crypto/pem/pvkfmt.c:307: error: INTEGER_OVERFLOW_L2
  ([0, `bitlen` + 7] - 1):unsigned32 by call to `read_lebn`.
Showing all 9 steps of the trace


crypto/pem/pvkfmt.c:293:1: Parameter `bitlen`
291.   }
292.   
293. > static EVP_PKEY *b2i_dss(const unsigned char **in, unsigned int length,
294.                            unsigned int bitlen, int ispub)
295.   {

crypto/pem/pvkfmt.c:301:5: Assignment
299.       BN_CTX *ctx = NULL;
300.       unsigned int nbyte;
301.       nbyte = (bitlen + 7) >> 3;
           ^
302.   
303.       dsa = DSA_new();

crypto/pem/pvkfmt.c:307:10: Call
305.       if (!dsa || !ret)
306.           goto memerr;
307.       if (!read_lebn(&p, nbyte, &dsa->p))
                ^
308.           goto memerr;
309.       if (!read_lebn(&p, 20, &dsa->q))

crypto/pem/pvkfmt.c:94:1: Parameter `nbyte`
  92.    */
  93.   
  94. > static int read_lebn(const unsigned char **in, unsigned int nbyte, BIGNUM **r)
  95.   {
  96.       const unsigned char *p;

crypto/pem/pvkfmt.c:106:10: Call
  104.       for (i = 0; i < nbyte; i++)
  105.           *q++ = *p--;
  106.       *r = BN_bin2bn(tmpbuf, nbyte, NULL);
                  ^
  107.       OPENSSL_free(tmpbuf);
  108.       if (*r) {

crypto/bn/bn_lib.c:546:1: <LHS trace>
544.   }
545.   
546. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
547.   {
548.       unsigned int i, m;

crypto/bn/bn_lib.c:546:1: Parameter `len`
    544.   }
    545.   
    546. > BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
    547.   {
    548.       unsigned int i, m;

crypto/bn/bn_lib.c:559:5: Assignment
    557.       bn_check_top(ret);
    558.       l = 0;
    559.       n = len;
               ^
    560.       if (n == 0) {
    561.           ret->top = 0;

crypto/bn/bn_lib.c:564:5: Binary operation: ([0, bitlen + 7] - 1):unsigned32 by call to `read_lebn` 
    562.           return (ret);
    563.       }
    564.       i = ((n - 1) / BN_BYTES) + 1;
               ^
    565.       m = ((n - 1) % (BN_BYTES));
    566.       if (bn_wexpand(ret, (int)i) == NULL) {
