crypto/ec/ecdsa_ossl.c:464: error: INTEGER_OVERFLOW_L2
  (0 - [0, max(1, `eckey->group->order->top`)]):unsigned64 by call to `EC_POINT_mul`.
Showing all 30 steps of the trace


crypto/ec/ecdsa_ossl.c:377:1: Parameter `eckey->group->order->top`
375.   }
376.   
377. > int ossl_ecdsa_verify_sig(const unsigned char *dgst, int dgst_len,
378.                             const ECDSA_SIG *sig, EC_KEY *eckey)
379.   {

crypto/ec/ecdsa_ossl.c:429:10: Call
427.       }
428.       /* calculate tmp1 = inv(S) mod order */
429.       if (!ec_group_do_inverse_ord(group, u2, sig->s, ctx)) {
                ^
430.           ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
431.           goto err;

crypto/ec/ec_lib.c:1101:1: Parameter `group->order->top`
  1099.    * other functionality.
  1100.    */
  1101. > int ec_group_do_inverse_ord(const EC_GROUP *group, BIGNUM *res,
  1102.                               const BIGNUM *x, BN_CTX *ctx)
  1103.   {

crypto/ec/ecdsa_ossl.c:434:9: Call
432.       }
433.       /* digest -> m */
434.       i = BN_num_bits(order);
               ^
435.       /*
436.        * Need to truncate digest if it is too long: first truncate whole bytes.

crypto/bn/bn_lib.c:140:9: Call
  138.       bn_check_top(a);
  139.   
  140.       if (BN_is_zero(a))
                 ^
  141.           return 0;
  142.       return ((i * BN_BITS2) + BN_num_bits_word(a->d[i]));

crypto/bn/bn_lib.c:853:1: Parameter `a->top`
    851.   }
    852.   
    853. > int BN_is_zero(const BIGNUM *a)
    854.   {
    855.       return a->top == 0;

crypto/ec/ecdsa_ossl.c:450:10: Call
448.       }
449.       /* u1 = m * tmp mod order */
450.       if (!BN_mod_mul(u1, m, u2, order, ctx)) {
                ^
451.           ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
452.           goto err;

crypto/bn/bn_mod.c:73:1: Parameter `m->top`
  71.   
  72.   /* slow but works */
  73. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
  74.                  BN_CTX *ctx)
  75.   {

crypto/ec/ecdsa_ossl.c:455:10: Call
453.       }
454.       /* u2 = r * w mod q */
455.       if (!BN_mod_mul(u2, sig->r, u2, order, ctx)) {
                ^
456.           ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_BN_LIB);
457.           goto err;

crypto/bn/bn_mod.c:73:1: Parameter `m->top`
  71.   
  72.   /* slow but works */
  73. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
  74.                  BN_CTX *ctx)
  75.   {

crypto/ec/ecdsa_ossl.c:464:10: Call
462.           goto err;
463.       }
464.       if (!EC_POINT_mul(group, point, u1, pub_key, u2, ctx)) {
                ^
465.           ECerr(EC_F_OSSL_ECDSA_VERIFY_SIG, ERR_R_EC_LIB);
466.           goto err;

crypto/ec/ec_lib.c:956:1: Parameter `group->order->top`
  954.   }
  955.   
  956. > int EC_POINT_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *g_scalar,
  957.                    const EC_POINT *point, const BIGNUM *p_scalar, BN_CTX *ctx)
  958.   {

crypto/ec/ec_lib.c:967:12: Call
  965.       scalars[0] = p_scalar;
  966.   
  967.       return EC_POINTs_mul(group, r, g_scalar,
                    ^
  968.                            (point != NULL
  969.                             && p_scalar != NULL), points, scalars, ctx);

crypto/ec/ec_lib.c:918:1: Parameter `group->order->top`
    916.    */
    917.   
    918. > int EC_POINTs_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
    919.                     size_t num, const EC_POINT *points[],
    920.                     const BIGNUM *scalars[], BN_CTX *ctx)

crypto/ec/ec_lib.c:950:15: Call
    948.       else
    949.           /* use default */
    950.           ret = ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
                         ^
    951.   
    952.       BN_CTX_free(new_ctx);

