_ZN6google8protobuf5Arena21CreateMessageInternalIN8asn1_pdu3PDUEEEPT_PS1_:
  551|  23.6k|  PROTOBUF_NDEBUG_INLINE static T* CreateMessageInternal(Arena* arena) {
  552|  23.6k|    static_assert(
  553|  23.6k|        InternalHelper<T>::is_arena_constructable::value,
  554|  23.6k|        "CreateMessage can only construct types that are ArenaConstructable");
  555|  23.6k|    if (arena == nullptr) {
  ------------------
  |  Branch (555:9): [True: 23.6k, False: 0]
  ------------------
  556|       |      // Generated arena constructor T(Arena*) is protected. Call via
  557|       |      // InternalHelper.
  558|  23.6k|      return InternalHelper<T>::New();
  559|  23.6k|    } else {
  560|      0|      return arena->DoCreateMessage<T>();
  561|      0|    }
  562|  23.6k|  }
_ZN6google8protobuf5Arena14InternalHelperIN8asn1_pdu3PDUEE3NewEv:
  487|  23.6k|    static inline PROTOBUF_ALWAYS_INLINE T* New() {
  488|  23.6k|      return new T(nullptr);
  489|  23.6k|    }
_ZN6google8protobuf5Arena21CreateMessageInternalIN8asn1_pdu10IdentifierEEEPT_PS1_:
  551|  29.1k|  PROTOBUF_NDEBUG_INLINE static T* CreateMessageInternal(Arena* arena) {
  552|  29.1k|    static_assert(
  553|  29.1k|        InternalHelper<T>::is_arena_constructable::value,
  554|  29.1k|        "CreateMessage can only construct types that are ArenaConstructable");
  555|  29.1k|    if (arena == nullptr) {
  ------------------
  |  Branch (555:9): [True: 29.1k, False: 0]
  ------------------
  556|       |      // Generated arena constructor T(Arena*) is protected. Call via
  557|       |      // InternalHelper.
  558|  29.1k|      return InternalHelper<T>::New();
  559|  29.1k|    } else {
  560|      0|      return arena->DoCreateMessage<T>();
  561|      0|    }
  562|  29.1k|  }
_ZN6google8protobuf5Arena14InternalHelperIN8asn1_pdu10IdentifierEE3NewEv:
  487|  29.1k|    static inline PROTOBUF_ALWAYS_INLINE T* New() {
  488|  29.1k|      return new T(nullptr);
  489|  29.1k|    }
_ZN6google8protobuf5Arena21CreateMessageInternalIN8asn1_pdu9TagNumberEEEPT_PS1_:
  551|  28.2k|  PROTOBUF_NDEBUG_INLINE static T* CreateMessageInternal(Arena* arena) {
  552|  28.2k|    static_assert(
  553|  28.2k|        InternalHelper<T>::is_arena_constructable::value,
  554|  28.2k|        "CreateMessage can only construct types that are ArenaConstructable");
  555|  28.2k|    if (arena == nullptr) {
  ------------------
  |  Branch (555:9): [True: 28.2k, False: 0]
  ------------------
  556|       |      // Generated arena constructor T(Arena*) is protected. Call via
  557|       |      // InternalHelper.
  558|  28.2k|      return InternalHelper<T>::New();
  559|  28.2k|    } else {
  560|      0|      return arena->DoCreateMessage<T>();
  561|      0|    }
  562|  28.2k|  }
_ZN6google8protobuf5Arena14InternalHelperIN8asn1_pdu9TagNumberEE3NewEv:
  487|  28.2k|    static inline PROTOBUF_ALWAYS_INLINE T* New() {
  488|  28.2k|      return new T(nullptr);
  489|  28.2k|    }
_ZN6google8protobuf5Arena21CreateMessageInternalIN8asn1_pdu6LengthEEEPT_PS1_:
  551|  29.0k|  PROTOBUF_NDEBUG_INLINE static T* CreateMessageInternal(Arena* arena) {
  552|  29.0k|    static_assert(
  553|  29.0k|        InternalHelper<T>::is_arena_constructable::value,
  554|  29.0k|        "CreateMessage can only construct types that are ArenaConstructable");
  555|  29.0k|    if (arena == nullptr) {
  ------------------
  |  Branch (555:9): [True: 29.0k, False: 0]
  ------------------
  556|       |      // Generated arena constructor T(Arena*) is protected. Call via
  557|       |      // InternalHelper.
  558|  29.0k|      return InternalHelper<T>::New();
  559|  29.0k|    } else {
  560|      0|      return arena->DoCreateMessage<T>();
  561|      0|    }
  562|  29.0k|  }
_ZN6google8protobuf5Arena14InternalHelperIN8asn1_pdu6LengthEE3NewEv:
  487|  29.0k|    static inline PROTOBUF_ALWAYS_INLINE T* New() {
  488|  29.0k|      return new T(nullptr);
  489|  29.0k|    }
_ZN6google8protobuf5Arena21CreateMessageInternalIN8asn1_pdu12ValueElementEEEPT_PS1_:
  551|  51.2k|  PROTOBUF_NDEBUG_INLINE static T* CreateMessageInternal(Arena* arena) {
  552|  51.2k|    static_assert(
  553|  51.2k|        InternalHelper<T>::is_arena_constructable::value,
  554|  51.2k|        "CreateMessage can only construct types that are ArenaConstructable");
  555|  51.2k|    if (arena == nullptr) {
  ------------------
  |  Branch (555:9): [True: 51.2k, False: 0]
  ------------------
  556|       |      // Generated arena constructor T(Arena*) is protected. Call via
  557|       |      // InternalHelper.
  558|  51.2k|      return InternalHelper<T>::New();
  559|  51.2k|    } else {
  560|      0|      return arena->DoCreateMessage<T>();
  561|      0|    }
  562|  51.2k|  }
_ZN6google8protobuf5Arena14InternalHelperIN8asn1_pdu12ValueElementEE3NewEv:
  487|  51.2k|    static inline PROTOBUF_ALWAYS_INLINE T* New() {
  488|  51.2k|      return new T(nullptr);
  489|  51.2k|    }
_ZN6google8protobuf5Arena21CreateMessageInternalIN8asn1_pdu5ValueEEEPT_PS1_:
  551|  28.9k|  PROTOBUF_NDEBUG_INLINE static T* CreateMessageInternal(Arena* arena) {
  552|  28.9k|    static_assert(
  553|  28.9k|        InternalHelper<T>::is_arena_constructable::value,
  554|  28.9k|        "CreateMessage can only construct types that are ArenaConstructable");
  555|  28.9k|    if (arena == nullptr) {
  ------------------
  |  Branch (555:9): [True: 28.9k, False: 0]
  ------------------
  556|       |      // Generated arena constructor T(Arena*) is protected. Call via
  557|       |      // InternalHelper.
  558|  28.9k|      return InternalHelper<T>::New();
  559|  28.9k|    } else {
  560|      0|      return arena->DoCreateMessage<T>();
  561|      0|    }
  562|  28.9k|  }
_ZN6google8protobuf5Arena14InternalHelperIN8asn1_pdu5ValueEE3NewEv:
  487|  28.9k|    static inline PROTOBUF_ALWAYS_INLINE T* New() {
  488|  28.9k|      return new T(nullptr);
  489|  28.9k|    }

_ZN6google8protobuf8internal15TaggedStringPtrC2EPNS1_21ExplicitlyConstructedINSt3__112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEELm8EEE:
  133|  51.2k|      : ptr_(ptr) {}
_ZNK6google8protobuf8internal15TaggedStringPtr3GetEv:
  189|  56.2k|  inline std::string* Get() const {
  190|  56.2k|    return reinterpret_cast<std::string*>(as_int() & ~kMask);
  191|  56.2k|  }
_ZNK6google8protobuf8internal15TaggedStringPtr6as_intEv:
  210|  56.2k|  uintptr_t as_int() const { return reinterpret_cast<uintptr_t>(ptr_); }
_ZNK6google8protobuf8internal14ArenaStringPtr3GetEv:
  299|  54.5k|  PROTOBUF_NDEBUG_INLINE const std::string& Get() const {
  300|       |    // Unconditionally mask away the tag.
  301|  54.5k|    return *tagged_ptr_.Get();
  302|  54.5k|  }
_ZN6google8protobuf8internal14ArenaStringPtr11InitDefaultEv:
  395|  51.2k|inline void ArenaStringPtr::InitDefault() {
  396|  51.2k|  tagged_ptr_ = TaggedStringPtr(&fixed_address_empty_string);
  397|  51.2k|}
_ZN6google8protobuf8internal14ArenaStringPtr22ClearNonDefaultToEmptyEv:
  475|  1.70k|inline void ArenaStringPtr::ClearNonDefaultToEmpty() {
  476|       |  // Unconditionally mask away the tag.
  477|  1.70k|  tagged_ptr_.Get()->clear();
  478|  1.70k|}

_ZN6google8protobuf8internal10CachedSizeC2Ev:
  198|   196k|  constexpr CachedSize() noexcept : atom_(Scalar{}) {}

_ZNK6google8protobuf8internal7HasBitsILm1EEixEi:
   61|  71.9k|  PROTOBUF_NDEBUG_INLINE const uint32_t& operator[](int index) const {
   62|  71.9k|    return has_bits_[index];
   63|  71.9k|  }
_ZN6google8protobuf8internal7HasBitsILm1EEixEi:
   57|  33.8k|  PROTOBUF_NDEBUG_INLINE uint32_t& operator[](int index) {
   58|  33.8k|    return has_bits_[index];
   59|  33.8k|  }
_ZN6google8protobuf8internal7HasBitsILm1EEC2Ev:
   51|   138k|  PROTOBUF_NDEBUG_INLINE constexpr HasBits() : has_bits_{} {}
_ZN6google8protobuf8internal7HasBitsILm1EE5ClearEv:
   53|  33.8k|  PROTOBUF_NDEBUG_INLINE void Clear() {
   54|  33.8k|    memset(has_bits_, 0, sizeof(has_bits_));
   55|  33.8k|  }

_ZN6google8protobuf7MessageC2EPNS0_5ArenaE:
  414|   196k|  inline explicit Message(Arena* arena) : MessageLite(arena) {}

_ZN6google8protobuf11MessageLiteC2EPNS0_5ArenaE:
  468|   196k|  inline explicit MessageLite(Arena* arena) : _internal_metadata_(arena) {}
_ZN6google8protobuf11MessageLite18CreateMaybeMessageIN8asn1_pdu3PDUEEEPT_PNS0_5ArenaE:
  464|  23.6k|  static T* CreateMaybeMessage(Arena* arena) {
  465|  23.6k|    return Arena::CreateMaybeMessage<T>(arena);
  466|  23.6k|  }
_ZN6google8protobuf11MessageLite18CreateMaybeMessageIN8asn1_pdu10IdentifierEEEPT_PNS0_5ArenaE:
  464|  29.1k|  static T* CreateMaybeMessage(Arena* arena) {
  465|  29.1k|    return Arena::CreateMaybeMessage<T>(arena);
  466|  29.1k|  }
_ZN6google8protobuf11MessageLite18CreateMaybeMessageIN8asn1_pdu9TagNumberEEEPT_PNS0_5ArenaE:
  464|  28.2k|  static T* CreateMaybeMessage(Arena* arena) {
  465|  28.2k|    return Arena::CreateMaybeMessage<T>(arena);
  466|  28.2k|  }
_ZN6google8protobuf11MessageLite18CreateMaybeMessageIN8asn1_pdu6LengthEEEPT_PNS0_5ArenaE:
  464|  29.0k|  static T* CreateMaybeMessage(Arena* arena) {
  465|  29.0k|    return Arena::CreateMaybeMessage<T>(arena);
  466|  29.0k|  }
_ZN6google8protobuf11MessageLite18CreateMaybeMessageIN8asn1_pdu12ValueElementEEEPT_PNS0_5ArenaE:
  464|  51.2k|  static T* CreateMaybeMessage(Arena* arena) {
  465|  51.2k|    return Arena::CreateMaybeMessage<T>(arena);
  466|  51.2k|  }
_ZN6google8protobuf11MessageLite18CreateMaybeMessageIN8asn1_pdu5ValueEEEPT_PNS0_5ArenaE:
  464|  28.9k|  static T* CreateMaybeMessage(Arena* arena) {
  465|  28.9k|    return Arena::CreateMaybeMessage<T>(arena);
  466|  28.9k|  }
_ZN6google8protobuf11MessageLiteD2Ev:
  175|   196k|  virtual ~MessageLite() = default;

_ZN6google8protobuf8internal16InternalMetadataC2EPNS0_5ArenaE:
   70|   196k|  explicit InternalMetadata(Arena* arena) {
   71|   196k|    ptr_ = reinterpret_cast<intptr_t>(arena);
   72|   196k|  }
_ZNK6google8protobuf8internal16InternalMetadata19have_unknown_fieldsEv:
  106|   244k|  PROTOBUF_NDEBUG_INLINE bool have_unknown_fields() const {
  107|   244k|    return HasUnknownFieldsTag();
  108|   244k|  }
_ZNK6google8protobuf8internal16InternalMetadata19HasUnknownFieldsTagEv:
  173|   244k|  PROTOBUF_ALWAYS_INLINE bool HasUnknownFieldsTag() const {
  174|   244k|    return ptr_ & kUnknownFieldsTagMask;
  175|   244k|  }
_ZNK6google8protobuf8internal16InternalMetadata8PtrValueINS0_5ArenaEEEPT_v:
  178|   196k|  U* PtrValue() const {
  179|   196k|    return reinterpret_cast<U*>(ptr_ & kPtrValueMask);
  180|   196k|  }
_ZN6google8protobuf8internal16InternalMetadata9MergeFromINS0_15UnknownFieldSetEEEvRKS2_:
  151|  4.56k|  PROTOBUF_NDEBUG_INLINE void MergeFrom(const InternalMetadata& other) {
  152|  4.56k|    if (other.have_unknown_fields()) {
  ------------------
  |  Branch (152:9): [True: 0, False: 4.56k]
  ------------------
  153|      0|      DoMergeFrom<T>(other.unknown_fields<T>(nullptr));
  154|      0|    }
  155|  4.56k|  }
_ZN6google8protobuf8internal16InternalMetadata17DeleteReturnArenaINS0_15UnknownFieldSetEEEPNS0_5ArenaEv:
   90|   196k|  Arena* DeleteReturnArena() {
   91|   196k|    if (have_unknown_fields()) {
  ------------------
  |  Branch (91:9): [True: 0, False: 196k]
  ------------------
   92|      0|      return DeleteOutOfLineHelper<T>();
   93|   196k|    } else {
   94|   196k|      return PtrValue<Arena>();
   95|   196k|    }
   96|   196k|  }
_ZN6google8protobuf8internal16InternalMetadata5ClearINS0_15UnknownFieldSetEEEvv:
  158|  43.7k|  PROTOBUF_NDEBUG_INLINE void Clear() {
  159|  43.7k|    if (have_unknown_fields()) {
  ------------------
  |  Branch (159:9): [True: 0, False: 43.7k]
  ------------------
  160|      0|      DoClear<T>();
  161|      0|    }
  162|  43.7k|  }

_ZN6google8protobuf8internal20RepeatedPtrFieldBaseC2EPNS0_5ArenaE:
  169|  28.9k|      : arena_(arena), current_size_(0), total_size_(0), rep_(nullptr) {}
_ZN6google8protobuf8internal20RepeatedPtrFieldBaseD2Ev:
  174|  28.9k|  ~RepeatedPtrFieldBase() {
  175|       |#ifndef NDEBUG
  176|       |    // Try to trigger segfault / asan failure in non-opt builds. If arena_
  177|       |    // lifetime has ended before the destructor.
  178|       |    if (arena_) (void)arena_->SpaceAllocated();
  179|       |#endif
  180|  28.9k|  }
_ZNK6google8protobuf8internal20RepeatedPtrFieldBase4sizeEv:
  183|  25.0k|  int size() const { return current_size_; }
_ZNK6google8protobuf8internal20RepeatedPtrFieldBase12NeedsDestroyEv:
  261|  28.9k|  bool NeedsDestroy() const { return rep_ != nullptr && arena_ == nullptr; }
  ------------------
  |  Branch (261:38): [True: 20.3k, False: 8.61k]
  |  Branch (261:57): [True: 20.3k, False: 0]
  ------------------
_ZNK6google8protobuf8internal20RepeatedPtrFieldBase8raw_dataEv:
  372|  50.0k|  void* const* raw_data() const { return rep_ ? rep_->elements : nullptr; }
  ------------------
  |  Branch (372:42): [True: 37.5k, False: 12.4k]
  ------------------
_ZN6google8protobuf8internal20RepeatedPtrFieldBase19ExchangeCurrentSizeEi:
  668|  1.58k|  inline int ExchangeCurrentSize(int new_size) {
  669|  1.58k|    int prev_size = current_size_;
  670|  1.58k|    current_size_ = new_size;
  671|  1.58k|    return prev_size;
  672|  1.58k|  }
_ZNK6google8protobuf16RepeatedPtrFieldIN8asn1_pdu12ValueElementEE4sizeEv:
 1329|  25.0k|inline int RepeatedPtrField<Element>::size() const {
 1330|  25.0k|  return RepeatedPtrFieldBase::size();
 1331|  25.0k|}
_ZN6google8protobuf16RepeatedPtrFieldIN8asn1_pdu12ValueElementEE5ClearEv:
 1484|  5.02k|inline void RepeatedPtrField<Element>::Clear() {
 1485|  5.02k|  RepeatedPtrFieldBase::Clear<TypeHandler>();
 1486|  5.02k|}
_ZN6google8protobuf8internal20RepeatedPtrFieldBase5ClearINS0_16RepeatedPtrFieldIN8asn1_pdu12ValueElementEE11TypeHandlerEEEvv:
  283|  5.02k|  void Clear() {
  284|  5.02k|    const int n = current_size_;
  285|  5.02k|    ABSL_DCHECK_GE(n, 0);
  ------------------
  |  |   78|  5.02k|  ABSL_DCHECK_GE_IMPL((val1), #val1, (val2), #val2)
  |  |  ------------------
  |  |  |  |   94|  5.02k|  ABSL_LOG_INTERNAL_DCHECK_NOP(val1, val2)
  |  |  |  |  ------------------
  |  |  |  |  |  |   56|  5.02k|  while (false && ((void)(x), (void)(y), 0)) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (56:10): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (56:19): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   57|  5.02k|  ::absl::log_internal::NullStream().InternalStream()
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  286|  5.02k|    if (n > 0) {
  ------------------
  |  Branch (286:9): [True: 1.58k, False: 3.43k]
  ------------------
  287|  1.58k|      ClearNonEmpty<TypeHandler>();
  288|  1.58k|    }
  289|  5.02k|  }
_ZN6google8protobuf8internal20RepeatedPtrFieldBase13ClearNonEmptyINS0_16RepeatedPtrFieldIN8asn1_pdu12ValueElementEE11TypeHandlerEEEvv:
  696|  1.58k|  PROTOBUF_NOINLINE void ClearNonEmpty() {
  697|  1.58k|    const int n = current_size_;
  698|  1.58k|    void* const* elements = rep_->elements;
  699|  1.58k|    int i = 0;
  700|  1.58k|    ABSL_DCHECK_GT(
  ------------------
  |  |   80|  1.58k|  ABSL_DCHECK_GT_IMPL((val1), #val1, (val2), #val2)
  |  |  ------------------
  |  |  |  |   96|  1.58k|  ABSL_LOG_INTERNAL_DCHECK_NOP(val1, val2)
  |  |  |  |  ------------------
  |  |  |  |  |  |   56|  1.58k|  while (false && ((void)(x), (void)(y), 0)) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (56:10): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (56:19): [Folded - Ignored]
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   57|  1.58k|  ::absl::log_internal::NullStream().InternalStream()
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  701|  1.58k|        n,
  702|  1.58k|        0);  // do/while loop to avoid initial test because we know n > 0
  703|  6.80k|    do {
  704|  6.80k|      TypeHandler::Clear(cast<TypeHandler>(elements[i++]));
  705|  6.80k|    } while (i < n);
  ------------------
  |  Branch (705:14): [True: 5.21k, False: 1.58k]
  ------------------
  706|  1.58k|    ExchangeCurrentSize(0);
  707|  1.58k|  }
_ZN6google8protobuf8internal18GenericTypeHandlerIN8asn1_pdu12ValueElementEE5ClearEPS4_:
  819|  6.80k|  static inline void Clear(GenericType* value) { value->Clear(); }
_ZN6google8protobuf8internal20RepeatedPtrFieldBase4castINS0_16RepeatedPtrFieldIN8asn1_pdu12ValueElementEE11TypeHandlerEEEPNT_4TypeEPv:
  685|  6.80k|  static inline typename TypeHandler::Type* cast(void* element) {
  686|  6.80k|    return reinterpret_cast<typename TypeHandler::Type*>(element);
  687|  6.80k|  }
_ZN6google8protobuf16RepeatedPtrFieldIN8asn1_pdu12ValueElementEEC2EPNS0_5ArenaE:
 1246|  28.9k|    : RepeatedPtrFieldBase(arena) {
 1247|  28.9k|  StaticValidityCheck();
 1248|  28.9k|}
_ZN6google8protobuf16RepeatedPtrFieldIN8asn1_pdu12ValueElementEE19StaticValidityCheckEv:
  913|  57.9k|  static constexpr PROTOBUF_ALWAYS_INLINE void StaticValidityCheck() {
  914|  57.9k|    static_assert(
  915|  57.9k|        absl::disjunction<
  916|  57.9k|            internal::is_supported_string_type<Element>,
  917|  57.9k|            internal::is_supported_message_type<Element>>::value,
  918|  57.9k|        "We only support string and Message types in RepeatedPtrField.");
  919|  57.9k|  }
_ZN6google8protobuf16RepeatedPtrFieldIN8asn1_pdu12ValueElementEED2Ev:
 1266|  28.9k|RepeatedPtrField<Element>::~RepeatedPtrField() {
 1267|  28.9k|  StaticValidityCheck();
 1268|       |#ifdef __cpp_if_constexpr
 1269|       |  if constexpr (std::is_base_of<MessageLite, Element>::value) {
 1270|       |#else
 1271|  28.9k|  if (std::is_base_of<MessageLite, Element>::value) {
  ------------------
  |  Branch (1271:7): [Folded - Ignored]
  ------------------
 1272|  28.9k|#endif
 1273|  28.9k|    if (NeedsDestroy()) DestroyProtos();
  ------------------
  |  Branch (1273:9): [True: 20.3k, False: 8.61k]
  ------------------
 1274|  28.9k|  } else {
 1275|      0|    Destroy<TypeHandler>();
 1276|      0|  }
 1277|  28.9k|}
_ZNK6google8protobuf16RepeatedPtrFieldIN8asn1_pdu12ValueElementEE5beginEv:
 1845|  25.0k|RepeatedPtrField<Element>::begin() const {
 1846|  25.0k|  return iterator(raw_data());
 1847|  25.0k|}
_ZN6google8protobuf8internal19RepeatedPtrIteratorIN8asn1_pdu12ValueElementEEC2EPKPv:
 1643|  50.0k|  explicit RepeatedPtrIterator(void* const* it) : it_(it) {}
_ZN6google8protobuf8internal19RepeatedPtrIteratorIKN8asn1_pdu12ValueElementEEC2IS4_LPv0EEERKNS2_IT_EE:
 1651|  50.0k|      : it_(other.it_) {}
_ZNK6google8protobuf16RepeatedPtrFieldIN8asn1_pdu12ValueElementEE3endEv:
 1860|  25.0k|RepeatedPtrField<Element>::end() const {
 1861|  25.0k|  return iterator(raw_data() + size());
 1862|  25.0k|}
_ZN6google8protobuf8internalneERKNS1_19RepeatedPtrIteratorIKN8asn1_pdu12ValueElementEEES8_:
 1673|  69.4k|  friend bool operator!=(const iterator& x, const iterator& y) {
 1674|  69.4k|    return x.it_ != y.it_;
 1675|  69.4k|  }
_ZN6google8protobuf8internal19RepeatedPtrIteratorIKN8asn1_pdu12ValueElementEEppEv:
 1658|  44.4k|  iterator& operator++() {
 1659|  44.4k|    ++it_;
 1660|  44.4k|    return *this;
 1661|  44.4k|  }
_ZNK6google8protobuf8internal19RepeatedPtrIteratorIKN8asn1_pdu12ValueElementEEdeEv:
 1654|  44.4k|  reference operator*() const { return *reinterpret_cast<Element*>(*it_); }
_ZN6google8protobuf16RepeatedPtrFieldIN8asn1_pdu12ValueElementEE9MergeFromERKS4_:
 1490|  1.06k|    const RepeatedPtrField& other) {
 1491|  1.06k|  RepeatedPtrFieldBase::MergeFrom<TypeHandler>(other);
 1492|  1.06k|}
_ZN6google8protobuf8internal20RepeatedPtrFieldBase9MergeFromINS0_16RepeatedPtrFieldIN8asn1_pdu12ValueElementEE11TypeHandlerEEEvRKS2_:
  292|  1.06k|  void MergeFrom(const RepeatedPtrFieldBase& other) {
  293|       |    // To avoid unnecessary code duplication and reduce binary size, we use a
  294|       |    // layered approach to implementing MergeFrom(). The toplevel method is
  295|       |    // templated, so we get a small thunk per concrete message type in the
  296|       |    // binary. This calls a shared implementation with most of the logic,
  297|       |    // passing a function pointer to another type-specific piece of code that
  298|       |    // calls the object-allocate and merge handlers.
  299|  1.06k|    ABSL_DCHECK_NE(&other, this);
  ------------------
  |  |   72|  1.06k|  ABSL_DCHECK_NE_IMPL((val1), #val1, (val2), #val2)
  |  |  ------------------
  |  |  |  |   88|  1.06k|  ABSL_LOG_INTERNAL_DCHECK_NOP(val1, val2)
  |  |  |  |  ------------------
  |  |  |  |  |  |   56|  1.06k|  while (false && ((void)(x), (void)(y), 0)) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (56:10): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (56:19): [True: 0, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   57|  1.06k|  ::absl::log_internal::NullStream().InternalStream()
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  300|  1.06k|    if (other.current_size_ == 0) return;
  ------------------
  |  Branch (300:9): [True: 1.06k, False: 0]
  ------------------
  301|      0|    MergeFromInternal(other,
  302|      0|                      &RepeatedPtrFieldBase::MergeFromInnerLoop<TypeHandler>);
  303|      0|  }

