crypto/bn/bntest.c:1695: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned64 by call to `BN_mod_exp_recp`.
Showing all 21 steps of the trace


crypto/bn/bntest.c:1684:8: Call
1682.   	for (i = 0; i < num0; i++)
1683.   		{
1684.   		if (!BN_bntest_rand(a, 512, 0, 0)) goto err;
               ^
1685.   		a->neg = rand_neg();
1686.   

crypto/bn/bn_rand.c:224:9: Call
  222.   int     BN_bntest_rand(BIGNUM *rnd, size_t bits, int top, int bottom)
  223.   	{
  224.   	return bnrand(2, rnd, bits, top, bottom);
                 ^
  225.   	}
  226.   #endif

crypto/bn/bn_rand.c:118:1: Parameter `rnd->top`
    116.   #include <openssl/rand.h>
    117.   
    118. > static int bnrand(int pseudorand, BIGNUM *rnd, int bits, int top, int bottom)
    119.   	{
    120.   	unsigned char *buf=NULL;

crypto/bn/bntest.c:1688:8: Call
1686.   
1687.   		/* t := (|b|-1)/2  (note that b is odd) */
1688.   		if (!BN_copy(t, b)) goto err;
               ^
1689.   		t->neg = 0;
1690.   		if (!BN_sub_word(t, 1)) goto err;

crypto/bn/bn_lib.c:497:1: Parameter `a->dmax`
  495.   	}
  496.   
  497. > BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
  498.   	{
  499.   	int i;

crypto/bn/bntest.c:1690:8: Call
1688.   		if (!BN_copy(t, b)) goto err;
1689.   		t->neg = 0;
1690.   		if (!BN_sub_word(t, 1)) goto err;
               ^
1691.   		if (!BN_rshift1(t, t)) goto err;
1692.   		/* r := a^t mod b */

crypto/bn/bn_word.c:178:1: Parameter `a->top`
  176.   	}
  177.   
  178. > int BN_sub_word(BIGNUM *a, BN_ULONG w)
  179.   	{
  180.   	int i;

crypto/bn/bntest.c:1691:8: Call
1689.   		t->neg = 0;
1690.   		if (!BN_sub_word(t, 1)) goto err;
1691.   		if (!BN_rshift1(t, t)) goto err;
               ^
1692.   		/* r := a^t mod b */
1693.   		b->neg=0;

crypto/bn/bn_shift.c:99:1: Parameter `r->dmax`
  97.   	}
  98.   
  99. > int BN_rshift1(BIGNUM *r, const BIGNUM *a)
  100.   	{
  101.   	BN_ULONG *ap,*rp,t,c;

crypto/bn/bntest.c:1695:8: Call
1693.   		b->neg=0;
1694.   		
1695.   		if (!BN_mod_exp_recp(r, a, t, b, ctx)) goto err;
               ^
1696.   		b->neg=1;
1697.   

crypto/bn/bn_exp.c:238:1: Parameter `a->top`
  236.   
  237.   
  238. > int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
  239.   		    const BIGNUM *m, BN_CTX *ctx)
  240.   	{

crypto/bn/bn_exp.c:281:7: Call
  279.   		}
  280.   
  281.   	if (!BN_nnmod(val[0],a,m,ctx)) goto err;		/* 1 */
               ^
  282.   	if (BN_is_zero(val[0]))
  283.   		{

crypto/bn/bn_mod.c:127:1: Parameter `m->top`
    125.   
    126.   
    127. > int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
    128.   	{
    129.   	/* like BN_mod, but returns non-negative remainder

crypto/bn/bn_mod.c:132:8: Call
    130.   	 * (i.e.,  0 <= r < |d|  always holds) */
    131.   
    132.   	if (!(BN_mod(r,m,d,ctx)))
                  ^
    133.   		return 0;
    134.   	if (!r->neg)

crypto/bn/bn_div.c:181:1: Parameter `num->top`
      179.   static int BN_div_no_branch(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
      180.           const BIGNUM *divisor, BN_CTX *ctx);
      181. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
      182.   	   BN_CTX *ctx)
      183.   	{

crypto/bn/bn_div.c:204:10: Call
      202.   	if ((BN_get_flags(num, BN_FLG_CONSTTIME) != 0) || (BN_get_flags(divisor, BN_FLG_CONSTTIME) != 0))
      203.   		{
      204.   		return BN_div_no_branch(dv, rm, num, divisor, ctx);
                      ^
      205.   		}
      206.   

crypto/bn/bn_div.c:426:1: Parameter `num->top`
        424.    * branches that may leak sensitive information.
        425.    */
        426. > static int BN_div_no_branch(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, 
        427.   	const BIGNUM *divisor, BN_CTX *ctx)
        428.   	{

crypto/bn/bn_div.c:460:8: Call
        458.   	sdiv->neg=0;
        459.   	norm_shift+=BN_BITS2;
        460.   	if (!(BN_lshift(snum,num,norm_shift))) goto err;
                      ^
        461.   	snum->neg=0;
        462.   

crypto/bn/bn_shift.c:132:1: <LHS trace>
130.   	}
131.   
132. > int BN_lshift(BIGNUM *r, const BIGNUM *a, int n)
133.   	{
134.   	int i,nw,lb,rb;

crypto/bn/bn_shift.c:132:1: Parameter `a->top`
          130.   	}
          131.   
          132. > int BN_lshift(BIGNUM *r, const BIGNUM *a, int n)
          133.   	{
          134.   	int i,nw,lb,rb;

crypto/bn/bn_shift.c:150:8: Binary operation: ([0, +oo] - 1):unsigned64 by call to `BN_mod_exp_recp` 
          148.   	t[a->top+nw]=0;
          149.   	if (lb == 0)
          150.   		for (i=a->top-1; i>=0; i--)
                        ^
          151.   			t[nw+i]=f[i];
          152.   	else
