crypto/rsa/rsa_ossl.c:594: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `RSA_padding_check_PKCS1_OAEP`.
Showing all 13 steps of the trace


crypto/rsa/rsa_ossl.c:551:14: Unknown value from: non-const function
549.            (rsa->q != NULL) &&
550.            (rsa->dmp1 != NULL) && (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) {
551.           if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx))
                    ^
552.               goto err;
553.       } else {

crypto/rsa/rsa_ossl.c:587:9: Call
585.   
586.       p = buf;
587.       j = BN_bn2bin(ret, p);      /* j is only used with no-padding mode */
               ^
588.   
589.       switch (padding) {

crypto/bn/bn_lib.c:587:1: Parameter `*a->d`
  585.   
  586.   /* ignore negative */
  587. > int BN_bn2bin(const BIGNUM *a, unsigned char *to)
  588.   {
  589.       int n, i;

crypto/bn/bn_lib.c:593:13: Call
  591.   
  592.       bn_check_top(a);
  593.       n = i = BN_num_bytes(a);
                     ^
  594.       while (i--) {
  595.           l = a->d[i / BN_BYTES];

crypto/bn/bn_lib.c:214:1: Parameter `*a->d`
    212.   }
    213.   
    214. > int BN_num_bits(const BIGNUM *a)
    215.   {
    216.       int i = a->top - 1;

crypto/rsa/rsa_ossl.c:594:13: Call
592.           break;
593.       case RSA_PKCS1_OAEP_PADDING:
594.           r = RSA_padding_check_PKCS1_OAEP(to, num, buf, j, num, NULL, 0);
                   ^
595.           break;
596.       case RSA_SSLV23_PADDING:

crypto/rsa/rsa_oaep.c:104:1: Parameter `*from`
  102.   }
  103.   
  104. > int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,
  105.                                    const unsigned char *from, int flen, int num,
  106.                                    const unsigned char *param, int plen)

crypto/rsa/rsa_oaep.c:108:12: Call
  106.                                    const unsigned char *param, int plen)
  107.   {
  108.       return RSA_padding_check_PKCS1_OAEP_mgf1(to, tlen, from, flen, num,
                    ^
  109.                                                param, plen, NULL, NULL);
  110.   }

crypto/rsa/rsa_oaep.c:112:1: Parameter `*from`
    110.   }
    111.   
    112. > int RSA_padding_check_PKCS1_OAEP_mgf1(unsigned char *to, int tlen,
    113.                                         const unsigned char *from, int flen,
    114.                                         int num, const unsigned char *param,

crypto/rsa/rsa_oaep.c:173:12: Call
    171.        * Optimal Asymmetric Encryption Padding (OAEP) [...]", CRYPTO 2001).
    172.        */
    173.       good = constant_time_is_zero(em[0]);
                      ^
    174.   
    175.       maskedseed = em + 1;

include/internal/constant_time_locl.h:166:1: <LHS trace>
164.   }
165.   
166. > static ossl_inline unsigned int constant_time_is_zero(unsigned int a)
167.   {
168.       return constant_time_msb(~a & (a - 1));

include/internal/constant_time_locl.h:166:1: Parameter `a`
      164.   }
      165.   
      166. > static ossl_inline unsigned int constant_time_is_zero(unsigned int a)
      167.   {
      168.       return constant_time_msb(~a & (a - 1));

include/internal/constant_time_locl.h:168:12: Binary operation: ([0, +oo] - 1):unsigned32 by call to `RSA_padding_check_PKCS1_OAEP` 
      166.   static ossl_inline unsigned int constant_time_is_zero(unsigned int a)
      167.   {
      168.       return constant_time_msb(~a & (a - 1));
                        ^
      169.   }
      170.   
