_CTX_start(BN_CTX *ctx)
              258.   	{
              259.   	CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_gcd.c:563:8: Call
            561.   		pB = &local_B;
            562.   		BN_with_flags(pB, B, BN_FLG_CONSTTIME);	
            563.   		if (!BN_nnmod(B, pB, A, ctx)) goto err;
                          ^
            564.   		}
            565.   	sign = -1;

crypto/bn/bn_mod.c:127:1: Parameter `ctx->stack.depth`
              125.   
              126.   
              127. > int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
              128.   	{
              129.   	/* like BN_mod, but returns non-negative remainder

crypto/bn/bn_mod.c:132:8: Call
              130.   	 * (i.e.,  0 <= r < |d|  always holds) */
              131.   
              132.   	if (!(BN_mod(r,m,d,ctx)))
                            ^
              133.   		return 0;
              134.   	if (!r->neg)

crypto/bn/bn_div.c:181:1: Parameter `ctx->stack.depth`
                179.   static int BN_div_no_branch(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
                180.           const BIGNUM *divisor, BN_CTX *ctx);
                181. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
                182.   	   BN_CTX *ctx)
                183.   	{

crypto/bn/bn_div.c:203:10: Call
                201.   	if ((BN_get_flags(num, BN_FLG_CONSTTIME) != 0) || (BN_get_flags(divisor, BN_FLG_CONSTTIME) != 0))
                202.   		{
                203.   		return BN_div_no_branch(dv, rm, num, divisor, ctx);
                                ^
                204.   		}
                205.   

crypto/bn/bn_div.c:426:1: Parameter `ctx->stack.depth`
                  424.    * branches that may leak sensitive information.
                  425.    */
                  426. > static int BN_div_no_branch(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, 
                  427.   	const BIGNUM *divisor, BN_CTX *ctx)
                  428.   	{

crypto/bn/bn_div.c:446:2: Call
                  444.   		}
                  445.   
                  446.   	BN_CTX_start(ctx);
                          ^
                  447.   	tmp=BN_CTX_get(ctx);
                  448.   	snum=BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:257:1: Parameter `ctx->stack.depth`
                    255.   	}
                    256.   
                    257. > void BN_CTX_start(BN_CTX *ctx)
                    258.   	{
                    259.   	CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_div.c:642:2: Call
                  640.   		}
                  641.   	bn_correct_top(res);
                  642.   	BN_CTX_end(ctx);
                          ^
                  643.   	return(1);
                  644.   err:

crypto/bn/bn_ctx.c:272:1: Parameter `ctx->stack.depth`
                    270.   	}
                    271.   
                    272. > void BN_CTX_end(BN_CTX *ctx)
                    273.   	{
                    274.   	CTXDBG_ENTRY("BN_CTX_end", ctx);

crypto/bn/bn_ctx.c:279:21: Call
                    277.   	else
                    278.   		{
                    279.   		unsigned int fp = BN_STACK_pop(&ctx->stack);
                                               ^
                    280.   		/* Does this stack frame have anything to release? */
                    281.   		if(fp < ctx->used)

crypto/bn/bn_ctx.c:353:1: <LHS trace>
351.   	}
352.   
353. > static unsigned int BN_STACK_pop(BN_STACK *st)
354.   	{
355.   	return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:353:1: Parameter `st->depth`
                      351.   	}
                      352.   
                      353. > static unsigned int BN_STACK_pop(BN_STACK *st)
                      354.   	{
                      355.   	return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:355:9: Binary operation: ([0, 6+max(0, ctx->stack.depth)] - 1):unsigned32 by call to `BN_mod_exp` 
                      353.   static unsigned int BN_STACK_pop(BN_STACK *st)
                      354.   	{
                      355.   	return st->indexes[--(st->depth)];
                                     ^
                      356.   	}
                      357.   