_ZN8asn1_pdu12ASN1PDUToDER20EncodeOverrideLengthERKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEm:
   30|  3.78k|                                        size_t len_pos) {
   31|  3.78k|  der_.insert(der_.begin() + len_pos, raw_len.begin(), raw_len.end());
   32|  3.78k|}
_ZN8asn1_pdu12ASN1PDUToDER22EncodeIndefiniteLengthEm:
   34|  1.23k|void ASN1PDUToDER::EncodeIndefiniteLength(size_t len_pos) {
   35|  1.23k|  der_.insert(der_.begin() + len_pos, 0x80);
   36|       |  // The PDU's value is from |len_pos| to the end of |der_|, so just add an
   37|       |  // EOC marker to the end.
   38|  1.23k|  der_.push_back(0x00);
   39|  1.23k|  der_.push_back(0x00);
   40|  1.23k|}
_ZN8asn1_pdu12ASN1PDUToDER20EncodeDefiniteLengthEmm:
   42|  19.9k|void ASN1PDUToDER::EncodeDefiniteLength(size_t actual_len, size_t len_pos) {
   43|  19.9k|  InsertVariableIntBase256(actual_len, len_pos, der_);
   44|       |  // X.690 (2015), 8.1.3.3: The long-form is used when the length is
   45|       |  // larger than 127.
   46|       |  // Note: |len_num_bytes| is not checked here, because it will equal
   47|       |  // 1 for values [128..255], but those require the long-form length.
   48|  19.9k|  if (actual_len > 127) {
  ------------------
  |  Branch (48:7): [True: 6.01k, False: 13.9k]
  ------------------
   49|       |    // See X.690 (2015) 8.1.3.5.
   50|       |    // Long-form length is encoded as a byte with the high-bit set to indicate
   51|       |    // the long-form, while the remaining bits indicate how many bytes are used
   52|       |    // to encode the length.
   53|  6.01k|    size_t len_num_bytes = GetVariableIntLen(actual_len, 256);
   54|  6.01k|    der_.insert(der_.begin() + len_pos, (0x80 | len_num_bytes));
   55|  6.01k|  }
   56|  19.9k|}
_ZN8asn1_pdu12ASN1PDUToDER12EncodeLengthERKNS_6LengthEmm:
   60|  25.0k|                                size_t len_pos) {
   61|  25.0k|  if (len.has_length_override()) {
  ------------------
  |  Branch (61:7): [True: 3.78k, False: 21.2k]
  ------------------
   62|  3.78k|    EncodeOverrideLength(len.length_override(), len_pos);
   63|  21.2k|  } else if (len.has_indefinite_form() && len.indefinite_form()) {
  ------------------
  |  Branch (63:14): [True: 1.44k, False: 19.7k]
  |  Branch (63:43): [True: 1.23k, False: 207]
  ------------------
   64|  1.23k|    EncodeIndefiniteLength(len_pos);
   65|  19.9k|  } else {
   66|  19.9k|    EncodeDefiniteLength(actual_len, len_pos);
   67|  19.9k|  }
   68|  25.0k|}
_ZN8asn1_pdu12ASN1PDUToDER11EncodeValueERKNS_5ValueE:
   70|  25.0k|void ASN1PDUToDER::EncodeValue(const Value& val) {
   71|  44.4k|  for (const auto& val_ele : val.val_array()) {
  ------------------
  |  Branch (71:28): [True: 44.4k, False: 25.0k]
  ------------------
   72|  44.4k|    if (recursion_exceeded_) {
  ------------------
  |  Branch (72:9): [True: 0, False: 44.4k]
  ------------------
   73|       |      // If the message exceeds the recursion limit, abort processing the
   74|       |      // protobuf in order to limit uninteresting work.
   75|      0|      return;
   76|      0|    }
   77|  44.4k|    if (val_ele.has_pdu()) {
  ------------------
  |  Branch (77:9): [True: 19.0k, False: 25.3k]
  ------------------
   78|  19.0k|      EncodePDU(val_ele.pdu());
   79|  25.3k|    } else {
   80|  25.3k|      der_.insert(der_.end(), val_ele.val_bits().begin(),
   81|  25.3k|                  val_ele.val_bits().end());
   82|  25.3k|    }
   83|  44.4k|  }
   84|  25.0k|}
_ZN8asn1_pdu12ASN1PDUToDER23EncodeHighTagNumberFormEhhj:
   88|  1.75k|                                           uint32_t tag_num) {
   89|       |  // High-tag-number form requires the lower 5 bits of the identifier to be set
   90|       |  // to 1 (X.690 (2015), 8.1.2.4.1).
   91|  1.75k|  der_.push_back(id_class | encoding | 0x1F);
   92|       |  // The high-tag-number form base 128 encodes |tag_num| (X.690 (2015), 8.1.2).
   93|  1.75k|  InsertVariableIntBase128(tag_num, der_.size(), der_);
   94|  1.75k|}
_ZN8asn1_pdu12ASN1PDUToDER16EncodeIdentifierERKNS_10IdentifierE:
   96|  25.0k|void ASN1PDUToDER::EncodeIdentifier(const Identifier& id) {
   97|       |  // The class comprises the 7th and 8th bit of the identifier (X.690
   98|       |  // (2015), 8.1.2).
   99|  25.0k|  uint8_t id_class = static_cast<uint8_t>(id.id_class()) << 6;
  100|       |  // The encoding comprises the 6th bit of the identifier (X.690 (2015), 8.1.2).
  101|  25.0k|  uint8_t encoding = static_cast<uint8_t>(id.encoding()) << 5;
  102|       |
  103|  25.0k|  uint32_t tag_num = id.tag_num().has_high_tag_num()
  ------------------
  |  Branch (103:22): [True: 1.88k, False: 23.1k]
  ------------------
  104|  25.0k|                         ? id.tag_num().high_tag_num()
  105|  25.0k|                         : id.tag_num().low_tag_num();
  106|       |  // When the tag number is greater than or equal to 31, encode with a single
  107|       |  // byte; otherwise, use the high-tag-number form (X.690 (2015), 8.1.2).
  108|  25.0k|  if (tag_num >= 31) {
  ------------------
  |  Branch (108:7): [True: 1.75k, False: 23.2k]
  ------------------
  109|  1.75k|    EncodeHighTagNumberForm(id_class, encoding, tag_num);
  110|  23.2k|  } else {
  111|  23.2k|    der_.push_back(static_cast<uint8_t>(id_class | encoding | tag_num));
  112|  23.2k|  }
  113|  25.0k|}
_ZN8asn1_pdu12ASN1PDUToDER9EncodePDUERKNS_3PDUE:
  115|  25.0k|void ASN1PDUToDER::EncodePDU(const PDU& pdu) {
  116|       |  // Artifically limit the stack depth to avoid stack overflow.
  117|  25.0k|  if (depth_ > kRecursionLimit) {
  ------------------
  |  Branch (117:7): [True: 0, False: 25.0k]
  ------------------
  118|      0|    recursion_exceeded_ = true;
  119|      0|    return;
  120|      0|  }
  121|  25.0k|  ++depth_;
  122|  25.0k|  EncodeIdentifier(pdu.id());
  123|  25.0k|  size_t len_pos = der_.size();
  124|  25.0k|  EncodeValue(pdu.val());
  125|  25.0k|  EncodeLength(pdu.len(), der_.size() - len_pos, len_pos);
  126|  25.0k|  --depth_;
  127|  25.0k|}
_ZN8asn1_pdu12ASN1PDUToDER8PDUToDERERKNS_3PDUE:
  129|  5.97k|std::vector<uint8_t> ASN1PDUToDER::PDUToDER(const PDU& pdu) {
  130|       |  // Reset the previous state.
  131|  5.97k|  der_.clear();
  132|  5.97k|  depth_ = 0;
  133|  5.97k|  recursion_exceeded_ = false;
  134|       |
  135|  5.97k|  EncodePDU(pdu);
  136|  5.97k|  if (recursion_exceeded_) {
  ------------------
  |  Branch (136:7): [True: 0, False: 5.97k]
  ------------------
  137|      0|    der_.clear();
  138|      0|  }
  139|  5.97k|  return der_;
  140|  5.97k|}

BN_parse_asn1_unsigned:
   21|  8.63k|int BN_parse_asn1_unsigned(CBS *cbs, BIGNUM *ret) {
   22|  8.63k|  CBS child;
   23|  8.63k|  int is_negative;
   24|  8.63k|  if (!CBS_get_asn1(cbs, &child, CBS_ASN1_INTEGER) ||
  ------------------
  |  |  215|  8.63k|#define CBS_ASN1_INTEGER 0x2u
  ------------------
  |  Branch (24:7): [True: 97, False: 8.53k]
  ------------------
   25|  8.63k|      !CBS_is_valid_asn1_integer(&child, &is_negative)) {
  ------------------
  |  Branch (25:7): [True: 15, False: 8.52k]
  ------------------
   26|    112|    OPENSSL_PUT_ERROR(BN, BN_R_BAD_ENCODING);
  ------------------
  |  |  441|    112|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   27|    112|    return 0;
   28|    112|  }
   29|       |
   30|  8.52k|  if (is_negative) {
  ------------------
  |  Branch (30:7): [True: 14, False: 8.50k]
  ------------------
   31|     14|    OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
  ------------------
  |  |  441|     14|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   32|     14|    return 0;
   33|     14|  }
   34|       |
   35|  8.50k|  return BN_bin2bn(CBS_data(&child), CBS_len(&child), ret) != NULL;
   36|  8.52k|}
BN_marshal_asn1:
   38|  3.26k|int BN_marshal_asn1(CBB *cbb, const BIGNUM *bn) {
   39|       |  // Negative numbers are unsupported.
   40|  3.26k|  if (BN_is_negative(bn)) {
  ------------------
  |  Branch (40:7): [True: 0, False: 3.26k]
  ------------------
   41|      0|    OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   42|      0|    return 0;
   43|      0|  }
   44|       |
   45|  3.26k|  CBB child;
   46|  3.26k|  if (!CBB_add_asn1(cbb, &child, CBS_ASN1_INTEGER) ||
  ------------------
  |  |  215|  3.26k|#define CBS_ASN1_INTEGER 0x2u
  ------------------
  |  Branch (46:7): [True: 0, False: 3.26k]
  ------------------
   47|       |      // The number must be padded with a leading zero if the high bit would
   48|       |      // otherwise be set or if |bn| is zero.
   49|  3.26k|      (BN_num_bits(bn) % 8 == 0 && !CBB_add_u8(&child, 0x00)) ||
  ------------------
  |  Branch (49:8): [True: 1.14k, False: 2.11k]
  |  Branch (49:36): [True: 0, False: 1.14k]
  ------------------
   50|  3.26k|      !BN_bn2cbb_padded(&child, BN_num_bytes(bn), bn) ||
  ------------------
  |  Branch (50:7): [True: 0, False: 3.26k]
  ------------------
   51|  3.26k|      !CBB_flush(cbb)) {
  ------------------
  |  Branch (51:7): [True: 0, False: 3.26k]
  ------------------
   52|      0|    OPENSSL_PUT_ERROR(BN, BN_R_ENCODE_ERROR);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   53|      0|    return 0;
   54|      0|  }
   55|       |
   56|  3.26k|  return 1;
   57|  3.26k|}

BN_bn2cbb_padded:
   72|  3.28k|int BN_bn2cbb_padded(CBB *out, size_t len, const BIGNUM *in) {
   73|  3.28k|  uint8_t *ptr;
   74|  3.28k|  return CBB_add_space(out, &ptr, len) && BN_bn2bin_padded(ptr, len, in);
  ------------------
  |  Branch (74:10): [True: 3.28k, False: 0]
  |  Branch (74:43): [True: 3.28k, False: 0]
  ------------------
   75|  3.28k|}

