crypto/ec/ecdsa_ossl.c:396: error: INTEGER_OVERFLOW_L2
  (0 - [0, max(1, `eckey->group->order->top`)]):unsigned64 by call to `EC_POINT_mul`.
Showing all 32 steps of the trace


crypto/ec/ecdsa_ossl.c:309:1: Parameter `eckey->group->order->top`
307.   }
308.   
309. > int ossl_ecdsa_verify_sig(const unsigned char *dgst, int dgst_len,
310.                             const ECDSA_SIG *sig, EC_KEY *eckey)
311.   {

crypto/ec/ecdsa_ossl.c:361:10: Call
359.       }
360.       /* calculate tmp1 = inv(S) mod order */
361.       if (!ec_group_do_inverse_ord(group, u2, sig->s, ctx)) {
                ^
362.           ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
363.           goto err;

crypto/ec/ec_lib.c:1092:1: Parameter `group->order->top`
  1090.    * other functionality.
  1091.    */
  1092. > int ec_group_do_inverse_ord(const EC_GROUP *group, BIGNUM *res,
  1093.                               const BIGNUM *x, BN_CTX *ctx)
  1094.   {

crypto/ec/ecdsa_ossl.c:366:9: Call
364.       }
365.       /* digest -> m */
366.       i = BN_num_bits(order);
               ^
367.       /*
368.        * Need to truncate digest if it is too long: first truncate whole bytes.

crypto/bn/bn_lib.c:140:9: Call
  138.       bn_check_top(a);
  139.   
  140.       if (BN_is_zero(a))
                 ^
  141.           return 0;
  142.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));

crypto/bn/bn_lib.c:852:1: Parameter `a->top`
    850.   }
    851.   
    852. > int BN_is_zero(const BIGNUM *a)
    853.   {
    854.       return a->top == 0;

crypto/ec/ecdsa_ossl.c:382:10: Call
380.       }
381.       /* u1 = m * tmp mod order */
382.       if (!BN_mod_mul(u1, m, u2, order, ctx)) {
                ^
383.           ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
384.           goto err;

crypto/bn/bn_mod.c:193:1: Parameter `m->top`
  191.   
  192.   /* slow but works */
  193. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
  194.                  BN_CTX *ctx)
  195.   {

crypto/ec/ecdsa_ossl.c:387:10: Call
385.       }
386.       /* u2 = r * w mod q */
387.       if (!BN_mod_mul(u2, sig->r, u2, order, ctx)) {
                ^
388.           ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
389.           goto err;

crypto/bn/bn_mod.c:193:1: Parameter `m->top`
  191.   
  192.   /* slow but works */
  193. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
  194.                  BN_CTX *ctx)
  195.   {

crypto/ec/ecdsa_ossl.c:396:10: Call
394.           goto err;
395.       }
396.       if (!EC_POINT_mul(group, point, u1, pub_key, u2, ctx)) {
                ^
397.           ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);
398.           goto err;

crypto/ec/ec_lib.c:947:1: Parameter `group->order->top`
  945.   }
  946.   
  947. > int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
  948.                    const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
  949.   {

crypto/ec/ec_lib.c:958:12: Call
  956.       scalars[0] = p_scalar;
  957.   
  958.       return EC_POINTs_mul(group, r, g_scalar,
                    ^
  959.                            (point != NULL
  960.                             && p_scalar != NULL), points, scalars, ctx);

crypto/ec/ec_lib.c:909:1: Parameter `group->order->top`
    907.    */
    908.   
    909. > int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
    910.                     size_t num, const EC_POINT *points[],
    911.                     const BIGNUM *scalars[], BN_CTX *ctx)

crypto/ec/ec_lib.c:941:15: Call
    939.       else
    940.           /* use default */
    941.           ret = ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
                         ^
    942.   
    943.       BN_CTX_free(new_ctx);

crypto/ec/ec_mult.c:410:1: Parameter `group->order->top`
      408.    * in the addition if scalar != NULL
      409.    */
      410. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
      411.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
      412.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:438:10: Call
      436.       int ret = 0;
      437.   
      438.       if (!BN_is_zero(group->order) && !BN_is_zero(group->cofactor)) {
                      ^
      439.           /*-
      440.            * Handle the common cases where the scalar is secret, enforcing a

