crypto/rsa/rsa_pk1.c:239: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 10):unsigned32 by call to `constant_time_ge`.
Showing all 7 steps of the trace


crypto/rsa/rsa_pk1.c:192:2: Assignment
190.   	unsigned char *em = NULL;
191.   	unsigned int good, found_zero_byte;
192.   	int zero_index = 0, msg_index, mlen = -1;
        ^
193.   
194.           if (tlen < 0 || flen < 0)

crypto/rsa/rsa_pk1.c:239:10: Call
237.   	 * also fails.
238.   	 */
239.   	good &= constant_time_ge((unsigned int)(zero_index), 2 + 8);
                ^
240.   
241.   	/* Skip the zero byte. This is incorrect if we never found a zero-byte

crypto/constant_time_locl.h:150:1: <LHS trace>
148.   	}
149.   
150. > static inline unsigned int constant_time_ge(unsigned int a, unsigned int b)
151.   	{
152.   	unsigned int ge;

crypto/constant_time_locl.h:150:1: Parameter `a`
  148.   	}
  149.   
  150. > static inline unsigned int constant_time_ge(unsigned int a, unsigned int b)
  151.   	{
  152.   	unsigned int ge;

crypto/constant_time_locl.h:150:1: <RHS trace>
148.   	}
149.   
150. > static inline unsigned int constant_time_ge(unsigned int a, unsigned int b)
151.   	{
152.   	unsigned int ge;

crypto/constant_time_locl.h:150:1: Parameter `b`
  148.   	}
  149.   
  150. > static inline unsigned int constant_time_ge(unsigned int a, unsigned int b)
  151.   	{
  152.   	unsigned int ge;

crypto/constant_time_locl.h:154:2: Binary operation: ([0, +oo] - 10):unsigned32 by call to `constant_time_ge` 
  152.   	unsigned int ge;
  153.   	/* Case 1: msb(a) == msb(b). a >= b iff the MSB of a - b is not set.*/
  154.   	ge = ~((a ^ b) | (a - b));
          ^
  155.   	/* Case 2: msb(a) != msb(b). a >= b iff the MSB of a is set. */
  156.   	ge |= a & ~b;