CBB_zero:
   27|  11.1k|void CBB_zero(CBB *cbb) {
   28|  11.1k|  OPENSSL_memset(cbb, 0, sizeof(CBB));
   29|  11.1k|}
CBB_init:
   41|    978|int CBB_init(CBB *cbb, size_t initial_capacity) {
   42|    978|  CBB_zero(cbb);
   43|       |
   44|    978|  uint8_t *buf = OPENSSL_malloc(initial_capacity);
   45|    978|  if (initial_capacity > 0 && buf == NULL) {
  ------------------
  |  Branch (45:7): [True: 0, False: 978]
  |  Branch (45:31): [True: 0, False: 0]
  ------------------
   46|      0|    return 0;
   47|      0|  }
   48|       |
   49|    978|  cbb_init(cbb, buf, initial_capacity, /*can_resize=*/1);
   50|    978|  return 1;
   51|    978|}
CBB_cleanup:
   59|  1.95k|void CBB_cleanup(CBB *cbb) {
   60|       |  // Child |CBB|s are non-owning. They are implicitly discarded and should not
   61|       |  // be used with |CBB_cleanup| or |ScopedCBB|.
   62|  1.95k|  assert(!cbb->is_child);
   63|  1.95k|  if (cbb->is_child) {
  ------------------
  |  Branch (63:7): [True: 0, False: 1.95k]
  ------------------
   64|      0|    return;
   65|      0|  }
   66|       |
   67|  1.95k|  if (cbb->u.base.can_resize) {
  ------------------
  |  Branch (67:7): [True: 1.95k, False: 0]
  ------------------
   68|  1.95k|    OPENSSL_free(cbb->u.base.buf);
   69|  1.95k|  }
   70|  1.95k|}
CBB_finish:
  125|    978|int CBB_finish(CBB *cbb, uint8_t **out_data, size_t *out_len) {
  126|    978|  if (cbb->is_child) {
  ------------------
  |  Branch (126:7): [True: 0, False: 978]
  ------------------
  127|      0|    OPENSSL_PUT_ERROR(CRYPTO, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  128|      0|    return 0;
  129|      0|  }
  130|       |
  131|    978|  if (!CBB_flush(cbb)) {
  ------------------
  |  Branch (131:7): [True: 0, False: 978]
  ------------------
  132|      0|    return 0;
  133|      0|  }
  134|       |
  135|    978|  if (cbb->u.base.can_resize && (out_data == NULL || out_len == NULL)) {
  ------------------
  |  Branch (135:7): [True: 978, False: 0]
  |  Branch (135:34): [True: 0, False: 978]
  |  Branch (135:54): [True: 0, False: 978]
  ------------------
  136|       |    // |out_data| and |out_len| can only be NULL if the CBB is fixed.
  137|      0|    return 0;
  138|      0|  }
  139|       |
  140|    978|  if (out_data != NULL) {
  ------------------
  |  Branch (140:7): [True: 978, False: 0]
  ------------------
  141|    978|    *out_data = cbb->u.base.buf;
  142|    978|  }
  143|    978|  if (out_len != NULL) {
  ------------------
  |  Branch (143:7): [True: 978, False: 0]
  ------------------
  144|    978|    *out_len = cbb->u.base.len;
  145|    978|  }
  146|    978|  cbb->u.base.buf = NULL;
  147|    978|  CBB_cleanup(cbb);
  148|    978|  return 1;
  149|    978|}
CBB_flush:
  161|  41.2k|int CBB_flush(CBB *cbb) {
  162|       |  // If |base| has hit an error, the buffer is in an undefined state, so
  163|       |  // fail all following calls. In particular, |cbb->child| may point to invalid
  164|       |  // memory.
  165|  41.2k|  struct cbb_buffer_st *base = cbb_get_base(cbb);
  166|  41.2k|  if (base == NULL || base->error) {
  ------------------
  |  Branch (166:7): [True: 0, False: 41.2k]
  |  Branch (166:23): [True: 0, False: 41.2k]
  ------------------
  167|      0|    return 0;
  168|      0|  }
  169|       |
  170|  41.2k|  if (cbb->child == NULL) {
  ------------------
  |  Branch (170:7): [True: 32.0k, False: 9.20k]
  ------------------
  171|       |    // Nothing to flush.
  172|  32.0k|    return 1;
  173|  32.0k|  }
  174|       |
  175|  9.20k|  assert(cbb->child->is_child);
  176|  9.20k|  struct cbb_child_st *child = &cbb->child->u.child;
  177|  9.20k|  assert(child->base == base);
  178|  9.20k|  size_t child_start = child->offset + child->pending_len_len;
  179|       |
  180|  9.20k|  if (!CBB_flush(cbb->child) ||
  ------------------
  |  Branch (180:7): [True: 0, False: 9.20k]
  ------------------
  181|  9.20k|      child_start < child->offset ||
  ------------------
  |  Branch (181:7): [True: 0, False: 9.20k]
  ------------------
  182|  9.20k|      base->len < child_start) {
  ------------------
  |  Branch (182:7): [True: 0, False: 9.20k]
  ------------------
  183|      0|    goto err;
  184|      0|  }
  185|       |
  186|  9.20k|  size_t len = base->len - child_start;
  187|       |
  188|  9.20k|  if (child->pending_is_asn1) {
  ------------------
  |  Branch (188:7): [True: 9.20k, False: 0]
  ------------------
  189|       |    // For ASN.1 we assume that we'll only need a single byte for the length.
  190|       |    // If that turned out to be incorrect, we have to move the contents along
  191|       |    // in order to make space.
  192|  9.20k|    uint8_t len_len;
  193|  9.20k|    uint8_t initial_length_byte;
  194|       |
  195|  9.20k|    assert (child->pending_len_len == 1);
  196|       |
  197|  9.20k|    if (len > 0xfffffffe) {
  ------------------
  |  Branch (197:9): [True: 0, False: 9.20k]
  ------------------
  198|      0|      OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  199|       |      // Too large.
  200|      0|      goto err;
  201|  9.20k|    } else if (len > 0xffffff) {
  ------------------
  |  Branch (201:16): [True: 0, False: 9.20k]
  ------------------
  202|      0|      len_len = 5;
  203|      0|      initial_length_byte = 0x80 | 4;
  204|  9.20k|    } else if (len > 0xffff) {
  ------------------
  |  Branch (204:16): [True: 0, False: 9.20k]
  ------------------
  205|      0|      len_len = 4;
  206|      0|      initial_length_byte = 0x80 | 3;
  207|  9.20k|    } else if (len > 0xff) {
  ------------------
  |  Branch (207:16): [True: 1.13k, False: 8.07k]
  ------------------
  208|  1.13k|      len_len = 3;
  209|  1.13k|      initial_length_byte = 0x80 | 2;
  210|  8.07k|    } else if (len > 0x7f) {
  ------------------
  |  Branch (210:16): [True: 327, False: 7.74k]
  ------------------
  211|    327|      len_len = 2;
  212|    327|      initial_length_byte = 0x80 | 1;
  213|  7.74k|    } else {
  214|  7.74k|      len_len = 1;
  215|  7.74k|      initial_length_byte = (uint8_t)len;
  216|  7.74k|      len = 0;
  217|  7.74k|    }
  218|       |
  219|  9.20k|    if (len_len != 1) {
  ------------------
  |  Branch (219:9): [True: 1.46k, False: 7.74k]
  ------------------
  220|       |      // We need to move the contents along in order to make space.
  221|  1.46k|      size_t extra_bytes = len_len - 1;
  222|  1.46k|      if (!cbb_buffer_add(base, NULL, extra_bytes)) {
  ------------------
  |  Branch (222:11): [True: 0, False: 1.46k]
  ------------------
  223|      0|        goto err;
  224|      0|      }
  225|  1.46k|      OPENSSL_memmove(base->buf + child_start + extra_bytes,
  226|  1.46k|                      base->buf + child_start, len);
  227|  1.46k|    }
  228|  9.20k|    base->buf[child->offset++] = initial_length_byte;
  229|  9.20k|    child->pending_len_len = len_len - 1;
  230|  9.20k|  }
  231|       |
  232|  11.8k|  for (size_t i = child->pending_len_len - 1; i < child->pending_len_len; i--) {
  ------------------
  |  Branch (232:47): [True: 2.59k, False: 9.20k]
  ------------------
  233|  2.59k|    base->buf[child->offset + i] = (uint8_t)len;
  234|  2.59k|    len >>= 8;
  235|  2.59k|  }
  236|  9.20k|  if (len != 0) {
  ------------------
  |  Branch (236:7): [True: 0, False: 9.20k]
  ------------------
  237|      0|    OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  238|      0|    goto err;
  239|      0|  }
  240|       |
  241|  9.20k|  child->base = NULL;
  242|  9.20k|  cbb->child = NULL;
  243|       |
  244|  9.20k|  return 1;
  245|       |
  246|      0|err:
  247|      0|  base->error = 1;
  248|      0|  return 0;
  249|  9.20k|}
CBB_add_asn1:
  342|  9.20k|int CBB_add_asn1(CBB *cbb, CBB *out_contents, CBS_ASN1_TAG tag) {
  343|  9.20k|  if (!CBB_flush(cbb)) {
  ------------------
  |  Branch (343:7): [True: 0, False: 9.20k]
  ------------------
  344|      0|    return 0;
  345|      0|  }
  346|       |
  347|       |  // Split the tag into leading bits and tag number.
  348|  9.20k|  uint8_t tag_bits = (tag >> CBS_ASN1_TAG_SHIFT) & 0xe0;
  ------------------
  |  |  193|  9.20k|#define CBS_ASN1_TAG_SHIFT 24
  ------------------
  349|  9.20k|  CBS_ASN1_TAG tag_number = tag & CBS_ASN1_TAG_NUMBER_MASK;
  ------------------
  |  |  210|  9.20k|#define CBS_ASN1_TAG_NUMBER_MASK ((1u << (5 + CBS_ASN1_TAG_SHIFT)) - 1)
  |  |  ------------------
  |  |  |  |  193|  9.20k|#define CBS_ASN1_TAG_SHIFT 24
  |  |  ------------------
  ------------------
  350|  9.20k|  if (tag_number >= 0x1f) {
  ------------------
  |  Branch (350:7): [True: 0, False: 9.20k]
  ------------------
  351|       |    // Set all the bits in the tag number to signal high tag number form.
  352|      0|    if (!CBB_add_u8(cbb, tag_bits | 0x1f) ||
  ------------------
  |  Branch (352:9): [True: 0, False: 0]
  ------------------
  353|      0|        !add_base128_integer(cbb, tag_number)) {
  ------------------
  |  Branch (353:9): [True: 0, False: 0]
  ------------------
  354|      0|      return 0;
  355|      0|    }
  356|  9.20k|  } else if (!CBB_add_u8(cbb, tag_bits | tag_number)) {
  ------------------
  |  Branch (356:14): [True: 0, False: 9.20k]
  ------------------
  357|      0|    return 0;
  358|      0|  }
  359|       |
  360|       |  // Reserve one byte of length prefix. |CBB_flush| will finish it later.
  361|  9.20k|  return cbb_add_child(cbb, out_contents, /*len_len=*/1, /*is_asn1=*/1);
  362|  9.20k|}
CBB_add_bytes:
  364|  1.14k|int CBB_add_bytes(CBB *cbb, const uint8_t *data, size_t len) {
  365|  1.14k|  uint8_t *out;
  366|  1.14k|  if (!CBB_add_space(cbb, &out, len)) {
  ------------------
  |  Branch (366:7): [True: 0, False: 1.14k]
  ------------------
  367|      0|    return 0;
  368|      0|  }
  369|  1.14k|  OPENSSL_memcpy(out, data, len);
  370|  1.14k|  return 1;
  371|  1.14k|}
CBB_add_space:
  382|  15.7k|int CBB_add_space(CBB *cbb, uint8_t **out_data, size_t len) {
  383|  15.7k|  if (!CBB_flush(cbb) ||
  ------------------
  |  Branch (383:7): [True: 0, False: 15.7k]
  ------------------
  384|  15.7k|      !cbb_buffer_add(cbb_get_base(cbb), out_data, len)) {
  ------------------
  |  Branch (384:7): [True: 0, False: 15.7k]
  ------------------
  385|      0|    return 0;
  386|      0|  }
  387|  15.7k|  return 1;
  388|  15.7k|}
CBB_add_u8:
  430|  11.3k|int CBB_add_u8(CBB *cbb, uint8_t value) {
  431|  11.3k|  return cbb_add_u(cbb, value, 1);
  432|  11.3k|}
CBB_add_asn1_uint64:
  475|  1.00k|int CBB_add_asn1_uint64(CBB *cbb, uint64_t value) {
  476|  1.00k|  return CBB_add_asn1_uint64_with_tag(cbb, value, CBS_ASN1_INTEGER);
  ------------------
  |  |  215|  1.00k|#define CBS_ASN1_INTEGER 0x2u
  ------------------
  477|  1.00k|}
CBB_add_asn1_uint64_with_tag:
  479|  1.00k|int CBB_add_asn1_uint64_with_tag(CBB *cbb, uint64_t value, CBS_ASN1_TAG tag) {
  480|  1.00k|  CBB child;
  481|  1.00k|  if (!CBB_add_asn1(cbb, &child, tag)) {
  ------------------
  |  Branch (481:7): [True: 0, False: 1.00k]
  ------------------
  482|      0|    return 0;
  483|      0|  }
  484|       |
  485|  1.00k|  int started = 0;
  486|  9.04k|  for (size_t i = 0; i < 8; i++) {
  ------------------
  |  Branch (486:22): [True: 8.04k, False: 1.00k]
  ------------------
  487|  8.04k|    uint8_t byte = (value >> 8*(7-i)) & 0xff;
  488|  8.04k|    if (!started) {
  ------------------
  |  Branch (488:9): [True: 8.04k, False: 0]
  ------------------
  489|  8.04k|      if (byte == 0) {
  ------------------
  |  Branch (489:11): [True: 8.01k, False: 27]
  ------------------
  490|       |        // Don't encode leading zeros.
  491|  8.01k|        continue;
  492|  8.01k|      }
  493|       |      // If the high bit is set, add a padding byte to make it
  494|       |      // unsigned.
  495|     27|      if ((byte & 0x80) && !CBB_add_u8(&child, 0)) {
  ------------------
  |  Branch (495:11): [True: 0, False: 27]
  |  Branch (495:28): [True: 0, False: 0]
  ------------------
  496|      0|        return 0;
  497|      0|      }
  498|     27|      started = 1;
  499|     27|    }
  500|     27|    if (!CBB_add_u8(&child, byte)) {
  ------------------
  |  Branch (500:9): [True: 0, False: 27]
  ------------------
  501|      0|      return 0;
  502|      0|    }
  503|     27|  }
  504|       |
  505|       |  // 0 is encoded as a single 0, not the empty string.
  506|  1.00k|  if (!started && !CBB_add_u8(&child, 0)) {
  ------------------
  |  Branch (506:7): [True: 978, False: 27]
  |  Branch (506:19): [True: 0, False: 978]
  ------------------
  507|      0|    return 0;
  508|      0|  }
  509|       |
  510|  1.00k|  return CBB_flush(cbb);
  511|  1.00k|}
cbb.c:cbb_init:
   31|    978|static void cbb_init(CBB *cbb, uint8_t *buf, size_t cap, int can_resize) {
   32|    978|  cbb->is_child = 0;
   33|    978|  cbb->child = NULL;
   34|    978|  cbb->u.base.buf = buf;
   35|    978|  cbb->u.base.len = 0;
   36|    978|  cbb->u.base.cap = cap;
   37|    978|  cbb->u.base.can_resize = can_resize;
   38|    978|  cbb->u.base.error = 0;
   39|    978|}
cbb.c:cbb_get_base:
  151|  66.2k|static struct cbb_buffer_st *cbb_get_base(CBB *cbb) {
  152|  66.2k|  if (cbb->is_child) {
  ------------------
  |  Branch (152:7): [True: 60.4k, False: 5.86k]
  ------------------
  153|  60.4k|    return cbb->u.child.base;
  154|  60.4k|  }
  155|  5.86k|  return &cbb->u.base;
  156|  66.2k|}
cbb.c:cbb_buffer_add:
  116|  26.4k|                          size_t len) {
  117|  26.4k|  if (!cbb_buffer_reserve(base, out, len)) {
  ------------------
  |  Branch (117:7): [True: 0, False: 26.4k]
  ------------------
  118|      0|    return 0;
  119|      0|  }
  120|       |  // This will not overflow or |cbb_buffer_reserve| would have failed.
  121|  26.4k|  base->len += len;
  122|  26.4k|  return 1;
  123|  26.4k|}
cbb.c:cbb_add_child:
  272|  9.20k|                         int is_asn1) {
  273|  9.20k|  assert(cbb->child == NULL);
  274|  9.20k|  assert(!is_asn1 || len_len == 1);
  275|  9.20k|  struct cbb_buffer_st *base = cbb_get_base(cbb);
  276|  9.20k|  size_t offset = base->len;
  277|       |
  278|       |  // Reserve space for the length prefix.
  279|  9.20k|  uint8_t *prefix_bytes;
  280|  9.20k|  if (!cbb_buffer_add(base, &prefix_bytes, len_len)) {
  ------------------
  |  Branch (280:7): [True: 0, False: 9.20k]
  ------------------
  281|      0|    return 0;
  282|      0|  }
  283|  9.20k|  OPENSSL_memset(prefix_bytes, 0, len_len);
  284|       |
  285|  9.20k|  CBB_zero(out_child);
  286|  9.20k|  out_child->is_child = 1;
  287|  9.20k|  out_child->u.child.base = base;
  288|  9.20k|  out_child->u.child.offset = offset;
  289|  9.20k|  out_child->u.child.pending_len_len = len_len;
  290|  9.20k|  out_child->u.child.pending_is_asn1 = is_asn1;
  291|  9.20k|  cbb->child = out_child;
  292|  9.20k|  return 1;
  293|  9.20k|}
cbb.c:cbb_buffer_reserve:
   73|  26.4k|                              size_t len) {
   74|  26.4k|  if (base == NULL) {
  ------------------
  |  Branch (74:7): [True: 0, False: 26.4k]
  ------------------
   75|      0|    return 0;
   76|      0|  }
   77|       |
   78|  26.4k|  size_t newlen = base->len + len;
   79|  26.4k|  if (newlen < base->len) {
  ------------------
  |  Branch (79:7): [True: 0, False: 26.4k]
  ------------------
   80|       |    // Overflow
   81|      0|    OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   82|      0|    goto err;
   83|      0|  }
   84|       |
   85|  26.4k|  if (newlen > base->cap) {
  ------------------
  |  Branch (85:7): [True: 7.80k, False: 18.6k]
  ------------------
   86|  7.80k|    if (!base->can_resize) {
  ------------------
  |  Branch (86:9): [True: 0, False: 7.80k]
  ------------------
   87|      0|      OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   88|      0|      goto err;
   89|      0|    }
   90|       |
   91|  7.80k|    size_t newcap = base->cap * 2;
   92|  7.80k|    if (newcap < base->cap || newcap < newlen) {
  ------------------
  |  Branch (92:9): [True: 0, False: 7.80k]
  |  Branch (92:31): [True: 1.51k, False: 6.29k]
  ------------------
   93|  1.51k|      newcap = newlen;
   94|  1.51k|    }
   95|  7.80k|    uint8_t *newbuf = OPENSSL_realloc(base->buf, newcap);
   96|  7.80k|    if (newbuf == NULL) {
  ------------------
  |  Branch (96:9): [True: 0, False: 7.80k]
  ------------------
   97|      0|      goto err;
   98|      0|    }
   99|       |
  100|  7.80k|    base->buf = newbuf;
  101|  7.80k|    base->cap = newcap;
  102|  7.80k|  }
  103|       |
  104|  26.4k|  if (out) {
  ------------------
  |  Branch (104:7): [True: 24.9k, False: 1.46k]
  ------------------
  105|  24.9k|    *out = base->buf + base->len;
  106|  24.9k|  }
  107|       |
  108|  26.4k|  return 1;
  109|       |
  110|      0|err:
  111|      0|  base->error = 1;
  112|      0|  return 0;
  113|  26.4k|}
cbb.c:cbb_add_u:
  410|  11.3k|static int cbb_add_u(CBB *cbb, uint64_t v, size_t len_len) {
  411|  11.3k|  uint8_t *buf;
  412|  11.3k|  if (!CBB_add_space(cbb, &buf, len_len)) {
  ------------------
  |  Branch (412:7): [True: 0, False: 11.3k]
  ------------------
  413|      0|    return 0;
  414|      0|  }
  415|       |
  416|  22.7k|  for (size_t i = len_len - 1; i < len_len; i--) {
  ------------------
  |  Branch (416:32): [True: 11.3k, False: 11.3k]
  ------------------
  417|  11.3k|    buf[i] = v;
  418|  11.3k|    v >>= 8;
  419|  11.3k|  }
  420|       |
  421|       |  // |v| must fit in |len_len| bytes.
  422|  11.3k|  if (v != 0) {
  ------------------
  |  Branch (422:7): [True: 0, False: 11.3k]
  ------------------
  423|      0|    cbb_get_base(cbb)->error = 1;
  424|      0|    return 0;
  425|      0|  }
  426|       |
  427|  11.3k|  return 1;
  428|  11.3k|}

CBS_init:
   29|  54.3k|void CBS_init(CBS *cbs, const uint8_t *data, size_t len) {
   30|  54.3k|  cbs->data = data;
   31|  54.3k|  cbs->len = len;
   32|  54.3k|}
CBS_skip:
   45|  48.7k|int CBS_skip(CBS *cbs, size_t len) {
   46|  48.7k|  const uint8_t *dummy;
   47|  48.7k|  return cbs_get(cbs, &dummy, len);
   48|  48.7k|}
CBS_data:
   50|  29.8k|const uint8_t *CBS_data(const CBS *cbs) {
   51|  29.8k|  return cbs->data;
   52|  29.8k|}
CBS_len:
   54|   142k|size_t CBS_len(const CBS *cbs) {
   55|   142k|  return cbs->len;
   56|   142k|}
CBS_mem_equal:
   86|    538|int CBS_mem_equal(const CBS *cbs, const uint8_t *data, size_t len) {
   87|    538|  if (len != cbs->len) {
  ------------------
  |  Branch (87:7): [True: 438, False: 100]
  ------------------
   88|    438|    return 0;
   89|    438|  }
   90|    100|  return CRYPTO_memcmp(cbs->data, data, len) == 0;
   91|    538|}
CBS_get_u8:
  108|   144k|int CBS_get_u8(CBS *cbs, uint8_t *out) {
  109|   144k|  const uint8_t *v;
  110|   144k|  if (!cbs_get(cbs, &v, 1)) {
  ------------------
  |  Branch (110:7): [True: 12.9k, False: 131k]
  ------------------
  111|  12.9k|    return 0;
  112|  12.9k|  }
  113|   131k|  *out = *v;
  114|   131k|  return 1;
  115|   144k|}
CBS_get_bytes:
  181|  48.4k|int CBS_get_bytes(CBS *cbs, CBS *out, size_t len) {
  182|  48.4k|  const uint8_t *v;
  183|  48.4k|  if (!cbs_get(cbs, &v, len)) {
  ------------------
  |  Branch (183:7): [True: 246, False: 48.1k]
  ------------------
  184|    246|    return 0;
  185|    246|  }
  186|  48.1k|  CBS_init(out, v, len);
  187|  48.1k|  return 1;
  188|  48.4k|}
CBS_get_any_asn1_element:
  436|  49.1k|                                    size_t *out_header_len) {
  437|  49.1k|  return cbs_get_any_asn1_element(cbs, out, out_tag, out_header_len, NULL, NULL,
  438|  49.1k|                                  /*ber_ok=*/0);
  439|  49.1k|}
CBS_get_asn1:
  474|  49.1k|int CBS_get_asn1(CBS *cbs, CBS *out, CBS_ASN1_TAG tag_value) {
  475|  49.1k|  return cbs_get_asn1(cbs, out, tag_value, 1 /* skip header */);
  476|  49.1k|}
CBS_peek_asn1_tag:
  482|  5.49k|int CBS_peek_asn1_tag(const CBS *cbs, CBS_ASN1_TAG tag_value) {
  483|  5.49k|  CBS copy = *cbs;
  484|  5.49k|  CBS_ASN1_TAG actual_tag;
  485|  5.49k|  return parse_asn1_tag(&copy, &actual_tag) && tag_value == actual_tag;
  ------------------
  |  Branch (485:10): [True: 4.47k, False: 1.01k]
  |  Branch (485:48): [True: 1.67k, False: 2.80k]
  ------------------
  486|  5.49k|}
CBS_get_asn1_uint64:
  488|  7.76k|int CBS_get_asn1_uint64(CBS *cbs, uint64_t *out) {
  489|  7.76k|  CBS bytes;
  490|  7.76k|  if (!CBS_get_asn1(cbs, &bytes, CBS_ASN1_INTEGER) ||
  ------------------
  |  |  215|  7.76k|#define CBS_ASN1_INTEGER 0x2u
  ------------------
  |  Branch (490:7): [True: 271, False: 7.49k]
  ------------------
  491|  7.76k|      !CBS_is_unsigned_asn1_integer(&bytes)) {
  ------------------
  |  Branch (491:7): [True: 29, False: 7.46k]
  ------------------
  492|    300|    return 0;
  493|    300|  }
  494|       |
  495|  7.46k|  *out = 0;
  496|  7.46k|  const uint8_t *data = CBS_data(&bytes);
  497|  7.46k|  size_t len = CBS_len(&bytes);
  498|  18.4k|  for (size_t i = 0; i < len; i++) {
  ------------------
  |  Branch (498:22): [True: 10.9k, False: 7.41k]
  ------------------
  499|  10.9k|    if ((*out >> 56) != 0) {
  ------------------
  |  Branch (499:9): [True: 45, False: 10.9k]
  ------------------
  500|       |      // Too large to represent as a uint64_t.
  501|     45|      return 0;
  502|     45|    }
  503|  10.9k|    *out <<= 8;
  504|  10.9k|    *out |= data[i];
  505|  10.9k|  }
  506|       |
  507|  7.41k|  return 1;
  508|  7.46k|}
CBS_get_optional_asn1:
  547|    597|int CBS_get_optional_asn1(CBS *cbs, CBS *out, int *out_present, CBS_ASN1_TAG tag) {
  548|    597|  int present = 0;
  549|       |
  550|    597|  if (CBS_peek_asn1_tag(cbs, tag)) {
  ------------------
  |  Branch (550:7): [True: 62, False: 535]
  ------------------
  551|     62|    if (!CBS_get_asn1(cbs, out, tag)) {
  ------------------
  |  Branch (551:9): [True: 2, False: 60]
  ------------------
  552|      2|      return 0;
  553|      2|    }
  554|     60|    present = 1;
  555|     60|  }
  556|       |
  557|    595|  if (out_present != NULL) {
  ------------------
  |  Branch (557:7): [True: 192, False: 403]
  ------------------
  558|    192|    *out_present = present;
  559|    192|  }
  560|       |
  561|    595|  return 1;
  562|    597|}
CBS_is_valid_asn1_integer:
  671|  16.6k|int CBS_is_valid_asn1_integer(const CBS *cbs, int *out_is_negative) {
  672|  16.6k|  CBS copy = *cbs;
  673|  16.6k|  uint8_t first_byte, second_byte;
  674|  16.6k|  if (!CBS_get_u8(&copy, &first_byte)) {
  ------------------
  |  Branch (674:7): [True: 5, False: 16.6k]
  ------------------
  675|      5|    return 0;  // INTEGERs may not be empty.
  676|      5|  }
  677|  16.6k|  if (out_is_negative != NULL) {
  ------------------
  |  Branch (677:7): [True: 16.6k, False: 0]
  ------------------
  678|  16.6k|    *out_is_negative = (first_byte & 0x80) != 0;
  679|  16.6k|  }
  680|  16.6k|  if (!CBS_get_u8(&copy, &second_byte)) {
  ------------------
  |  Branch (680:7): [True: 11.9k, False: 4.68k]
  ------------------
  681|  11.9k|    return 1;  // One byte INTEGERs are always minimal.
  682|  11.9k|  }
  683|  4.68k|  if ((first_byte == 0x00 && (second_byte & 0x80) == 0) ||
  ------------------
  |  Branch (683:8): [True: 1.97k, False: 2.70k]
  |  Branch (683:30): [True: 19, False: 1.95k]
  ------------------
  684|  4.68k|      (first_byte == 0xff && (second_byte & 0x80) != 0)) {
  ------------------
  |  Branch (684:8): [True: 40, False: 4.62k]
  |  Branch (684:30): [True: 23, False: 17]
  ------------------
  685|     42|    return 0;  // The value is minimal iff the first 9 bits are not all equal.
  686|     42|  }
  687|  4.64k|  return 1;
  688|  4.68k|}
CBS_is_unsigned_asn1_integer:
  690|  8.14k|int CBS_is_unsigned_asn1_integer(const CBS *cbs) {
  691|  8.14k|  int is_negative;
  692|  8.14k|  return CBS_is_valid_asn1_integer(cbs, &is_negative) && !is_negative;
  ------------------
  |  Branch (692:10): [True: 8.11k, False: 32]
  |  Branch (692:58): [True: 8.09k, False: 23]
  ------------------
  693|  8.14k|}
cbs.c:cbs_get:
   34|   246k|static int cbs_get(CBS *cbs, const uint8_t **p, size_t n) {
   35|   246k|  if (cbs->len < n) {
  ------------------
  |  Branch (35:7): [True: 13.1k, False: 233k]
  ------------------
   36|  13.1k|    return 0;
   37|  13.1k|  }
   38|       |
   39|   233k|  *p = cbs->data;
   40|   233k|  cbs->data += n;
   41|   233k|  cbs->len -= n;
   42|   233k|  return 1;
   43|   246k|}
cbs.c:cbs_get_u:
   93|  5.09k|static int cbs_get_u(CBS *cbs, uint64_t *out, size_t len) {
   94|  5.09k|  uint64_t result = 0;
   95|  5.09k|  const uint8_t *data;
   96|       |
   97|  5.09k|  if (!cbs_get(cbs, &data, len)) {
  ------------------
  |  Branch (97:7): [True: 2, False: 5.09k]
  ------------------
   98|      2|    return 0;
   99|      2|  }
  100|  14.8k|  for (size_t i = 0; i < len; i++) {
  ------------------
  |  Branch (100:22): [True: 9.78k, False: 5.09k]
  ------------------
  101|  9.78k|    result <<= 8;
  102|  9.78k|    result |= data[i];
  103|  9.78k|  }
  104|  5.09k|  *out = result;
  105|  5.09k|  return 1;
  106|  5.09k|}
cbs.c:cbs_get_any_asn1_element:
  322|  49.1k|                                    int *out_indefinite, int ber_ok) {
  323|  49.1k|  CBS header = *cbs;
  324|  49.1k|  CBS throwaway;
  325|       |
  326|  49.1k|  if (out == NULL) {
  ------------------
  |  Branch (326:7): [True: 0, False: 49.1k]
  ------------------
  327|      0|    out = &throwaway;
  328|      0|  }
  329|  49.1k|  if (ber_ok) {
  ------------------
  |  Branch (329:7): [True: 0, False: 49.1k]
  ------------------
  330|      0|    *out_ber_found = 0;
  331|      0|    *out_indefinite = 0;
  332|  49.1k|  } else {
  333|  49.1k|    assert(out_ber_found == NULL);
  334|  49.1k|    assert(out_indefinite == NULL);
  335|  49.1k|  }
  336|       |
  337|  49.1k|  CBS_ASN1_TAG tag;
  338|  49.1k|  if (!parse_asn1_tag(&header, &tag)) {
  ------------------
  |  Branch (338:7): [True: 570, False: 48.5k]
  ------------------
  339|    570|    return 0;
  340|    570|  }
  341|  48.5k|  if (out_tag != NULL) {
  ------------------
  |  Branch (341:7): [True: 48.5k, False: 0]
  ------------------
  342|  48.5k|    *out_tag = tag;
  343|  48.5k|  }
  344|       |
  345|  48.5k|  uint8_t length_byte;
  346|  48.5k|  if (!CBS_get_u8(&header, &length_byte)) {
  ------------------
  |  Branch (346:7): [True: 32, False: 48.5k]
  ------------------
  347|     32|    return 0;
  348|     32|  }
  349|       |
  350|  48.5k|  size_t header_len = CBS_len(cbs) - CBS_len(&header);
  351|       |
  352|  48.5k|  size_t len;
  353|       |  // The format for the length encoding is specified in ITU-T X.690 section
  354|       |  // 8.1.3.
  355|  48.5k|  if ((length_byte & 0x80) == 0) {
  ------------------
  |  Branch (355:7): [True: 43.3k, False: 5.21k]
  ------------------
  356|       |    // Short form length.
  357|  43.3k|    len = ((size_t) length_byte) + header_len;
  358|  43.3k|    if (out_header_len != NULL) {
  ------------------
  |  Branch (358:9): [True: 43.3k, False: 0]
  ------------------
  359|  43.3k|      *out_header_len = header_len;
  360|  43.3k|    }
  361|  43.3k|  } else {
  362|       |    // The high bit indicate that this is the long form, while the next 7 bits
  363|       |    // encode the number of subsequent octets used to encode the length (ITU-T
  364|       |    // X.690 clause 8.1.3.5.b).
  365|  5.21k|    const size_t num_bytes = length_byte & 0x7f;
  366|  5.21k|    uint64_t len64;
  367|       |
  368|  5.21k|    if (ber_ok && (tag & CBS_ASN1_CONSTRUCTED) != 0 && num_bytes == 0) {
  ------------------
  |  |  196|      0|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  ------------------
  |  |  |  |  193|      0|#define CBS_ASN1_TAG_SHIFT 24
  |  |  ------------------
  ------------------
  |  Branch (368:9): [True: 0, False: 5.21k]
  |  Branch (368:19): [True: 0, False: 0]
  |  Branch (368:56): [True: 0, False: 0]
  ------------------
  369|       |      // indefinite length
  370|      0|      if (out_header_len != NULL) {
  ------------------
  |  Branch (370:11): [True: 0, False: 0]
  ------------------
  371|      0|        *out_header_len = header_len;
  372|      0|      }
  373|      0|      *out_ber_found = 1;
  374|      0|      *out_indefinite = 1;
  375|      0|      return CBS_get_bytes(cbs, out, header_len);
  376|      0|    }
  377|       |
  378|       |    // ITU-T X.690 clause 8.1.3.5.c specifies that the value 0xff shall not be
  379|       |    // used as the first byte of the length. If this parser encounters that
  380|       |    // value, num_bytes will be parsed as 127, which will fail this check.
  381|  5.21k|    if (num_bytes == 0 || num_bytes > 4) {
  ------------------
  |  Branch (381:9): [True: 108, False: 5.10k]
  |  Branch (381:27): [True: 13, False: 5.09k]
  ------------------
  382|    121|      return 0;
  383|    121|    }
  384|  5.09k|    if (!cbs_get_u(&header, &len64, num_bytes)) {
  ------------------
  |  Branch (384:9): [True: 2, False: 5.09k]
  ------------------
  385|      2|      return 0;
  386|      2|    }
  387|       |    // ITU-T X.690 section 10.1 (DER length forms) requires encoding the
  388|       |    // length with the minimum number of octets. BER could, technically, have
  389|       |    // 125 superfluous zero bytes. We do not attempt to handle that and still
  390|       |    // require that the length fit in a |uint32_t| for BER.
  391|  5.09k|    if (len64 < 128) {
  ------------------
  |  Branch (391:9): [True: 16, False: 5.07k]
  ------------------
  392|       |      // Length should have used short-form encoding.
  393|     16|      if (ber_ok) {
  ------------------
  |  Branch (393:11): [True: 0, False: 16]
  ------------------
  394|      0|        *out_ber_found = 1;
  395|     16|      } else {
  396|     16|        return 0;
  397|     16|      }
  398|     16|    }
  399|  5.07k|    if ((len64 >> ((num_bytes - 1) * 8)) == 0) {
  ------------------
  |  Branch (399:9): [True: 1, False: 5.07k]
  ------------------
  400|       |      // Length should have been at least one byte shorter.
  401|      1|      if (ber_ok) {
  ------------------
  |  Branch (401:11): [True: 0, False: 1]
  ------------------
  402|      0|        *out_ber_found = 1;
  403|      1|      } else {
  404|      1|        return 0;
  405|      1|      }
  406|      1|    }
  407|  5.07k|    len = len64;
  408|  5.07k|    if (len + header_len + num_bytes < len) {
  ------------------
  |  Branch (408:9): [True: 0, False: 5.07k]
  ------------------
  409|       |      // Overflow.
  410|      0|      return 0;
  411|      0|    }
  412|  5.07k|    len += header_len + num_bytes;
  413|  5.07k|    if (out_header_len != NULL) {
  ------------------
  |  Branch (413:9): [True: 5.07k, False: 0]
  ------------------
  414|  5.07k|      *out_header_len = header_len + num_bytes;
  415|  5.07k|    }
  416|  5.07k|  }
  417|       |
  418|  48.4k|  return CBS_get_bytes(cbs, out, len);
  419|  48.5k|}
cbs.c:cbs_get_asn1:
  452|  49.1k|                        int skip_header) {
  453|  49.1k|  size_t header_len;
  454|  49.1k|  CBS_ASN1_TAG tag;
  455|  49.1k|  CBS throwaway;
  456|       |
  457|  49.1k|  if (out == NULL) {
  ------------------
  |  Branch (457:7): [True: 5, False: 49.1k]
  ------------------
  458|      5|    out = &throwaway;
  459|      5|  }
  460|       |
  461|  49.1k|  if (!CBS_get_any_asn1_element(cbs, out, &tag, &header_len) ||
  ------------------
  |  Branch (461:7): [True: 988, False: 48.1k]
  ------------------
  462|  49.1k|      tag != tag_value) {
  ------------------
  |  Branch (462:7): [True: 642, False: 47.5k]
  ------------------
  463|  1.63k|    return 0;
  464|  1.63k|  }
  465|       |
  466|  47.5k|  if (skip_header && !CBS_skip(out, header_len)) {
  ------------------
  |  Branch (466:7): [True: 47.5k, False: 0]
  |  Branch (466:22): [True: 0, False: 47.5k]
  ------------------
  467|      0|    assert(0);
  468|      0|    return 0;
  469|      0|  }
  470|       |
  471|  47.5k|  return 1;
  472|  47.5k|}
cbs.c:parse_asn1_tag:
  281|  54.6k|static int parse_asn1_tag(CBS *cbs, CBS_ASN1_TAG *out) {
  282|  54.6k|  uint8_t tag_byte;
  283|  54.6k|  if (!CBS_get_u8(cbs, &tag_byte)) {
  ------------------
  |  Branch (283:7): [True: 791, False: 53.8k]
  ------------------
  284|    791|    return 0;
  285|    791|  }
  286|       |
  287|       |  // ITU-T X.690 section 8.1.2.3 specifies the format for identifiers with a tag
  288|       |  // number no greater than 30.
  289|       |  //
  290|       |  // If the number portion is 31 (0x1f, the largest value that fits in the
  291|       |  // allotted bits), then the tag is more than one byte long and the
  292|       |  // continuation bytes contain the tag number.
  293|  53.8k|  CBS_ASN1_TAG tag = ((CBS_ASN1_TAG)tag_byte & 0xe0) << CBS_ASN1_TAG_SHIFT;
  ------------------
  |  |  193|  53.8k|#define CBS_ASN1_TAG_SHIFT 24
  ------------------
  294|  53.8k|  CBS_ASN1_TAG tag_number = tag_byte & 0x1f;
  295|  53.8k|  if (tag_number == 0x1f) {
  ------------------
  |  Branch (295:7): [True: 1.16k, False: 52.7k]
  ------------------
  296|  1.16k|    uint64_t v;
  297|  1.16k|    if (!parse_base128_integer(cbs, &v) ||
  ------------------
  |  Branch (297:9): [True: 134, False: 1.03k]
  ------------------
  298|       |        // Check the tag number is within our supported bounds.
  299|  1.16k|        v > CBS_ASN1_TAG_NUMBER_MASK ||
  ------------------
  |  |  210|  2.19k|#define CBS_ASN1_TAG_NUMBER_MASK ((1u << (5 + CBS_ASN1_TAG_SHIFT)) - 1)
  |  |  ------------------
  |  |  |  |  193|  1.03k|#define CBS_ASN1_TAG_SHIFT 24
  |  |  ------------------
  ------------------
  |  Branch (299:9): [True: 436, False: 596]
  ------------------
  300|       |        // Small tag numbers should have used low tag number form, even in BER.
  301|  1.16k|        v < 0x1f) {
  ------------------
  |  Branch (301:9): [True: 24, False: 572]
  ------------------
  302|    594|      return 0;
  303|    594|    }
  304|    572|    tag_number = (CBS_ASN1_TAG)v;
  305|    572|  }
  306|       |
  307|  53.2k|  tag |= tag_number;
  308|       |
  309|       |  // Tag [UNIVERSAL 0] is reserved for use by the encoding. Reject it here to
  310|       |  // avoid some ambiguity around ANY values and BER indefinite-length EOCs. See
  311|       |  // https://crbug.com/boringssl/455.
  312|  53.2k|  if ((tag & ~CBS_ASN1_CONSTRUCTED) == 0) {
  ------------------
  |  |  196|  53.2k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  ------------------
  |  |  |  |  193|  53.2k|#define CBS_ASN1_TAG_SHIFT 24
  |  |  ------------------
  ------------------
  |  Branch (312:7): [True: 203, False: 53.0k]
  ------------------
  313|    203|    return 0;
  314|    203|  }
  315|       |
  316|  53.0k|  *out = tag;
  317|  53.0k|  return 1;
  318|  53.2k|}
cbs.c:parse_base128_integer:
  257|  1.16k|static int parse_base128_integer(CBS *cbs, uint64_t *out) {
  258|  1.16k|  uint64_t v = 0;
  259|  1.16k|  uint8_t b;
  260|  6.65k|  do {
  261|  6.65k|    if (!CBS_get_u8(cbs, &b)) {
  ------------------
  |  Branch (261:9): [True: 90, False: 6.56k]
  ------------------
  262|     90|      return 0;
  263|     90|    }
  264|  6.56k|    if ((v >> (64 - 7)) != 0) {
  ------------------
  |  Branch (264:9): [True: 38, False: 6.52k]
  ------------------
  265|       |      // The value is too large.
  266|     38|      return 0;
  267|     38|    }
  268|  6.52k|    if (v == 0 && b == 0x80) {
  ------------------
  |  Branch (268:9): [True: 1.15k, False: 5.36k]
  |  Branch (268:19): [True: 6, False: 1.15k]
  ------------------
  269|       |      // The value must be minimally encoded.
  270|      6|      return 0;
  271|      6|    }
  272|  6.51k|    v = (v << 7) | (b & 0x7f);
  273|       |
  274|       |    // Values end at an octet with the high bit cleared.
  275|  6.51k|  } while (b & 0x80);
  ------------------
  |  Branch (275:12): [True: 5.48k, False: 1.03k]
  ------------------
  276|       |
  277|  1.03k|  *out = v;
  278|  1.03k|  return 1;
  279|  1.16k|}

