crypto/bn/bn_exp.c:394: error: INTEGER_OVERFLOW_L2
  (0 - [0, 1]):unsigned64 by call to `bn_to_mont_fixed_top`.
Showing all 17 steps of the trace


crypto/bn/bn_exp.c:394:34: Call
392.       } else
393.   #endif
394.       if (!bn_to_mont_fixed_top(r, BN_value_one(), mont, ctx))
                                        ^
395.           goto err;
396.       for (;;) {

crypto/bn/bn_lib.c:83:5: Assignment
  81.   const BIGNUM *BN_value_one(void)
  82.   {
  83.       static const BN_ULONG data_one = 1L;
            ^
  84.       static const BIGNUM const_one =
  85.           { (BN_ULONG *)&data_one, 1, 1, 0, BN_FLG_STATIC_DATA };

crypto/bn/bn_exp.c:394:10: Call
392.       } else
393.   #endif
394.       if (!bn_to_mont_fixed_top(r, BN_value_one(), mont, ctx))
                ^
395.           goto err;
396.       for (;;) {

crypto/bn/bn_mont.c:222:1: Parameter `*a->d`
  220.   }
  221.   
  222. > int bn_to_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont,
  223.                            BN_CTX *ctx)
  224.   {

crypto/bn/bn_mont.c:225:12: Call
  223.                            BN_CTX *ctx)
  224.   {
  225.       return bn_mul_mont_fixed_top(r, a, &(mont->RR), mont, ctx);
                    ^
  226.   }
  227.   

crypto/bn/bn_mont.c:37:1: Parameter `*a->d`
    35.   }
    36.   
    37. > int bn_mul_mont_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
    38.                             BN_MONT_CTX *mont, BN_CTX *ctx)
    39.   {

crypto/bn/bn_mont.c:70:14: Call
    68.               goto err;
    69.       } else {
    70.           if (!bn_mul_fixed_top(tmp, a, b, ctx))
                       ^
    71.               goto err;
    72.       }

crypto/bn/bn_mul.c:507:1: Parameter `*a->d`
      505.   }
      506.   
      507. > int bn_mul_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
      508.   {
      509.       int ret = 0;

crypto/bn/bn_mul.c:587:17: Call
      585.                   if (bn_wexpand(rr, k * 4) == NULL)
      586.                       goto err;
      587.                   bn_mul_part_recursive(rr->d, a->d, b->d,
                             ^
      588.                                         j, al - j, bl - j, t->d);
      589.               } else {            /* al <= j || bl <= j */

crypto/bn/bn_mul.c:322:1: Parameter `*a`
        320.    */
        321.   /* tnX may not be negative but less than n */
        322. > void bn_mul_part_recursive(BN_ULONG *r, BN_ULONG *a, BN_ULONG *b, int n,
        323.                              int tna, int tnb, BN_ULONG *t)
        324.   {

crypto/bn/bn_mul.c:335:10: Call
        333.   
        334.       /* r=(a[0]-a[1])*(b[1]-b[0]) */
        335.       c1 = bn_cmp_part_words(a, &(a[n]), tna, n - tna);
                        ^
        336.       c2 = bn_cmp_part_words(&(b[n]), b, tnb, tnb - n);
        337.       neg = 0;

crypto/bn/bn_lib.c:706:1: Parameter `*b`
          704.    */
          705.   
          706. > int bn_cmp_part_words(const BN_ULONG *a, const BN_ULONG *b, int cl, int dl)
          707.   {
          708.       int n, i;

crypto/bn/bn_mul.c:340:9: Call
        338.       switch (c1 * 3 + c2) {
        339.       case -4:
        340.           bn_sub_part_words(t, &(a[n]), a, tna, tna - n); /* - */
                       ^
        341.           bn_sub_part_words(&(t[n]), b, &(b[n]), tnb, n - tnb); /* - */
        342.           break;

crypto/bn/bn_mul.c:27:1: <RHS trace>
25.    */
26.   
27. > BN_ULONG bn_sub_part_words(BN_ULONG *r,
28.                              const BN_ULONG *a, const BN_ULONG *b,
29.                              int cl, int dl)

crypto/bn/bn_mul.c:27:1: Parameter `*b`
          25.    */
          26.   
          27. > BN_ULONG bn_sub_part_words(BN_ULONG *r,
          28.                              const BN_ULONG *a, const BN_ULONG *b,
          29.                              int cl, int dl)

crypto/bn/bn_mul.c:45:13: Assignment
          43.       if (dl < 0) {
          44.           for (;;) {
          45.               t = b[0];
                            ^
          46.               r[0] = (0 - t - c) & BN_MASK2;
          47.               if (t != 0)

crypto/bn/bn_mul.c:46:13: Binary operation: (0 - [0, 1]):unsigned64 by call to `bn_to_mont_fixed_top` 
          44.           for (;;) {
          45.               t = b[0];
          46.               r[0] = (0 - t - c) & BN_MASK2;
                            ^
          47.               if (t != 0)
          48.                   c = 1;