crypto/ec/ec_mult.c:410:1: Parameter `group->order->top`
      408.    * in the addition if scalar != NULL
      409.    */
      410. > int ec_wNAF_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
      411.                   size_t num, const EC_POINT *points[], const BIGNUM *scalars[],
      412.                   BN_CTX *ctx)

crypto/ec/ec_mult.c:438:10: Call
      436.       int ret = 0;
      437.   
      438.       if (!BN_is_zero(group->order) && !BN_is_zero(group->cofactor)) {
                      ^
      439.           /*-
      440.            * Handle the common cases where the scalar is secret, enforcing a

crypto/bn/bn_lib.c:853:1: Parameter `a->top`
        851.   }
        852.   
        853. > int BN_is_zero(const BIGNUM *a)
        854.   {
        855.       return a->top == 0;

crypto/ec/ec_mult.c:453:20: Call
      451.                * always call the ladder version.
      452.                */
      453.               return ec_scalar_mul_ladder(group, r, scalar, NULL, ctx);
                                ^
      454.           }
      455.           if ((scalar == NULL) && (num == 1)) {

crypto/ec/ec_mult.c:139:1: Parameter `group->order->top`
        137.    * Returns 1 on success, 0 otherwise.
        138.    */
        139. > int ec_scalar_mul_ladder(const EC_GROUP *group, EC_POINT *r,
        140.                            const BIGNUM *scalar, const EC_POINT *point,
        141.                            BN_CTX *ctx)

crypto/ec/ec_mult.c:155:9: Call
        153.           return EC_POINT_set_to_infinity(group, r);
        154.   
        155.       if (BN_is_zero(group->order)) {
                       ^
        156.           ECerr(EC_F_EC_SCALAR_MUL_LADDER, EC_R_UNKNOWN_ORDER);
        157.           return 0;

crypto/bn/bn_lib.c:853:1: Parameter `a->top`
          851.   }
          852.   
          853. > int BN_is_zero(const BIGNUM *a)
          854.   {
          855.       return a->top == 0;

crypto/ec/ec_mult.c:196:10: Call
        194.       }
        195.   
        196.       if (!BN_mul(cardinality, group->order, group->cofactor, ctx)) {
                        ^
        197.           ECerr(EC_F_EC_SCALAR_MUL_LADDER, ERR_R_BN_LIB);
        198.           goto err;

crypto/bn/bn_mul.c:497:1: Parameter `a->top`
          495.   #endif                          /* BN_RECURSION */
          496.   
          497. > int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
          498.   {
          499.       int ret = 0;

crypto/bn/bn_mul.c:514:5: Assignment
          512.       bn_check_top(r);
          513.   
          514.       al = a->top;
                     ^
          515.       bl = b->top;
          516.   

crypto/bn/bn_mul.c:561:21: Call
          559.                */
          560.               if (i >= 0) {
          561.                   j = BN_num_bits_word((BN_ULONG)al);
                                     ^
          562.               }
          563.               if (i == -1) {

crypto/bn/bn_lib.c:90:1: <RHS trace>
88.   }
89.   
90. > int BN_num_bits_word(BN_ULONG l)
91.   {
92.       BN_ULONG x, mask;

crypto/bn/bn_lib.c:90:1: Parameter `l`
            88.   }
            89.   
            90. > int BN_num_bits_word(BN_ULONG l)
            91.   {
            92.       BN_ULONG x, mask;

crypto/bn/bn_lib.c:96:5: Assignment
            94.   
            95.   #if BN_BITS2 > 32
            96.       x = l >> 32;
                      ^
            97.       mask = (0 - x) & BN_MASK2;
            98.       mask = (0 - (mask >> (BN_BITS2 - 1)));

crypto/bn/bn_lib.c:97:5: Binary operation: (0 - [0, max(1, eckey->group->order->top)]):unsigned64 by call to `EC_POINT_mul` 
            95.   #if BN_BITS2 > 32
            96.       x = l >> 32;
            97.       mask = (0 - x) & BN_MASK2;
                       ^
            98.       mask = (0 - (mask >> (BN_BITS2 - 1)));
            99.       bits += 32 & mask;
