crypto/bn/bntest.c:1074: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `BN_mod_exp_mont_consttime`.
Showing all 31 steps of the trace


crypto/bn/bntest.c:1047:1: Parameter `ctx->stack.depth`
1045.    * x86_64 cause a different code branch to be taken.
1046.    */
1047. > int test_mod_exp_mont5(BIO *bp, BN_CTX *ctx)
1048.   {
1049.       BIGNUM *a, *p, *m, *d, *e;

crypto/bn/bntest.c:1065:10: Call
1063.       BN_bntest_rand(a, 1024, 0, 0);
1064.       BN_zero(p);
1065.       if (!BN_mod_exp_mont_consttime(d, a, p, m, ctx, NULL))
                 ^
1066.           return 0;
1067.       if (!BN_is_one(d)) {

crypto/bn/bn_exp.c:650:1: Parameter `ctx->stack.depth`
  648.    * http://www.daemong-consideredperthreading-considered-harmful/)
  649.    */
  650. > int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
  651.                                 const BIGNUM *m, BN_CTX *ctx,
  652.                                 BN_MONT_CTX *in_mont)

crypto/bn/bntest.c:1074:10: Call
1072.       BN_bntest_rand(p, 1024, 0, 0);
1073.       BN_zero(a);
1074.       if (!BN_mod_exp_mont_consttime(d, a, p, m, ctx, NULL))
                 ^
1075.           return 0;
1076.       if (!BN_is_zero(d)) {

crypto/bn/bn_exp.c:650:1: Parameter `ctx->stack.depth`
  648.    * http://www.daemong-consideredperthreading-considered-harmful/)
  649.    */
  650. > int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
  651.                                 const BIGNUM *m, BN_CTX *ctx,
  652.                                 BN_MONT_CTX *in_mont)

crypto/bn/bn_exp.c:683:5: Call
  681.       }
  682.   
  683.       BN_CTX_start(ctx);
             ^
  684.   
  685.       /*

crypto/bn/bn_ctx.c:253:1: Parameter `ctx->stack.depth`
    251.   }
    252.   
    253. > void BN_CTX_start(BN_CTX *ctx)
    254.   {
    255.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_exp.c:694:14: Call
  692.           if ((mont = BN_MONT_CTX_new()) == NULL)
  693.               goto err;
  694.           if (!BN_MONT_CTX_set(mont, m, ctx))
                      ^
  695.               goto err;
  696.       }

crypto/bn/bn_mont.c:347:1: Parameter `ctx->stack.depth`
    345.   }
    346.   
    347. > int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
    348.   {
    349.       int ret = 0;

crypto/bn/bn_mont.c:352:5: Call
    350.       BIGNUM *Ri, *R;
    351.   
    352.       BN_CTX_start(ctx);
               ^
    353.       if ((Ri = BN_CTX_get(ctx)) == NULL)
    354.           goto err;

crypto/bn/bn_ctx.c:253:1: Parameter `ctx->stack.depth`
      251.   }
      252.   
      253. > void BN_CTX_start(BN_CTX *ctx)
      254.   {
      255.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_mont.c:423:14: Call
    421.           tmod.top = buf[0] != 0 ? 1 : 0;
    422.           /* Ri = R^-1 mod N */
    423.           if ((BN_mod_inverse(Ri, R, &tmod, ctx)) == NULL)
                        ^
    424.               goto err;
    425.           if (!BN_lshift(Ri, Ri, BN_BITS2))

crypto/bn/bn_gcd.c:226:1: Parameter `ctx->stack.depth`
      224.                                           BN_CTX *ctx);
      225.   
      226. > BIGNUM *BN_mod_inverse(BIGNUM *in,
      227.                          const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
      228.   {

crypto/bn/bn_gcd.c:231:10: Call
      229.       BIGNUM *rv;
      230.       int noinv;
      231.       rv = int_bn_mod_inverse(in, a, n, ctx, &noinv);
                      ^
      232.       if (noinv)
      233.           BNerr(BN_F_BN_MOD_INVERSE, BN_R_NO_INVERSE);

crypto/bn/bn_gcd.c:237:1: Parameter `ctx->stack.depth`
        235.   }
        236.   
        237. > BIGNUM *int_bn_mod_inverse(BIGNUM *in,
        238.                              const BIGNUM *a, const BIGNUM *n, BN_CTX *ctx,
        239.                              int *pnoinv)

crypto/bn/bn_gcd.c:250:16: Call
        248.       if ((BN_get_flags(a, BN_FLG_CONSTTIME) != 0)
        249.           || (BN_get_flags(n, BN_FLG_CONSTTIME) != 0)) {
        250.           return BN_mod_inverse_no_branch(in, a, n, ctx);
                              ^
        251.       }
        252.   

