crypto/ec/ec_mult.c:247: error: INTEGER_OVERFLOW_L2
  ([0, 1] - 1):unsigned64 by call to `BN_consttime_swap`.
Showing all 7 steps of the trace


crypto/ec/ec_mult.c:246:12: Call
244.        * k := scalar + 2*cardinality
245.        */
246.       kbit = BN_is_bit_set(lambda, cardinality_bits);
                  ^
247.       BN_consttime_swap(kbit, k, lambda, group_top + 2);
248.   

crypto/bn/bn_lib.c:655:9: Assignment
  653.       bn_check_top(a);
  654.       if (n < 0)
  655.           return 0;
                 ^
  656.       i = n / BN_BITS2;
  657.       j = n % BN_BITS2;

crypto/ec/ec_mult.c:246:5: Assignment
244.        * k := scalar + 2*cardinality
245.        */
246.       kbit = BN_is_bit_set(lambda, cardinality_bits);
           ^
247.       BN_consttime_swap(kbit, k, lambda, group_top + 2);
248.   

crypto/ec/ec_mult.c:247:5: Call
245.        */
246.       kbit = BN_is_bit_set(lambda, cardinality_bits);
247.       BN_consttime_swap(kbit, k, lambda, group_top + 2);
           ^
248.   
249.       group_top = bn_get_top(group->field);

crypto/bn/bn_lib.c:747:1: <LHS trace>
745.    * Assumes that no more than nwords are used by either a or b.
746.    */
747. > void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
748.   {
749.       BN_ULONG t;

crypto/bn/bn_lib.c:747:1: Parameter `condition`
  745.    * Assumes that no more than nwords are used by either a or b.
  746.    */
  747. > void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
  748.   {
  749.       BN_ULONG t;

crypto/bn/bn_lib.c:758:5: Binary operation: ([0, 1] - 1):unsigned64 by call to `BN_consttime_swap` 
  756.       bn_wcheck_size(b, nwords);
  757.   
  758.       condition = ((~condition & ((condition - 1))) >> (BN_BITS2 - 1)) - 1;
             ^
  759.   
  760.       t = (a->top ^ b->top) & condition;
