crypto/rsa/rsa_eay.c:608: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `RSA_padding_check_PKCS1_OAEP`.
Showing all 13 steps of the trace


crypto/rsa/rsa_eay.c:563:14: Unknown value from: non-const function
561.            (rsa->q != NULL) &&
562.            (rsa->dmp1 != NULL) && (rsa->dmq1 != NULL) && (rsa->iqmp != NULL))) {
563.           if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx))
                    ^
564.               goto err;
565.       } else {

crypto/rsa/rsa_eay.c:600:9: Call
598.   
599.       p = buf;
600.       j = BN_bn2bin(ret, p);      /* j is only used with no-padding mode */
               ^
601.   
602.       switch (padding) {

crypto/bn/bn_lib.c:590:1: Parameter `*a->d`
  588.   
  589.   /* ignore negative */
  590. > int BN_bn2bin(const BIGNUM *a, unsigned char *to)
  591.   {
  592.       int n, i;

crypto/bn/bn_lib.c:596:13: Call
  594.   
  595.       bn_check_top(a);
  596.       n = i = BN_num_bytes(a);
                     ^
  597.       while (i--) {
  598.           l = a->d[i / BN_BYTES];

crypto/bn/bn_lib.c:216:1: Parameter `*a->d`
    214.   }
    215.   
    216. > int BN_num_bits(const BIGNUM *a)
    217.   {
    218.       int i = a->top - 1;

crypto/rsa/rsa_eay.c:608:13: Call
606.   # ifndef OPENSSL_NO_SHA
607.       case RSA_PKCS1_OAEP_PADDING:
608.           r = RSA_padding_check_PKCS1_OAEP(to, num, buf, j, num, NULL, 0);
                   ^
609.           break;
610.   # endif

crypto/rsa/rsa_oaep.c:105:1: Parameter `*from`
  103.   }
  104.   
  105. > int RSA_padding_check_PKCS1_OAEP(unsigned char *to, int tlen,
  106.                                    const unsigned char *from, int flen, int num,
  107.                                    const unsigned char *param, int plen)

crypto/rsa/rsa_oaep.c:109:12: Call
  107.                                    const unsigned char *param, int plen)
  108.   {
  109.       return RSA_padding_check_PKCS1_OAEP_mgf1(to, tlen, from, flen, num,
                    ^
  110.                                                param, plen, NULL, NULL);
  111.   }

crypto/rsa/rsa_oaep.c:113:1: Parameter `*from`
    111.   }
    112.   
    113. > int RSA_padding_check_PKCS1_OAEP_mgf1(unsigned char *to, int tlen,
    114.                                         const unsigned char *from, int flen,
    115.                                         int num, const unsigned char *param,

crypto/rsa/rsa_oaep.c:174:12: Call
    172.        * Optimal Asymmetric Encryption Padding (OAEP) [...]", CRYPTO 2001).
    173.        */
    174.       good = constant_time_is_zero(em[0]);
                      ^
    175.   
    176.       maskedseed = em + 1;

crypto/constant_time_locl.h:158:1: <LHS trace>
156.   }
157.   
158. > static inline unsigned int constant_time_is_zero(unsigned int a)
159.   {
160.       return constant_time_msb(~a & (a - 1));

crypto/constant_time_locl.h:158:1: Parameter `a`
      156.   }
      157.   
      158. > static inline unsigned int constant_time_is_zero(unsigned int a)
      159.   {
      160.       return constant_time_msb(~a & (a - 1));

crypto/constant_time_locl.h:160:12: Binary operation: ([0, +oo] - 1):unsigned32 by call to `RSA_padding_check_PKCS1_OAEP` 
      158.   static inline unsigned int constant_time_is_zero(unsigned int a)
      159.   {
      160.       return constant_time_msb(~a & (a - 1));
                        ^
      161.   }
      162.   