crypto/bn/bn_gcd.c:557:1: Parameter `ctx->stack.depth`
          555.    * not contain branches that may leak sensitive information.
          556.    */
          557. > static BIGNUM *BN_mod_inverse_no_branch(BIGNUM *in,
          558.                                           const BIGNUM *a, const BIGNUM *n,
          559.                                           BN_CTX *ctx)

crypto/bn/bn_gcd.c:570:5: Call
          568.       bn_check_top(n);
          569.   
          570.       BN_CTX_start(ctx);
                     ^
          571.       A = BN_CTX_get(ctx);
          572.       B = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:253:1: Parameter `ctx->stack.depth`
            251.   }
            252.   
            253. > void BN_CTX_start(BN_CTX *ctx)
            254.   {
            255.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_gcd.c:603:14: Call
          601.           pB = &local_B;
          602.           BN_with_flags(pB, B, BN_FLG_CONSTTIME);
          603.           if (!BN_nnmod(B, pB, A, ctx))
                              ^
          604.               goto err;
          605.       }

crypto/bn/bn_mod.c:119:1: Parameter `ctx->stack.depth`
            117.   #include "bn_lcl.h"
            118.   
            119. > int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
            120.   {
            121.       /*

crypto/bn/bn_mod.c:126:11: Call
            124.        */
            125.   
            126.       if (!(BN_mod(r, m, d, ctx)))
                             ^
            127.           return 0;
            128.       if (!r->neg)

crypto/bn/bn_div.c:189:1: Parameter `ctx->stack.depth`
              187.    * If 'dv' or 'rm' is NULL, the respective value is not returned.
              188.    */
              189. > int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
              190.              BN_CTX *ctx)
              191.   {

crypto/bn/bn_div.c:242:5: Call
              240.       }
              241.   
              242.       BN_CTX_start(ctx);
                         ^
              243.       tmp = BN_CTX_get(ctx);
              244.       snum = BN_CTX_get(ctx);

crypto/bn/bn_ctx.c:253:1: Parameter `ctx->stack.depth`
                251.   }
                252.   
                253. > void BN_CTX_start(BN_CTX *ctx)
                254.   {
                255.       CTXDBG_ENTRY("BN_CTX_start", ctx);

crypto/bn/bn_div.c:469:5: Call
              467.       if (no_branch)
              468.           bn_correct_top(res);
              469.       BN_CTX_end(ctx);
                         ^
              470.       return (1);
              471.    err:

crypto/bn/bn_ctx.c:267:1: Parameter `ctx->stack.depth`
                265.   }
                266.   
                267. > void BN_CTX_end(BN_CTX *ctx)
                268.   {
                269.       CTXDBG_ENTRY("BN_CTX_end", ctx);

crypto/bn/bn_ctx.c:273:27: Call
                271.           ctx->err_stack--;
                272.       else {
                273.           unsigned int fp = BN_STACK_pop(&ctx->stack);
                                                 ^
                274.           /* Does this stack frame have anything to release? */
                275.           if (fp < ctx->used)

crypto/bn/bn_ctx.c:351:1: <LHS trace>
349.   }
350.   
351. > static unsigned int BN_STACK_pop(BN_STACK *st)
352.   {
353.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:351:1: Parameter `st->depth`
                  349.   }
                  350.   
                  351. > static unsigned int BN_STACK_pop(BN_STACK *st)
                  352.   {
                  353.       return st->indexes[--(st->depth)];

crypto/bn/bn_ctx.c:353:12: Binary operation: ([0, +oo] - 1):unsigned32 by call to `BN_mod_exp_mont_consttime` 
                  351.   static unsigned int BN_STACK_pop(BN_STACK *st)
                  352.   {
                  353.       return st->indexes[--(st->depth)];
                                    ^
                  354.   }
                  355.   