OPENSSL_cpuid_setup:
  153|      2|void OPENSSL_cpuid_setup(void) {
  154|       |  // Determine the vendor and maximum input value.
  155|      2|  uint32_t eax, ebx, ecx, edx;
  156|      2|  OPENSSL_cpuid(&eax, &ebx, &ecx, &edx, 0);
  157|       |
  158|      2|  uint32_t num_ids = eax;
  159|       |
  160|      2|  int is_intel = ebx == 0x756e6547 /* Genu */ &&
  ------------------
  |  Branch (160:18): [True: 2, False: 0]
  ------------------
  161|      2|                 edx == 0x49656e69 /* ineI */ &&
  ------------------
  |  Branch (161:18): [True: 2, False: 0]
  ------------------
  162|      2|                 ecx == 0x6c65746e /* ntel */;
  ------------------
  |  Branch (162:18): [True: 2, False: 0]
  ------------------
  163|      2|  int is_amd = ebx == 0x68747541 /* Auth */ &&
  ------------------
  |  Branch (163:16): [True: 0, False: 2]
  ------------------
  164|      2|               edx == 0x69746e65 /* enti */ &&
  ------------------
  |  Branch (164:16): [True: 0, False: 0]
  ------------------
  165|      2|               ecx == 0x444d4163 /* cAMD */;
  ------------------
  |  Branch (165:16): [True: 0, False: 0]
  ------------------
  166|       |
  167|      2|  uint32_t extended_features[2] = {0};
  168|      2|  if (num_ids >= 7) {
  ------------------
  |  Branch (168:7): [True: 2, False: 0]
  ------------------
  169|      2|    OPENSSL_cpuid(&eax, &ebx, &ecx, &edx, 7);
  170|      2|    extended_features[0] = ebx;
  171|      2|    extended_features[1] = ecx;
  172|      2|  }
  173|       |
  174|      2|  OPENSSL_cpuid(&eax, &ebx, &ecx, &edx, 1);
  175|       |
  176|      2|  if (is_amd) {
  ------------------
  |  Branch (176:7): [True: 0, False: 2]
  ------------------
  177|       |    // See https://www.amd.com/system/files/TechDocs/25481.pdf, page 10.
  178|      0|    const uint32_t base_family = (eax >> 8) & 15;
  179|      0|    const uint32_t base_model = (eax >> 4) & 15;
  180|       |
  181|      0|    uint32_t family = base_family;
  182|      0|    uint32_t model = base_model;
  183|      0|    if (base_family == 0xf) {
  ------------------
  |  Branch (183:9): [True: 0, False: 0]
  ------------------
  184|      0|      const uint32_t ext_family = (eax >> 20) & 255;
  185|      0|      family += ext_family;
  186|      0|      const uint32_t ext_model = (eax >> 16) & 15;
  187|      0|      model |= ext_model << 4;
  188|      0|    }
  189|       |
  190|      0|    if (family < 0x17 || (family == 0x17 && 0x70 <= model && model <= 0x7f)) {
  ------------------
  |  Branch (190:9): [True: 0, False: 0]
  |  Branch (190:27): [True: 0, False: 0]
  |  Branch (190:45): [True: 0, False: 0]
  |  Branch (190:62): [True: 0, False: 0]
  ------------------
  191|       |      // Disable RDRAND on AMD families before 0x17 (Zen) due to reported
  192|       |      // failures after suspend.
  193|       |      // https://bugzilla.redhat.com/show_bug.cgi?id=1150286
  194|       |      // Also disable for family 0x17, models 0x70–0x7f, due to possible RDRAND
  195|       |      // failures there too.
  196|      0|      ecx &= ~(1u << 30);
  197|      0|    }
  198|      0|  }
  199|       |
  200|       |  // Force the hyper-threading bit so that the more conservative path is always
  201|       |  // chosen.
  202|      2|  edx |= 1u << 28;
  203|       |
  204|       |  // Reserved bit #20 was historically repurposed to control the in-memory
  205|       |  // representation of RC4 state. Always set it to zero.
  206|      2|  edx &= ~(1u << 20);
  207|       |
  208|       |  // Reserved bit #30 is repurposed to signal an Intel CPU.
  209|      2|  if (is_intel) {
  ------------------
  |  Branch (209:7): [True: 2, False: 0]
  ------------------
  210|      2|    edx |= (1u << 30);
  211|       |
  212|       |    // Clear the XSAVE bit on Knights Landing to mimic Silvermont. This enables
  213|       |    // some Silvermont-specific codepaths which perform better. See OpenSSL
  214|       |    // commit 64d92d74985ebb3d0be58a9718f9e080a14a8e7f.
  215|      2|    if ((eax & 0x0fff0ff0) == 0x00050670 /* Knights Landing */ ||
  ------------------
  |  Branch (215:9): [True: 0, False: 2]
  ------------------
  216|      2|        (eax & 0x0fff0ff0) == 0x00080650 /* Knights Mill (per SDE) */) {
  ------------------
  |  Branch (216:9): [True: 0, False: 2]
  ------------------
  217|      0|      ecx &= ~(1u << 26);
  218|      0|    }
  219|      2|  } else {
  220|      0|    edx &= ~(1u << 30);
  221|      0|  }
  222|       |
  223|       |  // The SDBG bit is repurposed to denote AMD XOP support. Don't ever use AMD
  224|       |  // XOP code paths.
  225|      2|  ecx &= ~(1u << 11);
  226|       |
  227|      2|  uint64_t xcr0 = 0;
  228|      2|  if (ecx & (1u << 27)) {
  ------------------
  |  Branch (228:7): [True: 2, False: 0]
  ------------------
  229|       |    // XCR0 may only be queried if the OSXSAVE bit is set.
  230|      2|    xcr0 = OPENSSL_xgetbv(0);
  231|      2|  }
  232|       |  // See Intel manual, volume 1, section 14.3.
  233|      2|  if ((xcr0 & 6) != 6) {
  ------------------
  |  Branch (233:7): [True: 0, False: 2]
  ------------------
  234|       |    // YMM registers cannot be used.
  235|      0|    ecx &= ~(1u << 28);  // AVX
  236|      0|    ecx &= ~(1u << 12);  // FMA
  237|      0|    ecx &= ~(1u << 11);  // AMD XOP
  238|       |    // Clear AVX2 and AVX512* bits.
  239|       |    //
  240|       |    // TODO(davidben): Should bits 17 and 26-28 also be cleared? Upstream
  241|       |    // doesn't clear those.
  242|      0|    extended_features[0] &=
  243|      0|        ~((1u << 5) | (1u << 16) | (1u << 21) | (1u << 30) | (1u << 31));
  244|      0|  }
  245|       |  // See Intel manual, volume 1, section 15.2.
  246|      2|  if ((xcr0 & 0xe6) != 0xe6) {
  ------------------
  |  Branch (246:7): [True: 2, False: 0]
  ------------------
  247|       |    // Clear AVX512F. Note we don't touch other AVX512 extensions because they
  248|       |    // can be used with YMM.
  249|      2|    extended_features[0] &= ~(1u << 16);
  250|      2|  }
  251|       |
  252|       |  // Disable ADX instructions on Knights Landing. See OpenSSL commit
  253|       |  // 64d92d74985ebb3d0be58a9718f9e080a14a8e7f.
  254|      2|  if ((ecx & (1u << 26)) == 0) {
  ------------------
  |  Branch (254:7): [True: 0, False: 2]
  ------------------
  255|      0|    extended_features[0] &= ~(1u << 19);
  256|      0|  }
  257|       |
  258|      2|  OPENSSL_ia32cap_P[0] = edx;
  259|      2|  OPENSSL_ia32cap_P[1] = ecx;
  260|      2|  OPENSSL_ia32cap_P[2] = extended_features[0];
  261|      2|  OPENSSL_ia32cap_P[3] = extended_features[1];
  262|       |
  263|      2|  const char *env1, *env2;
  264|      2|  env1 = getenv("OPENSSL_ia32cap");
  265|      2|  if (env1 == NULL) {
  ------------------
  |  Branch (265:7): [True: 2, False: 0]
  ------------------
  266|      2|    return;
  267|      2|  }
  268|       |
  269|       |  // OPENSSL_ia32cap can contain zero, one or two values, separated with a ':'.
  270|       |  // Each value is a 64-bit, unsigned value which may start with "0x" to
  271|       |  // indicate a hex value. Prior to the 64-bit value, a '~' or '|' may be given.
  272|       |  //
  273|       |  // If the '~' prefix is present:
  274|       |  //   the value is inverted and ANDed with the probed CPUID result
  275|       |  // If the '|' prefix is present:
  276|       |  //   the value is ORed with the probed CPUID result
  277|       |  // Otherwise:
  278|       |  //   the value is taken as the result of the CPUID
  279|       |  //
  280|       |  // The first value determines OPENSSL_ia32cap_P[0] and [1]. The second [2]
  281|       |  // and [3].
  282|       |
  283|      0|  handle_cpu_env(&OPENSSL_ia32cap_P[0], env1);
  284|      0|  env2 = strchr(env1, ':');
  285|      0|  if (env2 != NULL) {
  ------------------
  |  Branch (285:7): [True: 0, False: 0]
  ------------------
  286|      0|    handle_cpu_env(&OPENSSL_ia32cap_P[2], env2 + 1);
  287|      0|  }
  288|      0|}
cpu_intel.c:OPENSSL_cpuid:
   80|      6|                          uint32_t *out_ecx, uint32_t *out_edx, uint32_t leaf) {
   81|       |#if defined(_MSC_VER)
   82|       |  int tmp[4];
   83|       |  __cpuid(tmp, (int)leaf);
   84|       |  *out_eax = (uint32_t)tmp[0];
   85|       |  *out_ebx = (uint32_t)tmp[1];
   86|       |  *out_ecx = (uint32_t)tmp[2];
   87|       |  *out_edx = (uint32_t)tmp[3];
   88|       |#elif defined(__pic__) && defined(OPENSSL_32_BIT)
   89|       |  // Inline assembly may not clobber the PIC register. For 32-bit, this is EBX.
   90|       |  // See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=47602.
   91|       |  __asm__ volatile (
   92|       |    "xor %%ecx, %%ecx\n"
   93|       |    "mov %%ebx, %%edi\n"
   94|       |    "cpuid\n"
   95|       |    "xchg %%edi, %%ebx\n"
   96|       |    : "=a"(*out_eax), "=D"(*out_ebx), "=c"(*out_ecx), "=d"(*out_edx)
   97|       |    : "a"(leaf)
   98|       |  );
   99|       |#else
  100|      6|  __asm__ volatile (
  101|      6|    "xor %%ecx, %%ecx\n"
  102|      6|    "cpuid\n"
  103|      6|    : "=a"(*out_eax), "=b"(*out_ebx), "=c"(*out_ecx), "=d"(*out_edx)
  104|      6|    : "a"(leaf)
  105|      6|  );
  106|      6|#endif
  107|      6|}
cpu_intel.c:OPENSSL_xgetbv:
  111|      2|static uint64_t OPENSSL_xgetbv(uint32_t xcr) {
  112|       |#if defined(_MSC_VER)
  113|       |  return (uint64_t)_xgetbv(xcr);
  114|       |#else
  115|      2|  uint32_t eax, edx;
  116|      2|  __asm__ volatile ("xgetbv" : "=a"(eax), "=d"(edx) : "c"(xcr));
  117|      2|  return (((uint64_t)edx) << 32) | eax;
  118|      2|#endif
  119|      2|}

crypto.c:do_library_init:
  151|      2|static void OPENSSL_CDECL do_library_init(void) {
  152|       | // WARNING: this function may only configure the capability variables. See the
  153|       | // note above about the linker bug.
  154|      2|#if defined(NEED_CPUID)
  155|      2|  OPENSSL_cpuid_setup();
  156|      2|#endif
  157|      2|}

