crypto/jpake/jpake.c:295: error: INTEGER_OVERFLOW_L2
  ([0, `ctx->p.p->top`] - 1):unsigned64 by call to `verify_zkp`.
Showing all 27 steps of the trace


crypto/jpake/jpake.c:285:1: Parameter `ctx->p.p->top`
283.       }
284.   
285. > int JPAKE_STEP1_process(JPAKE_CTX *ctx, const JPAKE_STEP1 *received)
286.       {
287.      /* verify their ZKP(xc) */

crypto/jpake/jpake.c:288:9: Call
286.       {
287.      /* verify their ZKP(xc) */
288.       if(!verify_zkp(&received->p1, ctx->p.g, ctx))
               ^
289.   	{
290.   	JPAKEerr(JPAKE_F_JPAKE_STEP1_PROCESS, JPAKE_R_VERIFY_X3_FAILED);

crypto/jpake/jpake.c:214:1: Parameter `ctx->p.p->top`
  212.       }
  213.   
  214. > static int verify_zkp(const JPAKE_STEP_PART *p, const BIGNUM *zkpg,
  215.   		      JPAKE_CTX *ctx)
  216.       {

crypto/jpake/jpake.c:226:5: Call
  224.   
  225.      /* t1 = g^b */
  226.       BN_mod_exp(t1, zkpg, p->zkpx.b, ctx->p.p, ctx->ctx);
             ^
  227.      /* t2 = (g^x)^h = g^{hx} */
  228.       BN_mod_exp(t2, p->gx, h, ctx->p.p, ctx->ctx);

crypto/bn/bn_exp.c:163:1: Parameter `m->top`
    161.   
    162.   
    163. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
    164.   	       BN_CTX *ctx)
    165.   	{

crypto/bn/bn_exp.c:219:8: Call
    217.   			{
    218.   			BN_ULONG A = a->d[0];
    219.   			ret=BN_mod_exp_mont_word(r,A,p,m,ctx,NULL);
                  ^
    220.   			}
    221.   		else

crypto/bn/bn_exp.c:727:1: Parameter `m->top`
      725.   	}
      726.   
      727. > int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
      728.                            const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
      729.   	{

crypto/jpake/jpake.c:228:5: Call
  226.       BN_mod_exp(t1, zkpg, p->zkpx.b, ctx->p.p, ctx->ctx);
  227.      /* t2 = (g^x)^h = g^{hx} */
  228.       BN_mod_exp(t2, p->gx, h, ctx->p.p, ctx->ctx);
             ^
  229.      /* t3 = t1 * t2 = g^{hx} * g^b = g^{hx+b} = g^r (allegedly) */
  230.       BN_mod_mul(t3, t1, t2, ctx->p.p, ctx->ctx);

crypto/bn/bn_exp.c:163:1: Parameter `m->top`
    161.   
    162.   
    163. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
    164.   	       BN_CTX *ctx)
    165.   	{

crypto/bn/bn_exp.c:219:8: Call
    217.   			{
    218.   			BN_ULONG A = a->d[0];
    219.   			ret=BN_mod_exp_mont_word(r,A,p,m,ctx,NULL);
                  ^
    220.   			}
    221.   		else

crypto/bn/bn_exp.c:727:1: Parameter `m->top`
      725.   	}
      726.   
      727. > int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
      728.                            const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
      729.   	{

crypto/jpake/jpake.c:230:5: Call
  228.       BN_mod_exp(t2, p->gx, h, ctx->p.p, ctx->ctx);
  229.      /* t3 = t1 * t2 = g^{hx} * g^b = g^{hx+b} = g^r (allegedly) */
  230.       BN_mod_mul(t3, t1, t2, ctx->p.p, ctx->ctx);
             ^
  231.   
  232.      /* verify t3 == g^r */

crypto/bn/bn_mod.c:178:1: Parameter `m->top`
    176.   
    177.   /* slow but works */
    178. > int BN_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *m,
    179.   	BN_CTX *ctx)
    180.   	{

