crypto/bn/bn_sqrt.c:98: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `BN_mod_exp`.
Showing all 51 steps of the trace


crypto/bn/bn_sqrt.c:75:10: Call
73.   
74.       /* A = a mod p */
75.       if (!BN_nnmod(A, a, p, ctx))
               ^
76.           goto end;
77.   

crypto/bn/bn_mod.c:20:11: Call
  18.        */
  19.   
  20.       if (!(BN_mod(r, m, d, ctx)))
                  ^
  21.           return 0;
  22.       if (!r->neg)

crypto/bn/bn_div.c:209:1: Parameter `ctx->pool.used`
    207.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
    208.    */
    209. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
    210.              BN_CTX *ctx)
    211.   {

crypto/bn/bn_sqrt.c:98:14: Call
96.           if (!BN_add_word(q, 1))
97.               goto end;
98.           if (!BN_mod_exp(ret, A, q, p, ctx))
                    ^
99.               goto end;
100.           err = 0;

crypto/bn/bn_exp.c:89:1: Parameter `ctx->pool.used`
  87.   }
  88.   
  89. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
  90.                  BN_CTX *ctx)
  91.   {

crypto/bn/bn_exp.c:144:19: Call
  142.           } else
  143.   # endif
  144.               ret = BN_mod_exp_mont(r, a, p, m, ctx, NULL);
                           ^
  145.       } else
  146.   #endif

crypto/bn/bn_exp.c:296:1: Parameter `ctx->pool.used`
    294.   }
    295.   
    296. > int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
    297.                       const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
    298.   {

crypto/bn/bn_exp.c:310:16: Call
    308.               || BN_get_flags(a, BN_FLG_CONSTTIME) != 0
    309.               || BN_get_flags(m, BN_FLG_CONSTTIME) != 0) {
    310.           return BN_mod_exp_mont_consttime(rr, a, p, m, ctx, in_mont);
                          ^
    311.       }
    312.   

crypto/bn/bn_exp.c:592:1: Parameter `ctx->pool.used`
      590.    * http://www.daemonology.net/hyperthreading-considered-harmful/)
      591.    */
      592. > int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
      593.                                 const BIGNUM *m, BN_CTX *ctx,
      594.                                 BN_MONT_CTX *in_mont)

crypto/bn/bn_exp.c:647:14: Call
      645.           if ((mont = BN_MONT_CTX_new()) == NULL)
      646.               goto err;
      647.           if (!BN_MONT_CTX_set(mont, m, ctx))
                          ^
      648.               goto err;
      649.       }

crypto/bn/bn_mont.c:263:1: Parameter `ctx->pool.used`
        261.   }
        262.   
        263. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
        264.   {
        265.       int i, ret = 0;

crypto/bn/bn_mont.c:272:15: Call
        270.   
        271.       BN_CTX_start(ctx);
        272.       if ((Ri = BN_CTX_get(ctx)) == NULL)
                             ^
        273.           goto err;
        274.       R = &(mont->RR);            /* grab RR as a temp */

crypto/bn/bn_ctx.c:204:1: Parameter `ctx->pool.used`
          202.   }
          203.   
          204. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
          205.   {
          206.       BIGNUM *ret;

crypto/bn/bn_mont.c:351:19: Call
        349.           if (BN_is_one(&tmod))
        350.               BN_zero(Ri);
        351.           else if ((BN_mod_inverse(Ri, R, &tmod, ctx)) == NULL)
                                 ^
        352.               goto err;
        353.           if (!BN_lshift(Ri, Ri, BN_BITS2))

crypto/bn/bn_gcd.c:124:1: Parameter `ctx->pool.used`
          122.                                           BN_CTX *ctx);
          123.   
          124. > BIGNUM *BN_mod_inverse(BIGNUM *in,
          125.                          const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
          126.   {

crypto/bn/bn_gcd.c:129:10: Call
          127.       BIGNUM *rv;
          128.       int noinv;
          129.       rv = int_bn_mod_inverse(in, a, n, ctx, &noinv);
                          ^
          130.       if (noinv)
          131.           BNerr(BN_F_BN_MOD_INVERSE, BN_R_NO_INVERSE);

crypto/bn/bn_gcd.c:135:1: Parameter `ctx->pool.used`
            133.   }
            134.   
            135. > BIGNUM *int_bn_mod_inverse(BIGNUM *in,
            136.                              const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx,
            137.                              int *pnoinv)

crypto/bn/bn_gcd.c:155:16: Call
            153.       if ((BN_get_flags(a, BN_FLG_CONSTTIME) != 0)
            154.           || (BN_get_flags(n, BN_FLG_CONSTTIME) != 0)) {
            155.           return BN_mod_inverse_no_branch(in, a, n, ctx);
                                  ^
            156.       }
            157.   