x25519_ge_scalarmult_base:
  799|    136|void x25519_ge_scalarmult_base(ge_p3 *h, const uint8_t a[32]) {
  800|    136|#if defined(BORINGSSL_FE25519_ADX)
  801|    136|  if (CRYPTO_is_BMI1_capable() && CRYPTO_is_BMI2_capable() &&
  ------------------
  |  Branch (801:7): [True: 136, False: 0]
  |  Branch (801:35): [True: 136, False: 0]
  ------------------
  802|    136|      CRYPTO_is_ADX_capable()) {
  ------------------
  |  Branch (802:7): [True: 136, False: 0]
  ------------------
  803|    136|    uint8_t t[4][32];
  804|    136|    x25519_ge_scalarmult_base_adx(t, a);
  805|    136|    fiat_25519_from_bytes(h->X.v, t[0]);
  806|    136|    fiat_25519_from_bytes(h->Y.v, t[1]);
  807|    136|    fiat_25519_from_bytes(h->Z.v, t[2]);
  808|    136|    fiat_25519_from_bytes(h->T.v, t[3]);
  809|    136|    return;
  810|    136|  }
  811|      0|#endif
  812|      0|  signed char e[64];
  813|      0|  signed char carry;
  814|      0|  ge_p1p1 r;
  815|      0|  ge_p2 s;
  816|      0|  ge_precomp t;
  817|      0|  int i;
  818|       |
  819|      0|  for (i = 0; i < 32; ++i) {
  ------------------
  |  Branch (819:15): [True: 0, False: 0]
  ------------------
  820|      0|    e[2 * i + 0] = (a[i] >> 0) & 15;
  821|      0|    e[2 * i + 1] = (a[i] >> 4) & 15;
  822|      0|  }
  823|       |  // each e[i] is between 0 and 15
  824|       |  // e[63] is between 0 and 7
  825|       |
  826|      0|  carry = 0;
  827|      0|  for (i = 0; i < 63; ++i) {
  ------------------
  |  Branch (827:15): [True: 0, False: 0]
  ------------------
  828|      0|    e[i] += carry;
  829|      0|    carry = e[i] + 8;
  830|      0|    carry >>= 4;
  831|      0|    e[i] -= carry << 4;
  832|      0|  }
  833|      0|  e[63] += carry;
  834|       |  // each e[i] is between -8 and 8
  835|       |
  836|      0|  ge_p3_0(h);
  837|      0|  for (i = 1; i < 64; i += 2) {
  ------------------
  |  Branch (837:15): [True: 0, False: 0]
  ------------------
  838|      0|    table_select(&t, i / 2, e[i]);
  839|      0|    ge_madd(&r, h, &t);
  840|      0|    x25519_ge_p1p1_to_p3(h, &r);
  841|      0|  }
  842|       |
  843|      0|  ge_p3_dbl(&r, h);
  844|      0|  x25519_ge_p1p1_to_p2(&s, &r);
  845|      0|  ge_p2_dbl(&r, &s);
  846|      0|  x25519_ge_p1p1_to_p2(&s, &r);
  847|      0|  ge_p2_dbl(&r, &s);
  848|      0|  x25519_ge_p1p1_to_p2(&s, &r);
  849|      0|  ge_p2_dbl(&r, &s);
  850|      0|  x25519_ge_p1p1_to_p3(h, &r);
  851|       |
  852|      0|  for (i = 0; i < 64; i += 2) {
  ------------------
  |  Branch (852:15): [True: 0, False: 0]
  ------------------
  853|      0|    table_select(&t, i / 2, e[i]);
  854|      0|    ge_madd(&r, h, &t);
  855|      0|    x25519_ge_p1p1_to_p3(h, &r);
  856|      0|  }
  857|      0|}
ED25519_keypair_from_seed:
 1975|     51|                               const uint8_t seed[32]) {
 1976|     51|  uint8_t az[SHA512_DIGEST_LENGTH];
 1977|     51|  SHA512(seed, 32, az);
 1978|       |
 1979|     51|  az[0] &= 248;
 1980|     51|  az[31] &= 127;
 1981|     51|  az[31] |= 64;
 1982|       |
 1983|     51|  ge_p3 A;
 1984|     51|  x25519_ge_scalarmult_base(&A, az);
 1985|     51|  ge_p3_tobytes(out_public_key, &A);
 1986|       |
 1987|     51|  OPENSSL_memcpy(out_private_key, seed, 32);
 1988|     51|  OPENSSL_memcpy(out_private_key + 32, out_public_key, 32);
 1989|     51|}
X25519_public_from_private:
 2125|     85|                                const uint8_t private_key[32]) {
 2126|       |#if defined(BORINGSSL_X25519_NEON)
 2127|       |  if (CRYPTO_is_NEON_capable()) {
 2128|       |    static const uint8_t kMongomeryBasePoint[32] = {9};
 2129|       |    x25519_NEON(out_public_value, private_key, kMongomeryBasePoint);
 2130|       |    return;
 2131|       |  }
 2132|       |#endif
 2133|       |
 2134|     85|  uint8_t e[32];
 2135|     85|  OPENSSL_memcpy(e, private_key, 32);
 2136|     85|  e[0] &= 248;
 2137|     85|  e[31] &= 127;
 2138|     85|  e[31] |= 64;
 2139|       |
 2140|     85|  ge_p3 A;
 2141|     85|  x25519_ge_scalarmult_base(&A, e);
 2142|       |
 2143|       |  // We only need the u-coordinate of the curve25519 point. The map is
 2144|       |  // u=(y+1)/(1-y). Since y=Y/Z, this gives u=(Z+Y)/(Z-Y).
 2145|     85|  fe_loose zplusy, zminusy;
 2146|     85|  fe zminusy_inv;
 2147|     85|  fe_add(&zplusy, &A.Z, &A.Y);
 2148|     85|  fe_sub(&zminusy, &A.Z, &A.Y);
 2149|     85|  fe_loose_invert(&zminusy_inv, &zminusy);
 2150|     85|  fe_mul_tlt(&zminusy_inv, &zplusy, &zminusy_inv);
 2151|     85|  fe_tobytes(out_public_value, &zminusy_inv);
 2152|     85|  CONSTTIME_DECLASSIFY(out_public_value, 32);
 2153|     85|}
curve25519.c:fe_invert:
  374|     51|static void fe_invert(fe *out, const fe *z) {
  375|     51|  fe_loose l;
  376|     51|  fe_copy_lt(&l, z);
  377|     51|  fe_loose_invert(out, &l);
  378|     51|}
curve25519.c:fe_mul_ttt:
  231|  1.46k|static void fe_mul_ttt(fe *h, const fe *f, const fe *g) {
  232|  1.46k|  fe_mul_impl(h->v, f->v, g->v);
  233|  1.46k|}
curve25519.c:fe_mul_impl:
  216|  1.68k|                        const fe_limb_t in2[FE_NUM_LIMBS]) {
  217|  1.68k|  assert_fe_loose(in1);
  ------------------
  |  |   99|  1.68k|  do {                                                                  \
  |  |  100|  10.0k|    for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \
  |  |  ------------------
  |  |  |  Branch (100:37): [True: 8.41k, False: 1.68k]
  |  |  ------------------
  |  |  101|  8.41k|      assert(f[_assert_fe_i] <= UINT64_C(0x1a666666666664));            \
  |  |  102|  8.41k|    }                                                                   \
  |  |  103|  1.68k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (103:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  218|  1.68k|  assert_fe_loose(in2);
  ------------------
  |  |   99|  1.68k|  do {                                                                  \
  |  |  100|  10.0k|    for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \
  |  |  ------------------
  |  |  |  Branch (100:37): [True: 8.41k, False: 1.68k]
  |  |  ------------------
  |  |  101|  8.41k|      assert(f[_assert_fe_i] <= UINT64_C(0x1a666666666664));            \
  |  |  102|  8.41k|    }                                                                   \
  |  |  103|  1.68k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (103:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  219|  1.68k|  fiat_25519_carry_mul(out, in1, in2);
  220|  1.68k|  assert_fe(out);
  ------------------
  |  |   82|  1.68k|  do {                                                                  \
  |  |   83|  10.0k|    for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \
  |  |  ------------------
  |  |  |  Branch (83:37): [True: 8.41k, False: 1.68k]
  |  |  ------------------
  |  |   84|  8.41k|      assert(f[_assert_fe_i] <= UINT64_C(0x8cccccccccccc));             \
  |  |   85|  8.41k|    }                                                                   \
  |  |   86|  1.68k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (86:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  221|  1.68k|}
curve25519.c:fe_tobytes:
  165|    187|static void fe_tobytes(uint8_t s[32], const fe *f) {
  166|    187|  assert_fe(f->v);
  ------------------
  |  |   82|    187|  do {                                                                  \
  |  |   83|  1.12k|    for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \
  |  |  ------------------
  |  |  |  Branch (83:37): [True: 935, False: 187]
  |  |  ------------------
  |  |   84|    935|      assert(f[_assert_fe_i] <= UINT64_C(0x8cccccccccccc));             \
  |  |   85|    935|    }                                                                   \
  |  |   86|    187|  } while (0)
  |  |  ------------------
  |  |  |  Branch (86:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  167|    187|  fiat_25519_to_bytes(s, f->v);
  168|    187|}
curve25519.c:fe_isnegative:
  394|     51|static int fe_isnegative(const fe *f) {
  395|     51|  uint8_t s[32];
  396|     51|  fe_tobytes(s, f);
  397|     51|  return s[0] & 1;
  398|     51|}
curve25519.c:fe_sq_tt:
  253|  34.4k|static void fe_sq_tt(fe *h, const fe *f) {
  254|  34.4k|  assert_fe_loose(f->v);
  ------------------
  |  |   99|  34.4k|  do {                                                                  \
  |  |  100|   206k|    for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \
  |  |  ------------------
  |  |  |  Branch (100:37): [True: 172k, False: 34.4k]
  |  |  ------------------
  |  |  101|   172k|      assert(f[_assert_fe_i] <= UINT64_C(0x1a666666666664));            \
  |  |  102|   172k|    }                                                                   \
  |  |  103|  34.4k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (103:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  255|  34.4k|  fiat_25519_carry_square(h->v, f->v);
  256|  34.4k|  assert_fe(h->v);
  ------------------
  |  |   82|  34.4k|  do {                                                                  \
  |  |   83|   206k|    for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \
  |  |  ------------------
  |  |  |  Branch (83:37): [True: 172k, False: 34.4k]
  |  |  ------------------
  |  |   84|   172k|      assert(f[_assert_fe_i] <= UINT64_C(0x8cccccccccccc));             \
  |  |   85|   172k|    }                                                                   \
  |  |   86|  34.4k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (86:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  257|  34.4k|}
curve25519.c:fe_sub:
  201|     85|static void fe_sub(fe_loose *h, const fe *f, const fe *g) {
  202|     85|  assert_fe(f->v);
  ------------------
  |  |   82|     85|  do {                                                                  \
  |  |   83|    510|    for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \
  |  |  ------------------
  |  |  |  Branch (83:37): [True: 425, False: 85]
  |  |  ------------------
  |  |   84|    425|      assert(f[_assert_fe_i] <= UINT64_C(0x8cccccccccccc));             \
  |  |   85|    425|    }                                                                   \
  |  |   86|     85|  } while (0)
  |  |  ------------------
  |  |  |  Branch (86:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  203|     85|  assert_fe(g->v);
  ------------------
  |  |   82|     85|  do {                                                                  \
  |  |   83|    510|    for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \
  |  |  ------------------
  |  |  |  Branch (83:37): [True: 425, False: 85]
  |  |  ------------------
  |  |   84|    425|      assert(f[_assert_fe_i] <= UINT64_C(0x8cccccccccccc));             \
  |  |   85|    425|    }                                                                   \
  |  |   86|     85|  } while (0)
  |  |  ------------------
  |  |  |  Branch (86:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  204|     85|  fiat_25519_sub(h->v, f->v, g->v);
  205|     85|  assert_fe_loose(h->v);
  ------------------
  |  |   99|     85|  do {                                                                  \
  |  |  100|    510|    for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \
  |  |  ------------------
  |  |  |  Branch (100:37): [True: 425, False: 85]
  |  |  ------------------
  |  |  101|    425|      assert(f[_assert_fe_i] <= UINT64_C(0x1a666666666664));            \
  |  |  102|    425|    }                                                                   \
  |  |  103|     85|  } while (0)
  |  |  ------------------
  |  |  |  Branch (103:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  206|     85|}
curve25519.c:fe_add:
  192|     85|static void fe_add(fe_loose *h, const fe *f, const fe *g) {
  193|     85|  assert_fe(f->v);
  ------------------
  |  |   82|     85|  do {                                                                  \
  |  |   83|    510|    for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \
  |  |  ------------------
  |  |  |  Branch (83:37): [True: 425, False: 85]
  |  |  ------------------
  |  |   84|    425|      assert(f[_assert_fe_i] <= UINT64_C(0x8cccccccccccc));             \
  |  |   85|    425|    }                                                                   \
  |  |   86|     85|  } while (0)
  |  |  ------------------
  |  |  |  Branch (86:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  194|     85|  assert_fe(g->v);
  ------------------
  |  |   82|     85|  do {                                                                  \
  |  |   83|    510|    for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \
  |  |  ------------------
  |  |  |  Branch (83:37): [True: 425, False: 85]
  |  |  ------------------
  |  |   84|    425|      assert(f[_assert_fe_i] <= UINT64_C(0x8cccccccccccc));             \
  |  |   85|    425|    }                                                                   \
  |  |   86|     85|  } while (0)
  |  |  ------------------
  |  |  |  Branch (86:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  195|     85|  fiat_25519_add(h->v, f->v, g->v);
  196|     85|  assert_fe_loose(h->v);
  ------------------
  |  |   99|     85|  do {                                                                  \
  |  |  100|    510|    for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \
  |  |  ------------------
  |  |  |  Branch (100:37): [True: 425, False: 85]
  |  |  ------------------
  |  |  101|    425|      assert(f[_assert_fe_i] <= UINT64_C(0x1a666666666664));            \
  |  |  102|    425|    }                                                                   \
  |  |  103|     85|  } while (0)
  |  |  ------------------
  |  |  |  Branch (103:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  197|     85|}
curve25519.c:fe_copy_lt:
  311|     51|static void fe_copy_lt(fe_loose *h, const fe *f) {
  312|     51|  static_assert(sizeof(fe_loose) == sizeof(fe), "fe and fe_loose mismatch");
  313|     51|  OPENSSL_memmove(h, f, sizeof(fe));
  314|     51|}
curve25519.c:fe_mul_tlt:
  235|    221|static void fe_mul_tlt(fe *h, const fe_loose *f, const fe *g) {
  236|    221|  fe_mul_impl(h->v, f->v, g->v);
  237|    221|}
curve25519.c:fe_sq_tl:
  247|    136|static void fe_sq_tl(fe *h, const fe_loose *f) {
  248|    136|  assert_fe_loose(f->v);
  ------------------
  |  |   99|    136|  do {                                                                  \
  |  |  100|    816|    for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \
  |  |  ------------------
  |  |  |  Branch (100:37): [True: 680, False: 136]
  |  |  ------------------
  |  |  101|    680|      assert(f[_assert_fe_i] <= UINT64_C(0x1a666666666664));            \
  |  |  102|    680|    }                                                                   \
  |  |  103|    136|  } while (0)
  |  |  ------------------
  |  |  |  Branch (103:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  249|    136|  fiat_25519_carry_square(h->v, f->v);
  250|    136|  assert_fe(h->v);
  ------------------
  |  |   82|    136|  do {                                                                  \
  |  |   83|    816|    for (unsigned _assert_fe_i = 0; _assert_fe_i < 5; _assert_fe_i++) { \
  |  |  ------------------
  |  |  |  Branch (83:37): [True: 680, False: 136]
  |  |  ------------------
  |  |   84|    680|      assert(f[_assert_fe_i] <= UINT64_C(0x8cccccccccccc));             \
  |  |   85|    680|    }                                                                   \
  |  |   86|    136|  } while (0)
  |  |  ------------------
  |  |  |  Branch (86:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  251|    136|}
curve25519.c:ge_p3_tobytes:
  482|     51|static void ge_p3_tobytes(uint8_t s[32], const ge_p3 *h) {
  483|     51|  fe recip;
  484|     51|  fe x;
  485|     51|  fe y;
  486|       |
  487|     51|  fe_invert(&recip, &h->Z);
  488|     51|  fe_mul_ttt(&x, &h->X, &recip);
  489|     51|  fe_mul_ttt(&y, &h->Y, &recip);
  490|     51|  fe_tobytes(s, &y);
  491|     51|  s[31] ^= fe_isnegative(&x) << 7;
  492|     51|}
curve25519.c:fe_loose_invert:
  316|    136|static void fe_loose_invert(fe *out, const fe_loose *z) {
  317|    136|  fe t0;
  318|    136|  fe t1;
  319|    136|  fe t2;
  320|    136|  fe t3;
  321|    136|  int i;
  322|       |
  323|    136|  fe_sq_tl(&t0, z);
  324|    136|  fe_sq_tt(&t1, &t0);
  325|    272|  for (i = 1; i < 2; ++i) {
  ------------------
  |  Branch (325:15): [True: 136, False: 136]
  ------------------
  326|    136|    fe_sq_tt(&t1, &t1);
  327|    136|  }
  328|    136|  fe_mul_tlt(&t1, z, &t1);
  329|    136|  fe_mul_ttt(&t0, &t0, &t1);
  330|    136|  fe_sq_tt(&t2, &t0);
  331|    136|  fe_mul_ttt(&t1, &t1, &t2);
  332|    136|  fe_sq_tt(&t2, &t1);
  333|    680|  for (i = 1; i < 5; ++i) {
  ------------------
  |  Branch (333:15): [True: 544, False: 136]
  ------------------
  334|    544|    fe_sq_tt(&t2, &t2);
  335|    544|  }
  336|    136|  fe_mul_ttt(&t1, &t2, &t1);
  337|    136|  fe_sq_tt(&t2, &t1);
  338|  1.36k|  for (i = 1; i < 10; ++i) {
  ------------------
  |  Branch (338:15): [True: 1.22k, False: 136]
  ------------------
  339|  1.22k|    fe_sq_tt(&t2, &t2);
  340|  1.22k|  }
  341|    136|  fe_mul_ttt(&t2, &t2, &t1);
  342|    136|  fe_sq_tt(&t3, &t2);
  343|  2.72k|  for (i = 1; i < 20; ++i) {
  ------------------
  |  Branch (343:15): [True: 2.58k, False: 136]
  ------------------
  344|  2.58k|    fe_sq_tt(&t3, &t3);
  345|  2.58k|  }
  346|    136|  fe_mul_ttt(&t2, &t3, &t2);
  347|    136|  fe_sq_tt(&t2, &t2);
  348|  1.36k|  for (i = 1; i < 10; ++i) {
  ------------------
  |  Branch (348:15): [True: 1.22k, False: 136]
  ------------------
  349|  1.22k|    fe_sq_tt(&t2, &t2);
  350|  1.22k|  }
  351|    136|  fe_mul_ttt(&t1, &t2, &t1);
  352|    136|  fe_sq_tt(&t2, &t1);
  353|  6.80k|  for (i = 1; i < 50; ++i) {
  ------------------
  |  Branch (353:15): [True: 6.66k, False: 136]
  ------------------
  354|  6.66k|    fe_sq_tt(&t2, &t2);
  355|  6.66k|  }
  356|    136|  fe_mul_ttt(&t2, &t2, &t1);
  357|    136|  fe_sq_tt(&t3, &t2);
  358|  13.6k|  for (i = 1; i < 100; ++i) {
  ------------------
  |  Branch (358:15): [True: 13.4k, False: 136]
  ------------------
  359|  13.4k|    fe_sq_tt(&t3, &t3);
  360|  13.4k|  }
  361|    136|  fe_mul_ttt(&t2, &t3, &t2);
  362|    136|  fe_sq_tt(&t2, &t2);
  363|  6.80k|  for (i = 1; i < 50; ++i) {
  ------------------
  |  Branch (363:15): [True: 6.66k, False: 136]
  ------------------
  364|  6.66k|    fe_sq_tt(&t2, &t2);
  365|  6.66k|  }
  366|    136|  fe_mul_ttt(&t1, &t2, &t1);
  367|    136|  fe_sq_tt(&t1, &t1);
  368|    680|  for (i = 1; i < 5; ++i) {
  ------------------
  |  Branch (368:15): [True: 544, False: 136]
  ------------------
  369|    544|    fe_sq_tt(&t1, &t1);
  370|    544|  }
  371|    136|  fe_mul_ttt(out, &t1, &t0);
  372|    136|}

DSA_new:
   90|  1.34k|DSA *DSA_new(void) {
   91|  1.34k|  DSA *dsa = OPENSSL_malloc(sizeof(DSA));
   92|  1.34k|  if (dsa == NULL) {
  ------------------
  |  Branch (92:7): [True: 0, False: 1.34k]
  ------------------
   93|      0|    return NULL;
   94|      0|  }
   95|       |
   96|  1.34k|  OPENSSL_memset(dsa, 0, sizeof(DSA));
   97|       |
   98|  1.34k|  dsa->references = 1;
   99|       |
  100|  1.34k|  CRYPTO_MUTEX_init(&dsa->method_mont_lock);
  101|  1.34k|  CRYPTO_new_ex_data(&dsa->ex_data);
  102|       |
  103|  1.34k|  return dsa;
  104|  1.34k|}
DSA_free:
  106|  2.37k|void DSA_free(DSA *dsa) {
  107|  2.37k|  if (dsa == NULL) {
  ------------------
  |  Branch (107:7): [True: 1.03k, False: 1.34k]
  ------------------
  108|  1.03k|    return;
  109|  1.03k|  }
  110|       |
  111|  1.34k|  if (!CRYPTO_refcount_dec_and_test_zero(&dsa->references)) {
  ------------------
  |  Branch (111:7): [True: 0, False: 1.34k]
  ------------------
  112|      0|    return;
  113|      0|  }
  114|       |
  115|  1.34k|  CRYPTO_free_ex_data(&g_ex_data_class, dsa, &dsa->ex_data);
  116|       |
  117|  1.34k|  BN_clear_free(dsa->p);
  118|  1.34k|  BN_clear_free(dsa->q);
  119|  1.34k|  BN_clear_free(dsa->g);
  120|  1.34k|  BN_clear_free(dsa->pub_key);
  121|  1.34k|  BN_clear_free(dsa->priv_key);
  122|  1.34k|  BN_MONT_CTX_free(dsa->method_mont_p);
  123|  1.34k|  BN_MONT_CTX_free(dsa->method_mont_q);
  124|  1.34k|  CRYPTO_MUTEX_cleanup(&dsa->method_mont_lock);
  125|  1.34k|  OPENSSL_free(dsa);
  126|  1.34k|}

dsa_check_key:
   73|  2.03k|int dsa_check_key(const DSA *dsa) {
   74|  2.03k|  if (!dsa->p || !dsa->q || !dsa->g) {
  ------------------
  |  Branch (74:7): [True: 0, False: 2.03k]
  |  Branch (74:18): [True: 0, False: 2.03k]
  |  Branch (74:29): [True: 0, False: 2.03k]
  ------------------
   75|      0|    OPENSSL_PUT_ERROR(DSA, DSA_R_MISSING_PARAMETERS);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   76|      0|    return 0;
   77|      0|  }
   78|       |
   79|       |  // Fully checking for invalid DSA groups is expensive, so security and
   80|       |  // correctness of the signature scheme depend on how |dsa| was computed. I.e.
   81|       |  // we leave "assurance of domain parameter validity" from FIPS 186-4 to the
   82|       |  // caller. However, we check bounds on all values to avoid DoS vectors even
   83|       |  // when domain parameters are invalid. In particular, signing will infinite
   84|       |  // loop if |g| is zero.
   85|  2.03k|  if (BN_is_negative(dsa->p) || BN_is_negative(dsa->q) || BN_is_zero(dsa->p) ||
  ------------------
  |  Branch (85:7): [True: 0, False: 2.03k]
  |  Branch (85:33): [True: 0, False: 2.03k]
  |  Branch (85:59): [True: 1, False: 2.03k]
  ------------------
   86|  2.03k|      BN_is_zero(dsa->q) || !BN_is_odd(dsa->p) || !BN_is_odd(dsa->q) ||
  ------------------
  |  Branch (86:7): [True: 1, False: 2.03k]
  |  Branch (86:29): [True: 19, False: 2.01k]
  |  Branch (86:51): [True: 10, False: 2.00k]
  ------------------
   87|       |      // |q| must be a prime divisor of |p - 1|, which implies |q < p|.
   88|  2.03k|      BN_cmp(dsa->q, dsa->p) >= 0 ||
  ------------------
  |  Branch (88:7): [True: 33, False: 1.97k]
  ------------------
   89|       |      // |g| is in the multiplicative group of |p|.
   90|  2.03k|      BN_is_negative(dsa->g) || BN_is_zero(dsa->g) ||
  ------------------
  |  Branch (90:7): [True: 0, False: 1.97k]
  |  Branch (90:33): [True: 1, False: 1.97k]
  ------------------
   91|  2.03k|      BN_cmp(dsa->g, dsa->p) >= 0) {
  ------------------
  |  Branch (91:7): [True: 85, False: 1.88k]
  ------------------
   92|    150|    OPENSSL_PUT_ERROR(DSA, DSA_R_INVALID_PARAMETERS);
  ------------------
  |  |  441|    150|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   93|    150|    return 0;
   94|    150|  }
   95|       |
   96|       |  // FIPS 186-4 allows only three different sizes for q.
   97|  1.88k|  unsigned q_bits = BN_num_bits(dsa->q);
   98|  1.88k|  if (q_bits != 160 && q_bits != 224 && q_bits != 256) {
  ------------------
  |  Branch (98:7): [True: 285, False: 1.60k]
  |  Branch (98:24): [True: 267, False: 18]
  |  Branch (98:41): [True: 219, False: 48]
  ------------------
   99|    219|    OPENSSL_PUT_ERROR(DSA, DSA_R_BAD_Q_VALUE);
  ------------------
  |  |  441|    219|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  100|    219|    return 0;
  101|    219|  }
  102|       |
  103|       |  // Bound |dsa->p| to avoid a DoS vector. Note this limit is much larger than
  104|       |  // the one in FIPS 186-4, which only allows L = 1024, 2048, and 3072.
  105|  1.66k|  if (BN_num_bits(dsa->p) > OPENSSL_DSA_MAX_MODULUS_BITS) {
  ------------------
  |  |   68|  1.66k|#define OPENSSL_DSA_MAX_MODULUS_BITS 10000
  ------------------
  |  Branch (105:7): [True: 17, False: 1.65k]
  ------------------
  106|     17|    OPENSSL_PUT_ERROR(DSA, DSA_R_MODULUS_TOO_LARGE);
  ------------------
  |  |  441|     17|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  107|     17|    return 0;
  108|     17|  }
  109|       |
  110|  1.65k|  if (dsa->pub_key != NULL) {
  ------------------
  |  Branch (110:7): [True: 0, False: 1.65k]
  ------------------
  111|       |    // The public key is also in the multiplicative group of |p|.
  112|      0|    if (BN_is_negative(dsa->pub_key) || BN_is_zero(dsa->pub_key) ||
  ------------------
  |  Branch (112:9): [True: 0, False: 0]
  |  Branch (112:41): [True: 0, False: 0]
  ------------------
  113|      0|        BN_cmp(dsa->pub_key, dsa->p) >= 0) {
  ------------------
  |  Branch (113:9): [True: 0, False: 0]
  ------------------
  114|      0|      OPENSSL_PUT_ERROR(DSA, DSA_R_INVALID_PARAMETERS);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  115|      0|      return 0;
  116|      0|    }
  117|      0|  }
  118|       |
  119|  1.65k|  if (dsa->priv_key != NULL) {
  ------------------
  |  Branch (119:7): [True: 819, False: 833]
  ------------------
  120|       |    // The private key is a non-zero element of the scalar field, determined by
  121|       |    // |q|.
  122|    819|    if (BN_is_negative(dsa->priv_key) || BN_is_zero(dsa->priv_key) ||
  ------------------
  |  Branch (122:9): [True: 0, False: 819]
  |  Branch (122:42): [True: 1, False: 818]
  ------------------
  123|    819|        BN_cmp(dsa->priv_key, dsa->q) >= 0) {
  ------------------
  |  Branch (123:9): [True: 3, False: 815]
  ------------------
  124|      4|      OPENSSL_PUT_ERROR(DSA, DSA_R_INVALID_PARAMETERS);
  ------------------
  |  |  441|      4|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  125|      4|      return 0;
  126|      4|    }
  127|    819|  }
  128|       |
  129|  1.64k|  return 1;
  130|  1.65k|}
DSA_parse_parameters:
  218|  1.34k|DSA *DSA_parse_parameters(CBS *cbs) {
  219|  1.34k|  DSA *ret = DSA_new();
  220|  1.34k|  if (ret == NULL) {
  ------------------
  |  Branch (220:7): [True: 0, False: 1.34k]
  ------------------
  221|      0|    return NULL;
  222|      0|  }
  223|  1.34k|  CBS child;
  224|  1.34k|  if (!CBS_get_asn1(cbs, &child, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|  1.34k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|  1.34k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|  1.34k|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (224:7): [True: 2, False: 1.34k]
  ------------------
  225|  1.34k|      !parse_integer(&child, &ret->p) ||
  ------------------
  |  Branch (225:7): [True: 32, False: 1.30k]
  ------------------
  226|  1.34k|      !parse_integer(&child, &ret->q) ||
  ------------------
  |  Branch (226:7): [True: 64, False: 1.24k]
  ------------------
  227|  1.34k|      !parse_integer(&child, &ret->g) ||
  ------------------
  |  Branch (227:7): [True: 4, False: 1.24k]
  ------------------
  228|  1.34k|      CBS_len(&child) != 0) {
  ------------------
  |  Branch (228:7): [True: 21, False: 1.21k]
  ------------------
  229|    123|    OPENSSL_PUT_ERROR(DSA, DSA_R_DECODE_ERROR);
  ------------------
  |  |  441|    123|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  230|    123|    goto err;
  231|    123|  }
  232|  1.21k|  if (!dsa_check_key(ret)) {
  ------------------
  |  Branch (232:7): [True: 386, False: 833]
  ------------------
  233|    386|    goto err;
  234|    386|  }
  235|    833|  return ret;
  236|       |
  237|    509|err:
  238|    509|  DSA_free(ret);
  239|    509|  return NULL;
  240|  1.21k|}
DSA_marshal_parameters:
  242|    815|int DSA_marshal_parameters(CBB *cbb, const DSA *dsa) {
  243|    815|  CBB child;
  244|    815|  if (!CBB_add_asn1(cbb, &child, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|    815|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|    815|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|    815|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (244:7): [True: 0, False: 815]
  ------------------
  245|    815|      !marshal_integer(&child, dsa->p) ||
  ------------------
  |  Branch (245:7): [True: 0, False: 815]
  ------------------
  246|    815|      !marshal_integer(&child, dsa->q) ||
  ------------------
  |  Branch (246:7): [True: 0, False: 815]
  ------------------
  247|    815|      !marshal_integer(&child, dsa->g) ||
  ------------------
  |  Branch (247:7): [True: 0, False: 815]
  ------------------
  248|    815|      !CBB_flush(cbb)) {
  ------------------
  |  Branch (248:7): [True: 0, False: 815]
  ------------------
  249|      0|    OPENSSL_PUT_ERROR(DSA, DSA_R_ENCODE_ERROR);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  250|      0|    return 0;
  251|      0|  }
  252|    815|  return 1;
  253|    815|}
dsa_asn1.c:parse_integer:
  132|  3.89k|static int parse_integer(CBS *cbs, BIGNUM **out) {
  133|  3.89k|  assert(*out == NULL);
  134|  3.89k|  *out = BN_new();
  135|  3.89k|  if (*out == NULL) {
  ------------------
  |  Branch (135:7): [True: 0, False: 3.89k]
  ------------------
  136|      0|    return 0;
  137|      0|  }
  138|  3.89k|  return BN_parse_asn1_unsigned(cbs, *out);
  139|  3.89k|}
dsa_asn1.c:marshal_integer:
  141|  2.44k|static int marshal_integer(CBB *cbb, BIGNUM *bn) {
  142|  2.44k|  if (bn == NULL) {
  ------------------
  |  Branch (142:7): [True: 0, False: 2.44k]
  ------------------
  143|       |    // A DSA object may be missing some components.
  144|      0|    OPENSSL_PUT_ERROR(DSA, ERR_R_PASSED_NULL_PARAMETER);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  145|      0|    return 0;
  146|      0|  }
  147|  2.44k|  return BN_marshal_asn1(cbb, bn);
  148|  2.44k|}

