crypto/ec/ecp_oct.c:179: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned64 by call to `BN_usub`.
Showing all 8 steps of the trace


crypto/ec/ecp_oct.c:149:7: Call
147.   		}
148.   	
149.   	if (!BN_mod_sqrt(y, tmp1, &group->field, ctx))
             ^
150.   		{
151.   		unsigned long err = ERR_peek_last_error();

crypto/bn/bn_sqrt.c:182:8: Call
  180.   
  181.   		/* t := 2*a */
  182.   		if (!BN_mod_lshift1_quick(t, A, p)) goto end;
                ^
  183.   
  184.   		/* b := (2*a)^((|p|-5)/8) */

crypto/bn/bn_mod.c:223:1: Parameter `*m->d`
    221.   /* BN_mod_lshift1 variant that may be used if  a  is non-negative
    222.    * and less than  m */
    223. > int BN_mod_lshift1_quick(BIGNUM *r, const BIGNUM *a, const BIGNUM *m)
    224.   	{
    225.   	if (!BN_lshift1(r, a)) return 0;

crypto/ec/ecp_oct.c:179:8: Call
177.   			goto err;
178.   			}
179.   		if (!BN_usub(y, &group->field, y)) goto err;
              ^
180.   		}
181.   	if (y_bit != BN_is_odd(y))

crypto/bn/bn_add.c:168:1: <LHS trace>
166.   
167.   /* unsigned subtraction of b from a, a must be larger than b. */
168. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
169.   	{
170.   	int max,min,dif;

crypto/bn/bn_add.c:168:1: Parameter `*a->d`
  166.   
  167.   /* unsigned subtraction of b from a, a must be larger than b. */
  168. > int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
  169.   	{
  170.   	int max,min,dif;

crypto/bn/bn_add.c:226:4: Assignment
  224.   			{
  225.   			dif--;
  226.   			t1 = *(ap++);
            ^
  227.   			t2 = (t1-1)&BN_MASK2;
  228.   			*(rp++) = t2;

crypto/bn/bn_add.c:227:4: Binary operation: ([0, +oo] - 1):unsigned64 by call to `BN_usub` 
  225.   			dif--;
  226.   			t1 = *(ap++);
  227.   			t2 = (t1-1)&BN_MASK2;
            ^
  228.   			*(rp++) = t2;
  229.   			if (t1)