crypto/bn/bn_gcd.c:458:1: Parameter `ctx->pool.used`
              456.    * not contain branches that may leak sensitive information.
              457.    */
              458. > static BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in,
              459.                                           const BIGNUM *a, const BIGNUM *n,
              460.                                           BN_CTX *ctx)

crypto/bn/bn_gcd.c:470:9: Call
              468.   
              469.       BN_CTX_start(ctx);
              470.       A = BN_CTX_get(ctx);
                             ^
              471.       B = BN_CTX_get(ctx);
              472.       X = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:204:1: Parameter `ctx->pool.used`
                202.   }
                203.   
                204. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
                205.   {
                206.       BIGNUM *ret;

crypto/bn/bn_gcd.c:471:9: Call
              469.       BN_CTX_start(ctx);
              470.       A = BN_CTX_get(ctx);
              471.       B = BN_CTX_get(ctx);
                             ^
              472.       X = BN_CTX_get(ctx);
              473.       D = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:204:1: Parameter `ctx->pool.used`
                202.   }
                203.   
                204. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
                205.   {
                206.       BIGNUM *ret;

crypto/bn/bn_gcd.c:472:9: Call
              470.       A = BN_CTX_get(ctx);
              471.       B = BN_CTX_get(ctx);
              472.       X = BN_CTX_get(ctx);
                             ^
              473.       D = BN_CTX_get(ctx);
              474.       M = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:204:1: Parameter `ctx->pool.used`
                202.   }
                203.   
                204. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
                205.   {
                206.       BIGNUM *ret;

crypto/bn/bn_gcd.c:473:9: Call
              471.       B = BN_CTX_get(ctx);
              472.       X = BN_CTX_get(ctx);
              473.       D = BN_CTX_get(ctx);
                             ^
              474.       M = BN_CTX_get(ctx);
              475.       Y = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:204:1: Parameter `ctx->pool.used`
                202.   }
                203.   
                204. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
                205.   {
                206.       BIGNUM *ret;

crypto/bn/bn_gcd.c:474:9: Call
              472.       X = BN_CTX_get(ctx);
              473.       D = BN_CTX_get(ctx);
              474.       M = BN_CTX_get(ctx);
                             ^
              475.       Y = BN_CTX_get(ctx);
              476.       T = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:204:1: Parameter `ctx->pool.used`
                202.   }
                203.   
                204. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
                205.   {
                206.       BIGNUM *ret;

crypto/bn/bn_gcd.c:475:9: Call
              473.       D = BN_CTX_get(ctx);
              474.       M = BN_CTX_get(ctx);
              475.       Y = BN_CTX_get(ctx);
                             ^
              476.       T = BN_CTX_get(ctx);
              477.       if (T == NULL)

crypto/bn/bn_ctx.c:204:1: Parameter `ctx->pool.used`
                202.   }
                203.   
                204. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
                205.   {
                206.       BIGNUM *ret;

crypto/bn/bn_gcd.c:476:9: Call
              474.       M = BN_CTX_get(ctx);
              475.       Y = BN_CTX_get(ctx);
              476.       T = BN_CTX_get(ctx);
                             ^
              477.       if (T == NULL)
              478.           goto err;

crypto/bn/bn_ctx.c:204:1: Parameter `ctx->pool.used`
                202.   }
                203.   
                204. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
                205.   {
                206.       BIGNUM *ret;

crypto/bn/bn_gcd.c:504:18: Call
              502.               bn_init(&local_B);
              503.               BN_with_flags(&local_B, B, BN_FLG_CONSTTIME);
              504.               if (!BN_nnmod(B, &local_B, A, ctx))
                                      ^
              505.                   goto err;
              506.               /* Ensure local_B goes out of scope before any further use of B */

crypto/bn/bn_mod.c:13:1: Parameter `ctx->pool.used`
                11.   #include "bn_lcl.h"
                12.   
                13. > int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
                14.   {
                15.       /*