EC_KEY_parse_private_key:
   75|  1.53k|EC_KEY *EC_KEY_parse_private_key(CBS *cbs, const EC_GROUP *group) {
   76|  1.53k|  CBS ec_private_key, private_key;
   77|  1.53k|  uint64_t version;
   78|  1.53k|  if (!CBS_get_asn1(cbs, &ec_private_key, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|  1.53k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|  1.53k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|  1.53k|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (78:7): [True: 3, False: 1.52k]
  ------------------
   79|  1.53k|      !CBS_get_asn1_uint64(&ec_private_key, &version) ||
  ------------------
  |  Branch (79:7): [True: 2, False: 1.52k]
  ------------------
   80|  1.53k|      version != 1 ||
  ------------------
  |  Branch (80:7): [True: 121, False: 1.40k]
  ------------------
   81|  1.53k|      !CBS_get_asn1(&ec_private_key, &private_key, CBS_ASN1_OCTETSTRING)) {
  ------------------
  |  |  217|  1.40k|#define CBS_ASN1_OCTETSTRING 0x4u
  ------------------
  |  Branch (81:7): [True: 1, False: 1.40k]
  ------------------
   82|    127|    OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
  ------------------
  |  |  441|    127|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   83|    127|    return NULL;
   84|    127|  }
   85|       |
   86|       |  // Parse the optional parameters field.
   87|  1.40k|  EC_GROUP *inner_group = NULL;
   88|  1.40k|  EC_KEY *ret = NULL;
   89|  1.40k|  BIGNUM *priv_key = NULL;
   90|  1.40k|  if (CBS_peek_asn1_tag(&ec_private_key, kParametersTag)) {
  ------------------
  |  Branch (90:7): [True: 240, False: 1.16k]
  ------------------
   91|       |    // Per SEC 1, as an alternative to omitting it, one is allowed to specify
   92|       |    // this field and put in a NULL to mean inheriting this value. This was
   93|       |    // omitted in a previous version of this logic without problems, so leave it
   94|       |    // unimplemented.
   95|    240|    CBS child;
   96|    240|    if (!CBS_get_asn1(&ec_private_key, &child, kParametersTag)) {
  ------------------
  |  Branch (96:9): [True: 1, False: 239]
  ------------------
   97|      1|      OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
  ------------------
  |  |  441|      1|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   98|      1|      goto err;
   99|      1|    }
  100|    239|    inner_group = EC_KEY_parse_parameters(&child);
  101|    239|    if (inner_group == NULL) {
  ------------------
  |  Branch (101:9): [True: 216, False: 23]
  ------------------
  102|    216|      goto err;
  103|    216|    }
  104|     23|    if (group == NULL) {
  ------------------
  |  Branch (104:9): [True: 0, False: 23]
  ------------------
  105|      0|      group = inner_group;
  106|     23|    } else if (EC_GROUP_cmp(group, inner_group, NULL) != 0) {
  ------------------
  |  Branch (106:16): [True: 1, False: 22]
  ------------------
  107|       |      // If a group was supplied externally, it must match.
  108|      1|      OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH);
  ------------------
  |  |  441|      1|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  109|      1|      goto err;
  110|      1|    }
  111|     22|    if (CBS_len(&child) != 0) {
  ------------------
  |  Branch (111:9): [True: 18, False: 4]
  ------------------
  112|     18|      OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
  ------------------
  |  |  441|     18|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  113|     18|      goto err;
  114|     18|    }
  115|     22|  }
  116|       |
  117|  1.16k|  if (group == NULL) {
  ------------------
  |  Branch (117:7): [True: 0, False: 1.16k]
  ------------------
  118|      0|    OPENSSL_PUT_ERROR(EC, EC_R_MISSING_PARAMETERS);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  119|      0|    goto err;
  120|      0|  }
  121|       |
  122|  1.16k|  ret = EC_KEY_new();
  123|  1.16k|  if (ret == NULL || !EC_KEY_set_group(ret, group)) {
  ------------------
  |  Branch (123:7): [True: 0, False: 1.16k]
  |  Branch (123:22): [True: 0, False: 1.16k]
  ------------------
  124|      0|    goto err;
  125|      0|  }
  126|       |
  127|       |  // Although RFC 5915 specifies the length of the key, OpenSSL historically
  128|       |  // got this wrong, so accept any length. See upstream's
  129|       |  // 30cd4ff294252c4b6a4b69cbef6a5b4117705d22.
  130|  1.16k|  priv_key = BN_bin2bn(CBS_data(&private_key), CBS_len(&private_key), NULL);
  131|  1.16k|  ret->pub_key = EC_POINT_new(group);
  132|  1.16k|  if (priv_key == NULL || ret->pub_key == NULL ||
  ------------------
  |  Branch (132:7): [True: 0, False: 1.16k]
  |  Branch (132:27): [True: 0, False: 1.16k]
  ------------------
  133|  1.16k|      !EC_KEY_set_private_key(ret, priv_key)) {
  ------------------
  |  Branch (133:7): [True: 145, False: 1.02k]
  ------------------
  134|    145|    goto err;
  135|    145|  }
  136|       |
  137|  1.02k|  if (CBS_peek_asn1_tag(&ec_private_key, kPublicKeyTag)) {
  ------------------
  |  Branch (137:7): [True: 776, False: 246]
  ------------------
  138|    776|    CBS child, public_key;
  139|    776|    uint8_t padding;
  140|    776|    if (!CBS_get_asn1(&ec_private_key, &child, kPublicKeyTag) ||
  ------------------
  |  Branch (140:9): [True: 1, False: 775]
  ------------------
  141|    776|        !CBS_get_asn1(&child, &public_key, CBS_ASN1_BITSTRING) ||
  ------------------
  |  |  216|    775|#define CBS_ASN1_BITSTRING 0x3u
  ------------------
  |  Branch (141:9): [True: 1, False: 774]
  ------------------
  142|       |        // As in a SubjectPublicKeyInfo, the byte-encoded public key is then
  143|       |        // encoded as a BIT STRING with bits ordered as in the DER encoding.
  144|    776|        !CBS_get_u8(&public_key, &padding) ||
  ------------------
  |  Branch (144:9): [True: 1, False: 773]
  ------------------
  145|    776|        padding != 0 ||
  ------------------
  |  Branch (145:9): [True: 18, False: 755]
  ------------------
  146|       |        // Explicitly check |public_key| is non-empty to save the conversion
  147|       |        // form later.
  148|    776|        CBS_len(&public_key) == 0 ||
  ------------------
  |  Branch (148:9): [True: 1, False: 754]
  ------------------
  149|    776|        !EC_POINT_oct2point(group, ret->pub_key, CBS_data(&public_key),
  ------------------
  |  Branch (149:9): [True: 273, False: 481]
  ------------------
  150|    754|                            CBS_len(&public_key), NULL) ||
  151|    776|        CBS_len(&child) != 0) {
  ------------------
  |  Branch (151:9): [True: 166, False: 315]
  ------------------
  152|    461|      OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
  ------------------
  |  |  441|    461|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  153|    461|      goto err;
  154|    461|    }
  155|       |
  156|       |    // Save the point conversion form.
  157|       |    // TODO(davidben): Consider removing this.
  158|    315|    ret->conv_form =
  159|    315|        (point_conversion_form_t)(CBS_data(&public_key)[0] & ~0x01);
  160|    315|  } else {
  161|       |    // Compute the public key instead.
  162|    246|    if (!ec_point_mul_scalar_base(group, &ret->pub_key->raw,
  ------------------
  |  Branch (162:9): [True: 0, False: 246]
  ------------------
  163|    246|                                  &ret->priv_key->scalar)) {
  164|      0|      goto err;
  165|      0|    }
  166|       |    // Remember the original private-key-only encoding.
  167|       |    // TODO(davidben): Consider removing this.
  168|    246|    ret->enc_flag |= EC_PKEY_NO_PUBKEY;
  ------------------
  |  |  146|    246|#define EC_PKEY_NO_PUBKEY 0x002
  ------------------
  169|    246|  }
  170|       |
  171|    561|  if (CBS_len(&ec_private_key) != 0) {
  ------------------
  |  Branch (171:7): [True: 105, False: 456]
  ------------------
  172|    105|    OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
  ------------------
  |  |  441|    105|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  173|    105|    goto err;
  174|    105|  }
  175|       |
  176|       |  // Ensure the resulting key is valid.
  177|    456|  if (!EC_KEY_check_key(ret)) {
  ------------------
  |  Branch (177:7): [True: 307, False: 149]
  ------------------
  178|    307|    goto err;
  179|    307|  }
  180|       |
  181|    149|  BN_free(priv_key);
  182|    149|  EC_GROUP_free(inner_group);
  183|    149|  return ret;
  184|       |
  185|  1.25k|err:
  186|  1.25k|  EC_KEY_free(ret);
  187|  1.25k|  BN_free(priv_key);
  188|  1.25k|  EC_GROUP_free(inner_group);
  189|  1.25k|  return NULL;
  190|    456|}
EC_KEY_marshal_private_key:
  193|     27|                               unsigned enc_flags) {
  194|     27|  if (key == NULL || key->group == NULL || key->priv_key == NULL) {
  ------------------
  |  Branch (194:7): [True: 0, False: 27]
  |  Branch (194:22): [True: 0, False: 27]
  |  Branch (194:44): [True: 0, False: 27]
  ------------------
  195|      0|    OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  196|      0|    return 0;
  197|      0|  }
  198|       |
  199|     27|  CBB ec_private_key, private_key;
  200|     27|  if (!CBB_add_asn1(cbb, &ec_private_key, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|     27|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|     27|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|     27|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (200:7): [True: 0, False: 27]
  ------------------
  201|     27|      !CBB_add_asn1_uint64(&ec_private_key, 1 /* version */) ||
  ------------------
  |  Branch (201:7): [True: 0, False: 27]
  ------------------
  202|     27|      !CBB_add_asn1(&ec_private_key, &private_key, CBS_ASN1_OCTETSTRING) ||
  ------------------
  |  |  217|     27|#define CBS_ASN1_OCTETSTRING 0x4u
  ------------------
  |  Branch (202:7): [True: 0, False: 27]
  ------------------
  203|     27|      !BN_bn2cbb_padded(&private_key,
  ------------------
  |  Branch (203:7): [True: 0, False: 27]
  ------------------
  204|     27|                        BN_num_bytes(EC_GROUP_get0_order(key->group)),
  205|     27|                        EC_KEY_get0_private_key(key))) {
  206|      0|    OPENSSL_PUT_ERROR(EC, EC_R_ENCODE_ERROR);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  207|      0|    return 0;
  208|      0|  }
  209|       |
  210|     27|  if (!(enc_flags & EC_PKEY_NO_PARAMETERS)) {
  ------------------
  |  |  145|     27|#define EC_PKEY_NO_PARAMETERS 0x001
  ------------------
  |  Branch (210:7): [True: 0, False: 27]
  ------------------
  211|      0|    CBB child;
  212|      0|    if (!CBB_add_asn1(&ec_private_key, &child, kParametersTag) ||
  ------------------
  |  Branch (212:9): [True: 0, False: 0]
  ------------------
  213|      0|        !EC_KEY_marshal_curve_name(&child, key->group) ||
  ------------------
  |  Branch (213:9): [True: 0, False: 0]
  ------------------
  214|      0|        !CBB_flush(&ec_private_key)) {
  ------------------
  |  Branch (214:9): [True: 0, False: 0]
  ------------------
  215|      0|      OPENSSL_PUT_ERROR(EC, EC_R_ENCODE_ERROR);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  216|      0|      return 0;
  217|      0|    }
  218|      0|  }
  219|       |
  220|       |  // TODO(fork): replace this flexibility with sensible default?
  221|     27|  if (!(enc_flags & EC_PKEY_NO_PUBKEY) && key->pub_key != NULL) {
  ------------------
  |  |  146|     27|#define EC_PKEY_NO_PUBKEY 0x002
  ------------------
  |  Branch (221:7): [True: 0, False: 27]
  |  Branch (221:43): [True: 0, False: 0]
  ------------------
  222|      0|    CBB child, public_key;
  223|      0|    if (!CBB_add_asn1(&ec_private_key, &child, kPublicKeyTag) ||
  ------------------
  |  Branch (223:9): [True: 0, False: 0]
  ------------------
  224|      0|        !CBB_add_asn1(&child, &public_key, CBS_ASN1_BITSTRING) ||
  ------------------
  |  |  216|      0|#define CBS_ASN1_BITSTRING 0x3u
  ------------------
  |  Branch (224:9): [True: 0, False: 0]
  ------------------
  225|       |        // As in a SubjectPublicKeyInfo, the byte-encoded public key is then
  226|       |        // encoded as a BIT STRING with bits ordered as in the DER encoding.
  227|      0|        !CBB_add_u8(&public_key, 0 /* padding */) ||
  ------------------
  |  Branch (227:9): [True: 0, False: 0]
  ------------------
  228|      0|        !EC_POINT_point2cbb(&public_key, key->group, key->pub_key,
  ------------------
  |  Branch (228:9): [True: 0, False: 0]
  ------------------
  229|      0|                            key->conv_form, NULL) ||
  230|      0|        !CBB_flush(&ec_private_key)) {
  ------------------
  |  Branch (230:9): [True: 0, False: 0]
  ------------------
  231|      0|      OPENSSL_PUT_ERROR(EC, EC_R_ENCODE_ERROR);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  232|      0|      return 0;
  233|      0|    }
  234|      0|  }
  235|       |
  236|     27|  if (!CBB_flush(cbb)) {
  ------------------
  |  Branch (236:7): [True: 0, False: 27]
  ------------------
  237|      0|    OPENSSL_PUT_ERROR(EC, EC_R_ENCODE_ERROR);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  238|      0|    return 0;
  239|      0|  }
  240|       |
  241|     27|  return 1;
  242|     27|}
EC_KEY_parse_curve_name:
  324|  1.87k|EC_GROUP *EC_KEY_parse_curve_name(CBS *cbs) {
  325|  1.87k|  CBS named_curve;
  326|  1.87k|  if (!CBS_get_asn1(cbs, &named_curve, CBS_ASN1_OBJECT)) {
  ------------------
  |  |  219|  1.87k|#define CBS_ASN1_OBJECT 0x6u
  ------------------
  |  Branch (326:7): [True: 263, False: 1.61k]
  ------------------
  327|    263|    OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
  ------------------
  |  |  441|    263|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  328|    263|    return NULL;
  329|    263|  }
  330|       |
  331|       |  // Look for a matching curve.
  332|  1.61k|  const struct built_in_curves *const curves = OPENSSL_built_in_curves();
  333|  4.54k|  for (size_t i = 0; i < OPENSSL_NUM_BUILT_IN_CURVES; i++) {
  ------------------
  |  |  780|  4.54k|#define OPENSSL_NUM_BUILT_IN_CURVES 4
  ------------------
  |  Branch (333:22): [True: 4.48k, False: 52]
  ------------------
  334|  4.48k|    const struct built_in_curve *curve = &curves->curves[i];
  335|  4.48k|    if (CBS_len(&named_curve) == curve->oid_len &&
  ------------------
  |  Branch (335:9): [True: 2.94k, False: 1.54k]
  ------------------
  336|  4.48k|        OPENSSL_memcmp(CBS_data(&named_curve), curve->oid, curve->oid_len) ==
  ------------------
  |  Branch (336:9): [True: 1.56k, False: 1.38k]
  ------------------
  337|  2.94k|            0) {
  338|  1.56k|      return EC_GROUP_new_by_curve_name(curve->nid);
  339|  1.56k|    }
  340|  4.48k|  }
  341|       |
  342|     52|  OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
  ------------------
  |  |  441|     52|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  343|     52|  return NULL;
  344|  1.61k|}
EC_KEY_marshal_curve_name:
  346|     27|int EC_KEY_marshal_curve_name(CBB *cbb, const EC_GROUP *group) {
  347|     27|  int nid = EC_GROUP_get_curve_name(group);
  348|     27|  if (nid == NID_undef) {
  ------------------
  |  |   85|     27|#define NID_undef 0
  ------------------
  |  Branch (348:7): [True: 0, False: 27]
  ------------------
  349|      0|    OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  350|      0|    return 0;
  351|      0|  }
  352|       |
  353|     27|  const struct built_in_curves *const curves = OPENSSL_built_in_curves();
  354|     47|  for (size_t i = 0; i < OPENSSL_NUM_BUILT_IN_CURVES; i++) {
  ------------------
  |  |  780|     47|#define OPENSSL_NUM_BUILT_IN_CURVES 4
  ------------------
  |  Branch (354:22): [True: 47, False: 0]
  ------------------
  355|     47|    const struct built_in_curve *curve = &curves->curves[i];
  356|     47|    if (curve->nid == nid) {
  ------------------
  |  Branch (356:9): [True: 27, False: 20]
  ------------------
  357|     27|      CBB child;
  358|     27|      return CBB_add_asn1(cbb, &child, CBS_ASN1_OBJECT) &&
  ------------------
  |  |  219|     27|#define CBS_ASN1_OBJECT 0x6u
  ------------------
  |  Branch (358:14): [True: 27, False: 0]
  ------------------
  359|     27|             CBB_add_bytes(&child, curve->oid, curve->oid_len) &&
  ------------------
  |  Branch (359:14): [True: 27, False: 0]
  ------------------
  360|     27|             CBB_flush(cbb);
  ------------------
  |  Branch (360:14): [True: 27, False: 0]
  ------------------
  361|     27|    }
  362|     47|  }
  363|       |
  364|      0|  OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  365|      0|  return 0;
  366|     27|}
EC_KEY_parse_parameters:
  368|  2.47k|EC_GROUP *EC_KEY_parse_parameters(CBS *cbs) {
  369|  2.47k|  if (!CBS_peek_asn1_tag(cbs, CBS_ASN1_SEQUENCE)) {
  ------------------
  |  |  222|  2.47k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|  2.47k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|  2.47k|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (369:7): [True: 1.87k, False: 594]
  ------------------
  370|  1.87k|    return EC_KEY_parse_curve_name(cbs);
  371|  1.87k|  }
  372|       |
  373|       |  // OpenSSL sometimes produces ECPrivateKeys with explicitly-encoded versions
  374|       |  // of named curves.
  375|       |  //
  376|       |  // TODO(davidben): Remove support for this.
  377|    594|  CBS prime, a, b, base_x, base_y, order;
  378|    594|  if (!parse_explicit_prime_curve(cbs, &prime, &a, &b, &base_x, &base_y,
  ------------------
  |  Branch (378:7): [True: 482, False: 112]
  ------------------
  379|    594|                                  &order)) {
  380|    482|    return NULL;
  381|    482|  }
  382|       |
  383|       |  // Look for a matching prime curve.
  384|    112|  const struct built_in_curves *const curves = OPENSSL_built_in_curves();
  385|    560|  for (size_t i = 0; i < OPENSSL_NUM_BUILT_IN_CURVES; i++) {
  ------------------
  |  |  780|    560|#define OPENSSL_NUM_BUILT_IN_CURVES 4
  ------------------
  |  Branch (385:22): [True: 448, False: 112]
  ------------------
  386|    448|    const struct built_in_curve *curve = &curves->curves[i];
  387|    448|    const unsigned param_len = curve->param_len;
  388|       |    // |curve->params| is ordered p, a, b, x, y, order, each component
  389|       |    // zero-padded up to the field length. Although SEC 1 states that the
  390|       |    // Field-Element-to-Octet-String conversion also pads, OpenSSL mis-encodes
  391|       |    // |a| and |b|, so this comparison must allow omitting leading zeros. (This
  392|       |    // is relevant for P-521 whose |b| has a leading 0.)
  393|    448|    if (integers_equal(&prime, curve->params, param_len) &&
  ------------------
  |  Branch (393:9): [True: 60, False: 388]
  ------------------
  394|    448|        integers_equal(&a, curve->params + param_len, param_len) &&
  ------------------
  |  Branch (394:9): [True: 30, False: 30]
  ------------------
  395|    448|        integers_equal(&b, curve->params + param_len * 2, param_len) &&
  ------------------
  |  Branch (395:9): [True: 0, False: 30]
  ------------------
  396|    448|        integers_equal(&base_x, curve->params + param_len * 3, param_len) &&
  ------------------
  |  Branch (396:9): [True: 0, False: 0]
  ------------------
  397|    448|        integers_equal(&base_y, curve->params + param_len * 4, param_len) &&
  ------------------
  |  Branch (397:9): [True: 0, False: 0]
  ------------------
  398|    448|        integers_equal(&order, curve->params + param_len * 5, param_len)) {
  ------------------
  |  Branch (398:9): [True: 0, False: 0]
  ------------------
  399|      0|      return EC_GROUP_new_by_curve_name(curve->nid);
  400|      0|    }
  401|    448|  }
  402|       |
  403|    112|  OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
  ------------------
  |  |  441|    112|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  404|    112|  return NULL;
  405|    112|}
ec_asn1.c:parse_explicit_prime_curve:
  249|    594|                                      CBS *out_base_y, CBS *out_order) {
  250|       |  // See RFC 3279, section 2.3.5. Note that RFC 3279 calls this structure an
  251|       |  // ECParameters while RFC 5480 calls it a SpecifiedECDomain.
  252|    594|  CBS params, field_id, field_type, curve, base, cofactor;
  253|    594|  int has_cofactor;
  254|    594|  uint64_t version;
  255|    594|  if (!CBS_get_asn1(in, &params, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|    594|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|    594|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|    594|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (255:7): [True: 2, False: 592]
  ------------------
  256|    594|      !CBS_get_asn1_uint64(&params, &version) ||
  ------------------
  |  Branch (256:7): [True: 4, False: 588]
  ------------------
  257|    594|      version != 1 ||
  ------------------
  |  Branch (257:7): [True: 124, False: 464]
  ------------------
  258|    594|      !CBS_get_asn1(&params, &field_id, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|    464|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|    464|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|    464|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (258:7): [True: 1, False: 463]
  ------------------
  259|    594|      !CBS_get_asn1(&field_id, &field_type, CBS_ASN1_OBJECT) ||
  ------------------
  |  |  219|    463|#define CBS_ASN1_OBJECT 0x6u
  ------------------
  |  Branch (259:7): [True: 1, False: 462]
  ------------------
  260|    594|      CBS_len(&field_type) != sizeof(kPrimeField) ||
  ------------------
  |  Branch (260:7): [True: 1, False: 461]
  ------------------
  261|    594|      OPENSSL_memcmp(CBS_data(&field_type), kPrimeField, sizeof(kPrimeField)) !=
  ------------------
  |  Branch (261:7): [True: 1, False: 460]
  ------------------
  262|    461|          0 ||
  263|    594|      !CBS_get_asn1(&field_id, out_prime, CBS_ASN1_INTEGER) ||
  ------------------
  |  |  215|    460|#define CBS_ASN1_INTEGER 0x2u
  ------------------
  |  Branch (263:7): [True: 1, False: 459]
  ------------------
  264|    594|      !CBS_is_unsigned_asn1_integer(out_prime) ||
  ------------------
  |  Branch (264:7): [True: 25, False: 434]
  ------------------
  265|    594|      CBS_len(&field_id) != 0 ||
  ------------------
  |  Branch (265:7): [True: 14, False: 420]
  ------------------
  266|    594|      !CBS_get_asn1(&params, &curve, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|    420|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|    420|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|    420|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (266:7): [True: 13, False: 407]
  ------------------
  267|    594|      !CBS_get_asn1(&curve, out_a, CBS_ASN1_OCTETSTRING) ||
  ------------------
  |  |  217|    407|#define CBS_ASN1_OCTETSTRING 0x4u
  ------------------
  |  Branch (267:7): [True: 2, False: 405]
  ------------------
  268|    594|      !CBS_get_asn1(&curve, out_b, CBS_ASN1_OCTETSTRING) ||
  ------------------
  |  |  217|    405|#define CBS_ASN1_OCTETSTRING 0x4u
  ------------------
  |  Branch (268:7): [True: 1, False: 404]
  ------------------
  269|       |      // |curve| has an optional BIT STRING seed which we ignore.
  270|    594|      !CBS_get_optional_asn1(&curve, NULL, NULL, CBS_ASN1_BITSTRING) ||
  ------------------
  |  |  216|    404|#define CBS_ASN1_BITSTRING 0x3u
  ------------------
  |  Branch (270:7): [True: 1, False: 403]
  ------------------
  271|    594|      CBS_len(&curve) != 0 ||
  ------------------
  |  Branch (271:7): [True: 204, False: 199]
  ------------------
  272|    594|      !CBS_get_asn1(&params, &base, CBS_ASN1_OCTETSTRING) ||
  ------------------
  |  |  217|    199|#define CBS_ASN1_OCTETSTRING 0x4u
  ------------------
  |  Branch (272:7): [True: 3, False: 196]
  ------------------
  273|    594|      !CBS_get_asn1(&params, out_order, CBS_ASN1_INTEGER) ||
  ------------------
  |  |  215|    196|#define CBS_ASN1_INTEGER 0x2u
  ------------------
  |  Branch (273:7): [True: 2, False: 194]
  ------------------
  274|    594|      !CBS_is_unsigned_asn1_integer(out_order) ||
  ------------------
  |  Branch (274:7): [True: 1, False: 193]
  ------------------
  275|    594|      !CBS_get_optional_asn1(&params, &cofactor, &has_cofactor,
  ------------------
  |  Branch (275:7): [True: 1, False: 192]
  ------------------
  276|    193|                             CBS_ASN1_INTEGER) ||
  ------------------
  |  |  215|    193|#define CBS_ASN1_INTEGER 0x2u
  ------------------
  277|    594|      CBS_len(&params) != 0) {
  ------------------
  |  Branch (277:7): [True: 20, False: 172]
  ------------------
  278|    422|    OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
  ------------------
  |  |  441|    422|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  279|    422|    return 0;
  280|    422|  }
  281|       |
  282|    172|  if (has_cofactor) {
  ------------------
  |  Branch (282:7): [True: 54, False: 118]
  ------------------
  283|       |    // We only support prime-order curves so the cofactor must be one.
  284|     54|    if (CBS_len(&cofactor) != 1 ||
  ------------------
  |  Branch (284:9): [True: 45, False: 9]
  ------------------
  285|     54|        CBS_data(&cofactor)[0] != 1) {
  ------------------
  |  Branch (285:9): [True: 7, False: 2]
  ------------------
  286|     52|      OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
  ------------------
  |  |  441|     52|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  287|     52|      return 0;
  288|     52|    }
  289|     54|  }
  290|       |
  291|       |  // Require that the base point use uncompressed form.
  292|    120|  uint8_t form;
  293|    120|  if (!CBS_get_u8(&base, &form) || form != POINT_CONVERSION_UNCOMPRESSED) {
  ------------------
  |  Branch (293:7): [True: 6, False: 114]
  |  Branch (293:36): [True: 1, False: 113]
  ------------------
  294|      7|    OPENSSL_PUT_ERROR(EC, EC_R_INVALID_FORM);
  ------------------
  |  |  441|      7|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  295|      7|    return 0;
  296|      7|  }
  297|       |
  298|    113|  if (CBS_len(&base) % 2 != 0) {
  ------------------
  |  Branch (298:7): [True: 1, False: 112]
  ------------------
  299|      1|    OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
  ------------------
  |  |  441|      1|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  300|      1|    return 0;
  301|      1|  }
  302|    112|  size_t field_len = CBS_len(&base) / 2;
  303|    112|  CBS_init(out_base_x, CBS_data(&base), field_len);
  304|    112|  CBS_init(out_base_y, CBS_data(&base) + field_len, field_len);
  305|       |
  306|    112|  return 1;
  307|    113|}
ec_asn1.c:integers_equal:
  311|    538|static int integers_equal(const CBS *a, const uint8_t *b, size_t b_len) {
  312|       |  // Remove leading zeros from |a| and |b|.
  313|    538|  CBS a_copy = *a;
  314|  1.76k|  while (CBS_len(&a_copy) > 0 && CBS_data(&a_copy)[0] == 0) {
  ------------------
  |  Branch (314:10): [True: 1.74k, False: 18]
  |  Branch (314:34): [True: 1.22k, False: 520]
  ------------------
  315|  1.22k|    CBS_skip(&a_copy, 1);
  316|  1.22k|  }
  317|    568|  while (b_len > 0 && b[0] == 0) {
  ------------------
  |  Branch (317:10): [True: 568, False: 0]
  |  Branch (317:23): [True: 30, False: 538]
  ------------------
  318|     30|    b++;
  319|     30|    b_len--;
  320|     30|  }
  321|    538|  return CBS_mem_equal(&a_copy, b, b_len);
  322|    538|}