crypto/jpake/jpake.c:295:9: Call
293.   
294.      /* verify their ZKP(xd) */
295.       if(!verify_zkp(&received->p2, ctx->p.g, ctx))
               ^
296.   	{
297.   	JPAKEerr(JPAKE_F_JPAKE_STEP1_PROCESS, JPAKE_R_VERIFY_X4_FAILED);

crypto/jpake/jpake.c:214:1: Parameter `ctx->p.p->top`
  212.       }
  213.   
  214. > static int verify_zkp(const JPAKE_STEP_PART *p, const BIGNUM *zkpg,
  215.   		      JPAKE_CTX *ctx)
  216.       {

crypto/jpake/jpake.c:226:5: Call
  224.   
  225.      /* t1 = g^b */
  226.       BN_mod_exp(t1, zkpg, p->zkpx.b, ctx->p.p, ctx->ctx);
             ^
  227.      /* t2 = (g^x)^h = g^{hx} */
  228.       BN_mod_exp(t2, p->gx, h, ctx->p.p, ctx->ctx);

crypto/bn/bn_exp.c:163:1: Parameter `m->top`
    161.   
    162.   
    163. > int BN_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
    164.   	       BN_CTX *ctx)
    165.   	{

crypto/bn/bn_exp.c:228:9: Call
    226.   #endif
    227.   #ifdef RECP_MUL_MOD
    228.   		{ ret=BN_mod_exp_recp(r,a,p,m,ctx); }
                   ^
    229.   #else
    230.   		{ ret=BN_mod_exp_simple(r,a,p,m,ctx); }

crypto/bn/bn_exp.c:238:1: Parameter `m->top`
      236.   
      237.   
      238. > int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
      239.   		    const BIGNUM *m, BN_CTX *ctx)
      240.   	{

crypto/bn/bn_exp.c:278:7: Call
      276.   	else
      277.   		{
      278.   		if (BN_RECP_CTX_set(&recp,m,ctx) <= 0) goto err;
                   ^
      279.   		}
      280.   

crypto/bn/bn_recp.c:94:1: Parameter `d->top`
        92.   	}
        93.   
        94. > int BN_RECP_CTX_set(BN_RECP_CTX *recp, const BIGNUM *d, BN_CTX *ctx)
        95.   	{
        96.   	if (!BN_copy(&(recp->N),d)) return 0;

crypto/bn/bn_recp.c:96:7: Call
        94.   int BN_RECP_CTX_set(BN_RECP_CTX *recp, const BIGNUM *d, BN_CTX *ctx)
        95.   	{
        96.   	if (!BN_copy(&(recp->N),d)) return 0;
                    ^
        97.   	BN_zero(&(recp->Nr));
        98.   	recp->num_bits=BN_num_bits(d);

crypto/bn/bn_lib.c:497:1: Parameter `a->dmax`
          495.   	}
          496.   
          497. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
          498.   	{
          499.   	int i;

crypto/bn/bn_recp.c:98:17: Call
        96.   	if (!BN_copy(&(recp->N),d)) return 0;
        97.   	BN_zero(&(recp->Nr));
        98.   	recp->num_bits=BN_num_bits(d);
                               ^
        99.   	recp->shift=0;
        100.   	return(1);

crypto/bn/bn_lib.c:248:1: <LHS trace>
246.   	}
247.   
248. > int BN_num_bits(const BIGNUM *a)
249.   	{
250.   	int i = a->top - 1;

crypto/bn/bn_lib.c:248:1: Parameter `a->top`
          246.   	}
          247.   
          248. > int BN_num_bits(const BIGNUM *a)
          249.   	{
          250.   	int i = a->top - 1;

crypto/bn/bn_lib.c:250:2: Binary operation: ([0, ctx->p.p->top] - 1):unsigned64 by call to `verify_zkp` 
          248.   int BN_num_bits(const BIGNUM *a)
          249.   	{
          250.   	int i = a->top - 1;
                  ^
          251.   	bn_check_top(a);
          252.   