crypto/bn/bn_mod.c:20:11: Call
                18.        */
                19.   
                20.       if (!(BN_mod(r, m, d, ctx)))
                                ^
                21.           return 0;
                22.       if (!r->neg)

crypto/bn/bn_div.c:209:1: Parameter `ctx->pool.used`
                  207.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
                  208.    */
                  209. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
                  210.              BN_CTX *ctx)
                  211.   {

crypto/bn/bn_div.c:229:11: Call
                  227.       }
                  228.   
                  229.       ret = bn_div_fixed_top(dv, rm, num, divisor, ctx);
                                   ^
                  230.   
                  231.       if (ret) {

crypto/bn/bn_div.c:264:1: Parameter `ctx->pool.used`
                    262.    *       divisor's length is considered public;
                    263.    */
                    264. > int bn_div_fixed_top(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
                    265.                        const BIGNUM *divisor, BN_CTX *ctx)
                    266.   {

crypto/bn/bn_div.c:282:11: Call
                    280.       BN_CTX_start(ctx);
                    281.       res = (dv == NULL) ? BN_CTX_get(ctx) : dv;
                    282.       tmp = BN_CTX_get(ctx);
                                     ^
                    283.       snum = BN_CTX_get(ctx);
                    284.       sdiv = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:204:1: Parameter `ctx->pool.used`
                      202.   }
                      203.   
                      204. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
                      205.   {
                      206.       BIGNUM *ret;

crypto/bn/bn_div.c:283:12: Call
                    281.       res = (dv == NULL) ? BN_CTX_get(ctx) : dv;
                    282.       tmp = BN_CTX_get(ctx);
                    283.       snum = BN_CTX_get(ctx);
                                      ^
                    284.       sdiv = BN_CTX_get(ctx);
                    285.       if (sdiv == NULL)

crypto/bn/bn_ctx.c:204:1: Parameter `ctx->pool.used`
                      202.   }
                      203.   
                      204. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
                      205.   {
                      206.       BIGNUM *ret;

crypto/bn/bn_div.c:284:12: Call
                    282.       tmp = BN_CTX_get(ctx);
                    283.       snum = BN_CTX_get(ctx);
                    284.       sdiv = BN_CTX_get(ctx);
                                      ^
                    285.       if (sdiv == NULL)
                    286.           goto err;

crypto/bn/bn_ctx.c:204:1: Parameter `ctx->pool.used`
                      202.   }
                      203.   
                      204. > BIGNUM *BN_CTX_get(BN_CTX *ctx)
                      205.   {
                      206.       BIGNUM *ret;

crypto/bn/bn_div.c:450:5: Call
                    448.       if (rm != NULL)
                    449.           bn_rshift_fixed_top(rm, snum, norm_shift);
                    450.       BN_CTX_end(ctx);
                               ^
                    451.       return 1;
                    452.    err:

crypto/bn/bn_ctx.c:185:1: Parameter `ctx->pool.used`
                      183.   }
                      184.   
                      185. > void BN_CTX_end(BN_CTX *ctx)
                      186.   {
                      187.       if (ctx == NULL)

crypto/bn/bn_ctx.c:196:13: Call
                      194.           /* Does this stack frame have anything to release? */
                      195.           if (fp < ctx->used)
                      196.               BN_POOL_release(&ctx->pool, ctx->used - fp);
                                         ^
                      197.           ctx->used = fp;
                      198.           /* Unjam "too_many" in case "get" had failed */

crypto/bn/bn_ctx.c:340:1: <LHS trace>
338.   }
339.   
340. > static void BN_POOL_release(BN_POOL *p, unsigned int num)
341.   {
342.       unsigned int offset = (p->used - 1) % BN_CTX_POOL_SIZE;

crypto/bn/bn_ctx.c:340:1: Parameter `p->used`
                        338.   }
                        339.   
                        340. > static void BN_POOL_release(BN_POOL *p, unsigned int num)
                        341.   {
                        342.       unsigned int offset = (p->used - 1) % BN_CTX_POOL_SIZE;

crypto/bn/bn_ctx.c:342:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `BN_mod_exp` 
                        340.   static void BN_POOL_release(BN_POOL *p, unsigned int num)
                        341.   {
                        342.       unsigned int offset = (p->used - 1) % BN_CTX_POOL_SIZE;
                                   ^
                        343.   
                        344.       p->used -= num;