METHOD_ref:
   86|    603|void METHOD_ref(void *method_in) {
   87|    603|  assert(((struct openssl_method_common_st*) method_in)->is_static);
   88|    603|}
METHOD_unref:
   90|    603|void METHOD_unref(void *method_in) {
   91|    603|  struct openssl_method_common_st *method = method_in;
   92|       |
   93|    603|  if (method == NULL) {
  ------------------
  |  Branch (93:7): [True: 0, False: 603]
  ------------------
   94|      0|    return;
   95|      0|  }
   96|    603|  assert(method->is_static);
   97|    603|}

ERR_peek_last_error:
  328|    200|uint32_t ERR_peek_last_error(void) {
  329|    200|  return get_error_values(0 /* peek */, 1 /* top */, NULL, NULL, NULL, NULL);
  330|    200|}
ERR_clear_error:
  341|  1.85k|void ERR_clear_error(void) {
  342|  1.85k|  ERR_STATE *const state = err_get_state();
  343|  1.85k|  unsigned i;
  344|       |
  345|  1.85k|  if (state == NULL) {
  ------------------
  |  Branch (345:7): [True: 0, False: 1.85k]
  ------------------
  346|      0|    return;
  347|      0|  }
  348|       |
  349|  31.6k|  for (i = 0; i < ERR_NUM_ERRORS; i++) {
  ------------------
  |  |  477|  31.6k|#define ERR_NUM_ERRORS 16
  ------------------
  |  Branch (349:15): [True: 29.7k, False: 1.85k]
  ------------------
  350|  29.7k|    err_clear(&state->errors[i]);
  351|  29.7k|  }
  352|  1.85k|  free(state->to_free);
  353|  1.85k|  state->to_free = NULL;
  354|       |
  355|  1.85k|  state->top = state->bottom = 0;
  356|  1.85k|}
ERR_put_error:
  657|  9.51k|                   unsigned line) {
  658|  9.51k|  ERR_STATE *const state = err_get_state();
  659|  9.51k|  struct err_error_st *error;
  660|       |
  661|  9.51k|  if (state == NULL) {
  ------------------
  |  Branch (661:7): [True: 0, False: 9.51k]
  ------------------
  662|      0|    return;
  663|      0|  }
  664|       |
  665|  9.51k|  if (library == ERR_LIB_SYS && reason == 0) {
  ------------------
  |  Branch (665:7): [True: 0, False: 9.51k]
  |  Branch (665:33): [True: 0, False: 0]
  ------------------
  666|       |#if defined(OPENSSL_WINDOWS)
  667|       |    reason = GetLastError();
  668|       |#else
  669|      0|    reason = errno;
  670|      0|#endif
  671|      0|  }
  672|       |
  673|  9.51k|  state->top = (state->top + 1) % ERR_NUM_ERRORS;
  ------------------
  |  |  477|  9.51k|#define ERR_NUM_ERRORS 16
  ------------------
  674|  9.51k|  if (state->top == state->bottom) {
  ------------------
  |  Branch (674:7): [True: 5.14k, False: 4.36k]
  ------------------
  675|  5.14k|    state->bottom = (state->bottom + 1) % ERR_NUM_ERRORS;
  ------------------
  |  |  477|  5.14k|#define ERR_NUM_ERRORS 16
  ------------------
  676|  5.14k|  }
  677|       |
  678|  9.51k|  error = &state->errors[state->top];
  679|  9.51k|  err_clear(error);
  680|  9.51k|  error->file = file;
  681|  9.51k|  error->line = line;
  682|  9.51k|  error->packed = ERR_PACK(library, reason);
  ------------------
  |  |  480|  9.51k|  (((((uint32_t)(lib)) & 0xff) << 24) | ((((uint32_t)(reason)) & 0xfff)))
  ------------------
  683|  9.51k|}
err.c:get_error_values:
  231|    200|                                 const char **data, int *flags) {
  232|    200|  unsigned i = 0;
  233|    200|  ERR_STATE *state;
  234|    200|  struct err_error_st *error;
  235|    200|  uint32_t ret;
  236|       |
  237|    200|  state = err_get_state();
  238|    200|  if (state == NULL || state->bottom == state->top) {
  ------------------
  |  Branch (238:7): [True: 0, False: 200]
  |  Branch (238:24): [True: 0, False: 200]
  ------------------
  239|      0|    return 0;
  240|      0|  }
  241|       |
  242|    200|  if (top) {
  ------------------
  |  Branch (242:7): [True: 200, False: 0]
  ------------------
  243|    200|    assert(!inc);
  244|       |    // last error
  245|    200|    i = state->top;
  246|    200|  } else {
  247|      0|    i = (state->bottom + 1) % ERR_NUM_ERRORS;
  ------------------
  |  |  477|      0|#define ERR_NUM_ERRORS 16
  ------------------
  248|      0|  }
  249|       |
  250|    200|  error = &state->errors[i];
  251|    200|  ret = error->packed;
  252|       |
  253|    200|  if (file != NULL && line != NULL) {
  ------------------
  |  Branch (253:7): [True: 0, False: 200]
  |  Branch (253:23): [True: 0, False: 0]
  ------------------
  254|      0|    if (error->file == NULL) {
  ------------------
  |  Branch (254:9): [True: 0, False: 0]
  ------------------
  255|      0|      *file = "NA";
  256|      0|      *line = 0;
  257|      0|    } else {
  258|      0|      *file = error->file;
  259|      0|      *line = error->line;
  260|      0|    }
  261|      0|  }
  262|       |
  263|    200|  if (data != NULL) {
  ------------------
  |  Branch (263:7): [True: 0, False: 200]
  ------------------
  264|      0|    if (error->data == NULL) {
  ------------------
  |  Branch (264:9): [True: 0, False: 0]
  ------------------
  265|      0|      *data = "";
  266|      0|      if (flags != NULL) {
  ------------------
  |  Branch (266:11): [True: 0, False: 0]
  ------------------
  267|      0|        *flags = 0;
  268|      0|      }
  269|      0|    } else {
  270|      0|      *data = error->data;
  271|      0|      if (flags != NULL) {
  ------------------
  |  Branch (271:11): [True: 0, False: 0]
  ------------------
  272|       |        // Without |ERR_FLAG_MALLOCED|, rust-openssl assumes the string has a
  273|       |        // static lifetime. In both cases, we retain ownership of the string,
  274|       |        // and the caller is not expected to free it.
  275|      0|        *flags = ERR_FLAG_STRING | ERR_FLAG_MALLOCED;
  ------------------
  |  |  188|      0|#define ERR_FLAG_STRING 1
  ------------------
                      *flags = ERR_FLAG_STRING | ERR_FLAG_MALLOCED;
  ------------------
  |  |  197|      0|#define ERR_FLAG_MALLOCED 2
  ------------------
  276|      0|      }
  277|       |      // If this error is being removed, take ownership of data from
  278|       |      // the error. The semantics are such that the caller doesn't
  279|       |      // take ownership either. Instead the error system takes
  280|       |      // ownership and retains it until the next call that affects the
  281|       |      // error queue.
  282|      0|      if (inc) {
  ------------------
  |  Branch (282:11): [True: 0, False: 0]
  ------------------
  283|      0|        if (error->data != NULL) {
  ------------------
  |  Branch (283:13): [True: 0, False: 0]
  ------------------
  284|      0|          free(state->to_free);
  285|      0|          state->to_free = error->data;
  286|      0|        }
  287|      0|        error->data = NULL;
  288|      0|      }
  289|      0|    }
  290|      0|  }
  291|       |
  292|    200|  if (inc) {
  ------------------
  |  Branch (292:7): [True: 0, False: 200]
  ------------------
  293|      0|    assert(!top);
  294|      0|    err_clear(error);
  295|      0|    state->bottom = i;
  296|      0|  }
  297|       |
  298|    200|  return ret;
  299|    200|}
err.c:err_get_state:
  213|  11.5k|static ERR_STATE *err_get_state(void) {
  214|  11.5k|  ERR_STATE *state = CRYPTO_get_thread_local(OPENSSL_THREAD_LOCAL_ERR);
  215|  11.5k|  if (state == NULL) {
  ------------------
  |  Branch (215:7): [True: 1, False: 11.5k]
  ------------------
  216|      1|    state = malloc(sizeof(ERR_STATE));
  217|      1|    if (state == NULL) {
  ------------------
  |  Branch (217:9): [True: 0, False: 1]
  ------------------
  218|      0|      return NULL;
  219|      0|    }
  220|      1|    OPENSSL_memset(state, 0, sizeof(ERR_STATE));
  221|      1|    if (!CRYPTO_set_thread_local(OPENSSL_THREAD_LOCAL_ERR, state,
  ------------------
  |  Branch (221:9): [True: 0, False: 1]
  ------------------
  222|      1|                                 err_state_free)) {
  223|      0|      return NULL;
  224|      0|    }
  225|      1|  }
  226|       |
  227|  11.5k|  return state;
  228|  11.5k|}
err.c:err_clear:
  168|  39.2k|static void err_clear(struct err_error_st *error) {
  169|  39.2k|  free(error->data);
  170|  39.2k|  OPENSSL_memset(error, 0, sizeof(struct err_error_st));
  171|  39.2k|}

EVP_PKEY_new:
   83|  4.45k|EVP_PKEY *EVP_PKEY_new(void) {
   84|  4.45k|  EVP_PKEY *ret;
   85|       |
   86|  4.45k|  ret = OPENSSL_malloc(sizeof(EVP_PKEY));
   87|  4.45k|  if (ret == NULL) {
  ------------------
  |  Branch (87:7): [True: 0, False: 4.45k]
  ------------------
   88|      0|    return NULL;
   89|      0|  }
   90|       |
   91|  4.45k|  OPENSSL_memset(ret, 0, sizeof(EVP_PKEY));
   92|  4.45k|  ret->type = EVP_PKEY_NONE;
  ------------------
  |  |  174|  4.45k|#define EVP_PKEY_NONE NID_undef
  |  |  ------------------
  |  |  |  |   85|  4.45k|#define NID_undef 0
  |  |  ------------------
  ------------------
   93|  4.45k|  ret->references = 1;
   94|       |
   95|  4.45k|  return ret;
   96|  4.45k|}
EVP_PKEY_free:
  106|  4.45k|void EVP_PKEY_free(EVP_PKEY *pkey) {
  107|  4.45k|  if (pkey == NULL) {
  ------------------
  |  Branch (107:7): [True: 0, False: 4.45k]
  ------------------
  108|      0|    return;
  109|      0|  }
  110|       |
  111|  4.45k|  if (!CRYPTO_refcount_dec_and_test_zero(&pkey->references)) {
  ------------------
  |  Branch (111:7): [True: 0, False: 4.45k]
  ------------------
  112|      0|    return;
  113|      0|  }
  114|       |
  115|  4.45k|  free_it(pkey);
  116|  4.45k|  OPENSSL_free(pkey);
  117|  4.45k|}
EVP_PKEY_assign_DSA:
  276|    815|int EVP_PKEY_assign_DSA(EVP_PKEY *pkey, DSA *key) {
  277|    815|  return EVP_PKEY_assign(pkey, EVP_PKEY_DSA, key);
  ------------------
  |  |  177|    815|#define EVP_PKEY_DSA NID_dsa
  |  |  ------------------
  |  |  |  |  612|    815|#define NID_dsa 116
  |  |  ------------------
  ------------------
  278|    815|}
EVP_PKEY_assign_EC_KEY:
  304|     27|int EVP_PKEY_assign_EC_KEY(EVP_PKEY *pkey, EC_KEY *key) {
  305|     27|  return EVP_PKEY_assign(pkey, EVP_PKEY_EC, key);
  ------------------
  |  |  178|     27|#define EVP_PKEY_EC NID_X9_62_id_ecPublicKey
  |  |  ------------------
  |  |  |  | 1886|     27|#define NID_X9_62_id_ecPublicKey 408
  |  |  ------------------
  ------------------
  306|     27|}
EVP_PKEY_assign:
  327|    842|int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key) {
  328|    842|  if (!EVP_PKEY_set_type(pkey, type)) {
  ------------------
  |  Branch (328:7): [True: 0, False: 842]
  ------------------
  329|      0|    return 0;
  330|      0|  }
  331|    842|  pkey->pkey = key;
  332|    842|  return key != NULL;
  333|    842|}
EVP_PKEY_set_type:
  335|  5.29k|int EVP_PKEY_set_type(EVP_PKEY *pkey, int type) {
  336|  5.29k|  const EVP_PKEY_ASN1_METHOD *ameth;
  337|       |
  338|  5.29k|  if (pkey && pkey->pkey) {
  ------------------
  |  Branch (338:7): [True: 5.29k, False: 0]
  |  Branch (338:15): [True: 0, False: 5.29k]
  ------------------
  339|      0|    free_it(pkey);
  340|      0|  }
  341|       |
  342|  5.29k|  ameth = evp_pkey_asn1_find(type);
  343|  5.29k|  if (ameth == NULL) {
  ------------------
  |  Branch (343:7): [True: 0, False: 5.29k]
  ------------------
  344|      0|    OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  345|      0|    ERR_add_error_dataf("algorithm %d", type);
  346|      0|    return 0;
  347|      0|  }
  348|       |
  349|  5.29k|  if (pkey) {
  ------------------
  |  Branch (349:7): [True: 5.29k, False: 0]
  ------------------
  350|  5.29k|    pkey->ameth = ameth;
  351|  5.29k|    pkey->type = pkey->ameth->pkey_id;
  352|  5.29k|  }
  353|       |
  354|  5.29k|  return 1;
  355|  5.29k|}
evp.c:free_it:
   98|  4.45k|static void free_it(EVP_PKEY *pkey) {
   99|  4.45k|  if (pkey->ameth && pkey->ameth->pkey_free) {
  ------------------
  |  Branch (99:7): [True: 4.45k, False: 0]
  |  Branch (99:22): [True: 4.45k, False: 0]
  ------------------
  100|  4.45k|    pkey->ameth->pkey_free(pkey);
  101|  4.45k|    pkey->pkey = NULL;
  102|  4.45k|    pkey->type = EVP_PKEY_NONE;
  ------------------
  |  |  174|  4.45k|#define EVP_PKEY_NONE NID_undef
  |  |  ------------------
  |  |  |  |   85|  4.45k|#define NID_undef 0
  |  |  ------------------
  ------------------
  103|  4.45k|  }
  104|  4.45k|}
evp.c:evp_pkey_asn1_find:
  215|  5.29k|static const EVP_PKEY_ASN1_METHOD *evp_pkey_asn1_find(int nid) {
  216|  5.29k|  switch (nid) {
  217|    624|    case EVP_PKEY_RSA:
  ------------------
  |  |  175|    624|#define EVP_PKEY_RSA NID_rsaEncryption
  |  |  ------------------
  |  |  |  |  114|    624|#define NID_rsaEncryption 6
  |  |  ------------------
  ------------------
  |  Branch (217:5): [True: 624, False: 4.67k]
  ------------------
  218|    624|      return &rsa_asn1_meth;
  219|  2.26k|    case EVP_PKEY_EC:
  ------------------
  |  |  178|  2.26k|#define EVP_PKEY_EC NID_X9_62_id_ecPublicKey
  |  |  ------------------
  |  |  |  | 1886|  2.26k|#define NID_X9_62_id_ecPublicKey 408
  |  |  ------------------
  ------------------
  |  Branch (219:5): [True: 2.26k, False: 3.03k]
  ------------------
  220|  2.26k|      return &ec_asn1_meth;
  221|  2.15k|    case EVP_PKEY_DSA:
  ------------------
  |  |  177|  2.15k|#define EVP_PKEY_DSA NID_dsa
  |  |  ------------------
  |  |  |  |  612|  2.15k|#define NID_dsa 116
  |  |  ------------------
  ------------------
  |  Branch (221:5): [True: 2.15k, False: 3.13k]
  ------------------
  222|  2.15k|      return &dsa_asn1_meth;
  223|    110|    case EVP_PKEY_ED25519:
  ------------------
  |  |  179|    110|#define EVP_PKEY_ED25519 NID_ED25519
  |  |  ------------------
  |  |  |  | 4199|    110|#define NID_ED25519 949
  |  |  ------------------
  ------------------
  |  Branch (223:5): [True: 110, False: 5.18k]
  ------------------
  224|    110|      return &ed25519_asn1_meth;
  225|    144|    case EVP_PKEY_X25519:
  ------------------
  |  |  180|    144|#define EVP_PKEY_X25519 NID_X25519
  |  |  ------------------
  |  |  |  | 4195|    144|#define NID_X25519 948
  |  |  ------------------
  ------------------
  |  Branch (225:5): [True: 144, False: 5.15k]
  ------------------
  226|    144|      return &x25519_asn1_meth;
  227|      0|    default:
  ------------------
  |  Branch (227:5): [True: 0, False: 5.29k]
  ------------------
  228|      0|      return NULL;
  229|  5.29k|  }
  230|  5.29k|}