crypto/bn/bn_lib.c:852:1: Parameter `a->top`
        850.   }
        851.   
        852. > int BN_is_zero(const BIGNUM *a)
        853.   {
        854.       return a->top == 0;

crypto/ec/ec_mult.c:453:20: Call
      451.                * always call the ladder version.
      452.                */
      453.               return ec_scalar_mul_ladder(group, r, scalar, NULL, ctx);
                                ^
      454.           }
      455.           if ((scalar == NULL) && (num == 1)) {

crypto/ec/ec_mult.c:139:1: Parameter `group->order->top`
        137.    * Returns 1 on success, 0 otherwise.
        138.    */
        139. > int ec_scalar_mul_ladder(const EC_GROUP *group, EC_POINT *r,
        140.                            const BIGNUM *scalar, const EC_POINT *point,
        141.                            BN_CTX *ctx)

crypto/ec/ec_mult.c:155:9: Call
        153.           return EC_POINT_set_to_infinity(group, r);
        154.   
        155.       if (BN_is_zero(group->order)) {
                       ^
        156.           ECerr(EC_F_EC_SCALAR_MUL_LADDER, EC_R_UNKNOWN_ORDER);
        157.           return 0;

crypto/bn/bn_lib.c:852:1: Parameter `a->top`
          850.   }
          851.   
          852. > int BN_is_zero(const BIGNUM *a)
          853.   {
          854.       return a->top == 0;

crypto/ec/ec_mult.c:196:10: Call
        194.       }
        195.   
        196.       if (!BN_mul(cardinality, group->order, group->cofactor, ctx)) {
                        ^
        197.           ECerr(EC_F_EC_SCALAR_MUL_LADDER, ERR_R_BN_LIB);
        198.           goto err;

crypto/bn/bn_mul.c:497:1: Parameter `a->top`
          495.   #endif                          /* BN_RECURSION */
          496.   
          497. > int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
          498.   {
          499.       int ret = bn_mul_fixed_top(r, a, b, ctx);

crypto/bn/bn_mul.c:499:15: Call
          497.   int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
          498.   {
          499.       int ret = bn_mul_fixed_top(r, a, b, ctx);
                               ^
          500.   
          501.       bn_correct_top(r);

crypto/bn/bn_mul.c:507:1: Parameter `a->top`
            505.   }
            506.   
            507. > int bn_mul_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
            508.   {
            509.       int ret = 0;

crypto/bn/bn_mul.c:524:5: Assignment
            522.       bn_check_top(r);
            523.   
            524.       al = a->top;
                       ^
            525.       bl = b->top;
            526.   

crypto/bn/bn_mul.c:571:21: Call
            569.                */
            570.               if (i >= 0) {
            571.                   j = BN_num_bits_word((BN_ULONG)al);
                                       ^
            572.               }
            573.               if (i == -1) {

crypto/bn/bn_lib.c:90:1: <RHS trace>
88.   }
89.   
90. > int BN_num_bits_word(BN_ULONG l)
91.   {
92.       BN_ULONG x, mask;

crypto/bn/bn_lib.c:90:1: Parameter `l`
              88.   }
              89.   
              90. > int BN_num_bits_word(BN_ULONG l)
              91.   {
              92.       BN_ULONG x, mask;

crypto/bn/bn_lib.c:96:5: Assignment
              94.   
              95.   #if BN_BITS2 > 32
              96.       x = l >> 32;
                        ^
              97.       mask = (0 - x) & BN_MASK2;
              98.       mask = (0 - (mask >> (BN_BITS2 - 1)));

crypto/bn/bn_lib.c:97:5: Binary operation: (0 - [0, max(1, eckey->group->order->top)]):unsigned64 by call to `EC_POINT_mul` 
              95.   #if BN_BITS2 > 32
              96.       x = l >> 32;
              97.       mask = (0 - x) & BN_MASK2;
                         ^
              98.       mask = (0 - (mask >> (BN_BITS2 - 1)));
              99.       bits += 32 & mask;
