crypto/ec/curve448/eddsa.c:111: error: INTEGER_OVERFLOW_L2
  (0 - [0, 1]):unsigned64 by call to `curve448_scalar_halve`.
Showing all 6 steps of the trace


crypto/ec/curve448/eddsa.c:99:5: Call
97.       clamp(secret_scalar_ser);
98.   
99.       curve448_scalar_decode_long(secret_scalar, secret_scalar_ser,
           ^
100.                                   sizeof(secret_scalar_ser));
101.   

crypto/ec/curve448/scalar.c:173:1: Parameter `s->limb[*]`
  171.   }
  172.   
  173. > void curve448_scalar_decode_long(curve448_scalar_t s,
  174.                                    const unsigned char *ser, size_t ser_len)
  175.   {

crypto/ec/curve448/eddsa.c:111:9: Call
109.        */
110.       for (c = 1; c < C448_EDDSA_ENCODE_RATIO; c <<= 1)
111.           curve448_scalar_halve(secret_scalar, secret_scalar);
               ^
112.   
113.       curve448_precomputed_scalarmul(p, curve448_precomputed_base, secret_scalar);

crypto/ec/curve448/scalar.c:221:1: <RHS trace>
219.   }
220.   
221. > void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
222.   {
223.       c448_word_t mask = 0 - (a->limb[0] & 1);

crypto/ec/curve448/scalar.c:221:1: Parameter `a->limb[*]`
  219.   }
  220.   
  221. > void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
  222.   {
  223.       c448_word_t mask = 0 - (a->limb[0] & 1);

crypto/ec/curve448/scalar.c:223:5: Binary operation: (0 - [0, 1]):unsigned64 by call to `curve448_scalar_halve` 
  221.   void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a)
  222.   {
  223.       c448_word_t mask = 0 - (a->limb[0] & 1);
             ^
  224.       c448_dword_t chain = 0;
  225.       unsigned int i;
