crypto/ec/ec_mult.c:298: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned64 by call to `BN_consttime_swap`.
Showing all 7 steps of the trace


crypto/ec/ec_mult.c:297:16: Call
295.   
296.       for (i = order_bits - 1; i >= 0; i--) {
297.           kbit = BN_is_bit_set(k, i) ^ pbit;
                      ^
298.           EC_POINT_CSWAP(kbit, r, s, group_top, Z_is_one);
299.           if (!EC_POINT_add(group, s, r, s, ctx))

crypto/bn/bn_lib.c:632:9: Assignment
  630.       bn_check_top(a);
  631.       if (n < 0)
  632.           return 0;
                 ^
  633.       i = n / BN_BITS2;
  634.       j = n % BN_BITS2;

crypto/ec/ec_mult.c:297:9: Assignment
295.   
296.       for (i = order_bits - 1; i >= 0; i--) {
297.           kbit = BN_is_bit_set(k, i) ^ pbit;
               ^
298.           EC_POINT_CSWAP(kbit, r, s, group_top, Z_is_one);
299.           if (!EC_POINT_add(group, s, r, s, ctx))

crypto/ec/ec_mult.c:298:9: Call
296.       for (i = order_bits - 1; i >= 0; i--) {
297.           kbit = BN_is_bit_set(k, i) ^ pbit;
298.           EC_POINT_CSWAP(kbit, r, s, group_top, Z_is_one);
               ^
299.           if (!EC_POINT_add(group, s, r, s, ctx))
300.               goto err;

crypto/bn/bn_lib.c:724:1: <LHS trace>
722.    * a and b cannot be the same number
723.    */
724. > void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
725.   {
726.       BN_ULONG t;

crypto/bn/bn_lib.c:724:1: Parameter `condition`
  722.    * a and b cannot be the same number
  723.    */
  724. > void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
  725.   {
  726.       BN_ULONG t;

crypto/bn/bn_lib.c:736:5: Binary operation: ([0, +oo] - 1):unsigned64 by call to `BN_consttime_swap` 
  734.       assert(sizeof(BN_ULONG) >= sizeof(int));
  735.   
  736.       condition = ((condition - 1) >> (BN_BITS2 - 1)) - 1;
             ^
  737.   
  738.       t = (a->top ^ b->top) & condition;