EVP_parse_private_key:
  154|  5.97k|EVP_PKEY *EVP_parse_private_key(CBS *cbs) {
  155|       |  // Parse the PrivateKeyInfo.
  156|  5.97k|  CBS pkcs8, algorithm, key;
  157|  5.97k|  uint64_t version;
  158|  5.97k|  int type;
  159|  5.97k|  if (!CBS_get_asn1(cbs, &pkcs8, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|  5.97k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|  5.97k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|  5.97k|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (159:7): [True: 937, False: 5.04k]
  ------------------
  160|  5.97k|      !CBS_get_asn1_uint64(&pkcs8, &version) ||
  ------------------
  |  Branch (160:7): [True: 338, False: 4.70k]
  ------------------
  161|  5.97k|      version != 0 ||
  ------------------
  |  Branch (161:7): [True: 118, False: 4.58k]
  ------------------
  162|  5.97k|      !CBS_get_asn1(&pkcs8, &algorithm, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|  4.58k|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|  4.58k|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|  4.58k|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (162:7): [True: 9, False: 4.57k]
  ------------------
  163|  5.97k|      !CBS_get_asn1(&pkcs8, &key, CBS_ASN1_OCTETSTRING)) {
  ------------------
  |  |  217|  4.57k|#define CBS_ASN1_OCTETSTRING 0x4u
  ------------------
  |  Branch (163:7): [True: 10, False: 4.56k]
  ------------------
  164|  1.41k|    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
  ------------------
  |  |  441|  1.41k|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  165|  1.41k|    return NULL;
  166|  1.41k|  }
  167|  4.56k|  if (!parse_key_type(&algorithm, &type)) {
  ------------------
  |  Branch (167:7): [True: 114, False: 4.45k]
  ------------------
  168|    114|    OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
  ------------------
  |  |  441|    114|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  169|    114|    return NULL;
  170|    114|  }
  171|       |
  172|       |  // A PrivateKeyInfo ends with a SET of Attributes which we ignore.
  173|       |
  174|       |  // Set up an |EVP_PKEY| of the appropriate type.
  175|  4.45k|  EVP_PKEY *ret = EVP_PKEY_new();
  176|  4.45k|  if (ret == NULL ||
  ------------------
  |  Branch (176:7): [True: 0, False: 4.45k]
  ------------------
  177|  4.45k|      !EVP_PKEY_set_type(ret, type)) {
  ------------------
  |  Branch (177:7): [True: 0, False: 4.45k]
  ------------------
  178|      0|    goto err;
  179|      0|  }
  180|       |
  181|       |  // Call into the type-specific PrivateKeyInfo decoding function.
  182|  4.45k|  if (ret->ameth->priv_decode == NULL) {
  ------------------
  |  Branch (182:7): [True: 0, False: 4.45k]
  ------------------
  183|      0|    OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  184|      0|    goto err;
  185|      0|  }
  186|  4.45k|  if (!ret->ameth->priv_decode(ret, &algorithm, &key)) {
  ------------------
  |  Branch (186:7): [True: 3.47k, False: 978]
  ------------------
  187|  3.47k|    goto err;
  188|  3.47k|  }
  189|       |
  190|    978|  return ret;
  191|       |
  192|  3.47k|err:
  193|  3.47k|  EVP_PKEY_free(ret);
  194|  3.47k|  return NULL;
  195|  4.45k|}
EVP_marshal_private_key:
  197|    978|int EVP_marshal_private_key(CBB *cbb, const EVP_PKEY *key) {
  198|    978|  if (key->ameth == NULL || key->ameth->priv_encode == NULL) {
  ------------------
  |  Branch (198:7): [True: 0, False: 978]
  |  Branch (198:29): [True: 0, False: 978]
  ------------------
  199|      0|    OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  200|      0|    return 0;
  201|      0|  }
  202|       |
  203|    978|  return key->ameth->priv_encode(cbb, key);
  204|    978|}
evp_asn1.c:parse_key_type:
   80|  4.56k|static int parse_key_type(CBS *cbs, int *out_type) {
   81|  4.56k|  CBS oid;
   82|  4.56k|  if (!CBS_get_asn1(cbs, &oid, CBS_ASN1_OBJECT)) {
  ------------------
  |  |  219|  4.56k|#define CBS_ASN1_OBJECT 0x6u
  ------------------
  |  Branch (82:7): [True: 2, False: 4.56k]
  ------------------
   83|      2|    return 0;
   84|      2|  }
   85|       |
   86|  10.9k|  for (unsigned i = 0; i < OPENSSL_ARRAY_SIZE(kASN1Methods); i++) {
  ------------------
  |  |  221|  10.9k|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0]))
  ------------------
  |  Branch (86:24): [True: 10.8k, False: 112]
  ------------------
   87|  10.8k|    const EVP_PKEY_ASN1_METHOD *method = kASN1Methods[i];
   88|  10.8k|    if (CBS_len(&oid) == method->oid_len &&
  ------------------
  |  Branch (88:9): [True: 6.07k, False: 4.76k]
  ------------------
   89|  10.8k|        OPENSSL_memcmp(CBS_data(&oid), method->oid, method->oid_len) == 0) {
  ------------------
  |  Branch (89:9): [True: 4.45k, False: 1.61k]
  ------------------
   90|  4.45k|      *out_type = method->pkey_id;
   91|  4.45k|      return 1;
   92|  4.45k|    }
   93|  10.8k|  }
   94|       |
   95|    112|  return 0;
   96|  4.56k|}

p_dsa_asn1.c:dsa_priv_decode:
  128|  1.34k|static int dsa_priv_decode(EVP_PKEY *out, CBS *params, CBS *key) {
  129|       |  // See PKCS#11, v2.40, section 2.5.
  130|       |
  131|       |  // Decode parameters.
  132|  1.34k|  BN_CTX *ctx = NULL;
  133|  1.34k|  DSA *dsa = DSA_parse_parameters(params);
  134|  1.34k|  if (dsa == NULL || CBS_len(params) != 0) {
  ------------------
  |  Branch (134:7): [True: 509, False: 833]
  |  Branch (134:22): [True: 1, False: 832]
  ------------------
  135|    510|    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
  ------------------
  |  |  441|    510|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  136|    510|    goto err;
  137|    510|  }
  138|       |
  139|    832|  dsa->priv_key = BN_new();
  140|    832|  if (dsa->priv_key == NULL) {
  ------------------
  |  Branch (140:7): [True: 0, False: 832]
  ------------------
  141|      0|    goto err;
  142|      0|  }
  143|    832|  if (!BN_parse_asn1_unsigned(key, dsa->priv_key) ||
  ------------------
  |  Branch (143:7): [True: 12, False: 820]
  ------------------
  144|    832|      CBS_len(key) != 0) {
  ------------------
  |  Branch (144:7): [True: 1, False: 819]
  ------------------
  145|     13|    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
  ------------------
  |  |  441|     13|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  146|     13|    goto err;
  147|     13|  }
  148|       |
  149|       |  // To avoid DoS attacks when importing private keys, check bounds on |dsa|.
  150|       |  // This bounds |dsa->priv_key| against |dsa->q| and bounds |dsa->q|'s bit
  151|       |  // width.
  152|    819|  if (!dsa_check_key(dsa)) {
  ------------------
  |  Branch (152:7): [True: 4, False: 815]
  ------------------
  153|      4|    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
  ------------------
  |  |  441|      4|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  154|      4|    goto err;
  155|      4|  }
  156|       |
  157|       |  // Calculate the public key.
  158|    815|  ctx = BN_CTX_new();
  159|    815|  dsa->pub_key = BN_new();
  160|    815|  if (ctx == NULL || dsa->pub_key == NULL ||
  ------------------
  |  Branch (160:7): [True: 0, False: 815]
  |  Branch (160:22): [True: 0, False: 815]
  ------------------
  161|    815|      !BN_mod_exp_mont_consttime(dsa->pub_key, dsa->g, dsa->priv_key, dsa->p,
  ------------------
  |  Branch (161:7): [True: 0, False: 815]
  ------------------
  162|    815|                                 ctx, NULL)) {
  163|      0|    goto err;
  164|      0|  }
  165|       |
  166|    815|  BN_CTX_free(ctx);
  167|    815|  EVP_PKEY_assign_DSA(out, dsa);
  168|    815|  return 1;
  169|       |
  170|    527|err:
  171|    527|  BN_CTX_free(ctx);
  172|    527|  DSA_free(dsa);
  173|    527|  return 0;
  174|    815|}
p_dsa_asn1.c:dsa_priv_encode:
  176|    815|static int dsa_priv_encode(CBB *out, const EVP_PKEY *key) {
  177|    815|  const DSA *dsa = key->pkey;
  178|    815|  if (dsa == NULL || dsa->priv_key == NULL) {
  ------------------
  |  Branch (178:7): [True: 0, False: 815]
  |  Branch (178:22): [True: 0, False: 815]
  ------------------
  179|      0|    OPENSSL_PUT_ERROR(EVP, EVP_R_MISSING_PARAMETERS);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  180|      0|    return 0;
  181|      0|  }
  182|       |
  183|       |  // See PKCS#11, v2.40, section 2.5.
  184|    815|  CBB pkcs8, algorithm, oid, private_key;
  185|    815|  if (!CBB_add_asn1(out, &pkcs8, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|    815|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|    815|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|    815|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (185:7): [True: 0, False: 815]
  ------------------
  186|    815|      !CBB_add_asn1_uint64(&pkcs8, 0 /* version */) ||
  ------------------
  |  Branch (186:7): [True: 0, False: 815]
  ------------------
  187|    815|      !CBB_add_asn1(&pkcs8, &algorithm, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|    815|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|    815|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|    815|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (187:7): [True: 0, False: 815]
  ------------------
  188|    815|      !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) ||
  ------------------
  |  |  219|    815|#define CBS_ASN1_OBJECT 0x6u
  ------------------
  |  Branch (188:7): [True: 0, False: 815]
  ------------------
  189|    815|      !CBB_add_bytes(&oid, dsa_asn1_meth.oid, dsa_asn1_meth.oid_len) ||
  ------------------
  |  Branch (189:7): [True: 0, False: 815]
  ------------------
  190|    815|      !DSA_marshal_parameters(&algorithm, dsa) ||
  ------------------
  |  Branch (190:7): [True: 0, False: 815]
  ------------------
  191|    815|      !CBB_add_asn1(&pkcs8, &private_key, CBS_ASN1_OCTETSTRING) ||
  ------------------
  |  |  217|    815|#define CBS_ASN1_OCTETSTRING 0x4u
  ------------------
  |  Branch (191:7): [True: 0, False: 815]
  ------------------
  192|    815|      !BN_marshal_asn1(&private_key, dsa->priv_key) ||
  ------------------
  |  Branch (192:7): [True: 0, False: 815]
  ------------------
  193|    815|      !CBB_flush(out)) {
  ------------------
  |  Branch (193:7): [True: 0, False: 815]
  ------------------
  194|      0|    OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  195|      0|    return 0;
  196|      0|  }
  197|       |
  198|    815|  return 1;
  199|    815|}
p_dsa_asn1.c:int_dsa_free:
  259|  1.34k|static void int_dsa_free(EVP_PKEY *pkey) {
  260|  1.34k|  DSA_free(pkey->pkey);
  261|  1.34k|  pkey->pkey = NULL;
  262|  1.34k|}

p_ec_asn1.c:eckey_priv_decode:
  136|  2.23k|static int eckey_priv_decode(EVP_PKEY *out, CBS *params, CBS *key) {
  137|       |  // See RFC 5915.
  138|  2.23k|  EC_GROUP *group = EC_KEY_parse_parameters(params);
  139|  2.23k|  if (group == NULL || CBS_len(params) != 0) {
  ------------------
  |  Branch (139:7): [True: 693, False: 1.54k]
  |  Branch (139:24): [True: 10, False: 1.53k]
  ------------------
  140|    703|    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
  ------------------
  |  |  441|    703|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  141|    703|    EC_GROUP_free(group);
  142|    703|    return 0;
  143|    703|  }
  144|       |
  145|  1.53k|  EC_KEY *ec_key = EC_KEY_parse_private_key(key, group);
  146|  1.53k|  EC_GROUP_free(group);
  147|  1.53k|  if (ec_key == NULL || CBS_len(key) != 0) {
  ------------------
  |  Branch (147:7): [True: 1.38k, False: 149]
  |  Branch (147:25): [True: 122, False: 27]
  ------------------
  148|  1.50k|    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
  ------------------
  |  |  441|  1.50k|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  149|  1.50k|    EC_KEY_free(ec_key);
  150|  1.50k|    return 0;
  151|  1.50k|  }
  152|       |
  153|     27|  EVP_PKEY_assign_EC_KEY(out, ec_key);
  154|     27|  return 1;
  155|  1.53k|}
p_ec_asn1.c:eckey_priv_encode:
  157|     27|static int eckey_priv_encode(CBB *out, const EVP_PKEY *key) {
  158|     27|  const EC_KEY *ec_key = key->pkey;
  159|       |
  160|       |  // Omit the redundant copy of the curve name. This contradicts RFC 5915 but
  161|       |  // aligns with PKCS #11. SEC 1 only says they may be omitted if known by other
  162|       |  // means. Both OpenSSL and NSS omit the redundant parameters, so we omit them
  163|       |  // as well.
  164|     27|  unsigned enc_flags = EC_KEY_get_enc_flags(ec_key) | EC_PKEY_NO_PARAMETERS;
  ------------------
  |  |  145|     27|#define EC_PKEY_NO_PARAMETERS 0x001
  ------------------
  165|       |
  166|       |  // See RFC 5915.
  167|     27|  CBB pkcs8, algorithm, oid, private_key;
  168|     27|  if (!CBB_add_asn1(out, &pkcs8, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|     27|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|     27|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|     27|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (168:7): [True: 0, False: 27]
  ------------------
  169|     27|      !CBB_add_asn1_uint64(&pkcs8, 0 /* version */) ||
  ------------------
  |  Branch (169:7): [True: 0, False: 27]
  ------------------
  170|     27|      !CBB_add_asn1(&pkcs8, &algorithm, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|     27|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|     27|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|     27|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (170:7): [True: 0, False: 27]
  ------------------
  171|     27|      !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) ||
  ------------------
  |  |  219|     27|#define CBS_ASN1_OBJECT 0x6u
  ------------------
  |  Branch (171:7): [True: 0, False: 27]
  ------------------
  172|     27|      !CBB_add_bytes(&oid, ec_asn1_meth.oid, ec_asn1_meth.oid_len) ||
  ------------------
  |  Branch (172:7): [True: 0, False: 27]
  ------------------
  173|     27|      !EC_KEY_marshal_curve_name(&algorithm, EC_KEY_get0_group(ec_key)) ||
  ------------------
  |  Branch (173:7): [True: 0, False: 27]
  ------------------
  174|     27|      !CBB_add_asn1(&pkcs8, &private_key, CBS_ASN1_OCTETSTRING) ||
  ------------------
  |  |  217|     27|#define CBS_ASN1_OCTETSTRING 0x4u
  ------------------
  |  Branch (174:7): [True: 0, False: 27]
  ------------------
  175|     27|      !EC_KEY_marshal_private_key(&private_key, ec_key, enc_flags) ||
  ------------------
  |  Branch (175:7): [True: 0, False: 27]
  ------------------
  176|     27|      !CBB_flush(out)) {
  ------------------
  |  Branch (176:7): [True: 0, False: 27]
  ------------------
  177|      0|    OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  178|      0|    return 0;
  179|      0|  }
  180|       |
  181|     27|  return 1;
  182|     27|}
p_ec_asn1.c:int_ec_free:
  264|  2.23k|static void int_ec_free(EVP_PKEY *pkey) {
  265|  2.23k|  EC_KEY_free(pkey->pkey);
  266|  2.23k|  pkey->pkey = NULL;
  267|  2.23k|}

p_ed25519_asn1.c:ed25519_priv_decode:
  154|    110|static int ed25519_priv_decode(EVP_PKEY *out, CBS *params, CBS *key) {
  155|       |  // See RFC 8410, section 7.
  156|       |
  157|       |  // Parameters must be empty. The key is a 32-byte value wrapped in an extra
  158|       |  // OCTET STRING layer.
  159|    110|  CBS inner;
  160|    110|  if (CBS_len(params) != 0 ||
  ------------------
  |  Branch (160:7): [True: 19, False: 91]
  ------------------
  161|    110|      !CBS_get_asn1(key, &inner, CBS_ASN1_OCTETSTRING) ||
  ------------------
  |  |  217|     91|#define CBS_ASN1_OCTETSTRING 0x4u
  ------------------
  |  Branch (161:7): [True: 1, False: 90]
  ------------------
  162|    110|      CBS_len(key) != 0) {
  ------------------
  |  Branch (162:7): [True: 19, False: 71]
  ------------------
  163|     39|    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
  ------------------
  |  |  441|     39|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  164|     39|    return 0;
  165|     39|  }
  166|       |
  167|     71|  return ed25519_set_priv_raw(out, CBS_data(&inner), CBS_len(&inner));
  168|    110|}
p_ed25519_asn1.c:ed25519_priv_encode:
  170|     51|static int ed25519_priv_encode(CBB *out, const EVP_PKEY *pkey) {
  171|     51|  const ED25519_KEY *key = pkey->pkey;
  172|     51|  if (!key->has_private) {
  ------------------
  |  Branch (172:7): [True: 0, False: 51]
  ------------------
  173|      0|    OPENSSL_PUT_ERROR(EVP, EVP_R_NOT_A_PRIVATE_KEY);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  174|      0|    return 0;
  175|      0|  }
  176|       |
  177|       |  // See RFC 8410, section 7.
  178|     51|  CBB pkcs8, algorithm, oid, private_key, inner;
  179|     51|  if (!CBB_add_asn1(out, &pkcs8, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|     51|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|     51|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|     51|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (179:7): [True: 0, False: 51]
  ------------------
  180|     51|      !CBB_add_asn1_uint64(&pkcs8, 0 /* version */) ||
  ------------------
  |  Branch (180:7): [True: 0, False: 51]
  ------------------
  181|     51|      !CBB_add_asn1(&pkcs8, &algorithm, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|     51|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|     51|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|     51|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (181:7): [True: 0, False: 51]
  ------------------
  182|     51|      !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) ||
  ------------------
  |  |  219|     51|#define CBS_ASN1_OBJECT 0x6u
  ------------------
  |  Branch (182:7): [True: 0, False: 51]
  ------------------
  183|     51|      !CBB_add_bytes(&oid, ed25519_asn1_meth.oid, ed25519_asn1_meth.oid_len) ||
  ------------------
  |  Branch (183:7): [True: 0, False: 51]
  ------------------
  184|     51|      !CBB_add_asn1(&pkcs8, &private_key, CBS_ASN1_OCTETSTRING) ||
  ------------------
  |  |  217|     51|#define CBS_ASN1_OCTETSTRING 0x4u
  ------------------
  |  Branch (184:7): [True: 0, False: 51]
  ------------------
  185|     51|      !CBB_add_asn1(&private_key, &inner, CBS_ASN1_OCTETSTRING) ||
  ------------------
  |  |  217|     51|#define CBS_ASN1_OCTETSTRING 0x4u
  ------------------
  |  Branch (185:7): [True: 0, False: 51]
  ------------------
  186|       |      // The PKCS#8 encoding stores only the 32-byte seed which is the first 32
  187|       |      // bytes of the private key.
  188|     51|      !CBB_add_bytes(&inner, key->key, 32) ||
  ------------------
  |  Branch (188:7): [True: 0, False: 51]
  ------------------
  189|     51|      !CBB_flush(out)) {
  ------------------
  |  Branch (189:7): [True: 0, False: 51]
  ------------------
  190|      0|    OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  191|      0|    return 0;
  192|      0|  }
  193|       |
  194|     51|  return 1;
  195|     51|}
p_ed25519_asn1.c:ed25519_set_priv_raw:
   31|     71|static int ed25519_set_priv_raw(EVP_PKEY *pkey, const uint8_t *in, size_t len) {
   32|     71|  if (len != 32) {
  ------------------
  |  Branch (32:7): [True: 20, False: 51]
  ------------------
   33|     20|    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
  ------------------
  |  |  441|     20|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   34|     20|    return 0;
   35|     20|  }
   36|       |
   37|     51|  ED25519_KEY *key = OPENSSL_malloc(sizeof(ED25519_KEY));
   38|     51|  if (key == NULL) {
  ------------------
  |  Branch (38:7): [True: 0, False: 51]
  ------------------
   39|      0|    return 0;
   40|      0|  }
   41|       |
   42|       |  // The RFC 8032 encoding stores only the 32-byte seed, so we must recover the
   43|       |  // full representation which we use from it.
   44|     51|  uint8_t pubkey_unused[32];
   45|     51|  ED25519_keypair_from_seed(pubkey_unused, key->key, in);
   46|     51|  key->has_private = 1;
   47|       |
   48|     51|  ed25519_free(pkey);
   49|     51|  pkey->pkey = key;
   50|     51|  return 1;
   51|     51|}
p_ed25519_asn1.c:ed25519_free:
   26|    161|static void ed25519_free(EVP_PKEY *pkey) {
   27|    161|  OPENSSL_free(pkey->pkey);
   28|    161|  pkey->pkey = NULL;
   29|    161|}

p_rsa_asn1.c:rsa_priv_decode:
  138|    624|static int rsa_priv_decode(EVP_PKEY *out, CBS *params, CBS *key) {
  139|       |  // Per RFC 3447, A.1, the parameters have type NULL.
  140|    624|  CBS null;
  141|    624|  if (!CBS_get_asn1(params, &null, CBS_ASN1_NULL) ||
  ------------------
  |  |  218|    624|#define CBS_ASN1_NULL 0x5u
  ------------------
  |  Branch (141:7): [True: 1, False: 623]
  ------------------
  142|    624|      CBS_len(&null) != 0 ||
  ------------------
  |  Branch (142:7): [True: 19, False: 604]
  ------------------
  143|    624|      CBS_len(params) != 0) {
  ------------------
  |  Branch (143:7): [True: 1, False: 603]
  ------------------
  144|     21|    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
  ------------------
  |  |  441|     21|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  145|     21|    return 0;
  146|     21|  }
  147|       |
  148|    603|  RSA *rsa = RSA_parse_private_key(key);
  149|    603|  if (rsa == NULL || CBS_len(key) != 0) {
  ------------------
  |  Branch (149:7): [True: 603, False: 0]
  |  Branch (149:22): [True: 0, False: 0]
  ------------------
  150|    603|    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
  ------------------
  |  |  441|    603|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  151|    603|    RSA_free(rsa);
  152|    603|    return 0;
  153|    603|  }
  154|       |
  155|      0|  EVP_PKEY_assign_RSA(out, rsa);
  156|      0|  return 1;
  157|    603|}
p_rsa_asn1.c:int_rsa_free:
  174|    624|static void int_rsa_free(EVP_PKEY *pkey) {
  175|    624|  RSA_free(pkey->pkey);
  176|    624|  pkey->pkey = NULL;
  177|    624|}

p_x25519_asn1.c:x25519_priv_decode:
  166|    144|static int x25519_priv_decode(EVP_PKEY *out, CBS *params, CBS *key) {
  167|       |  // See RFC 8410, section 7.
  168|       |
  169|       |  // Parameters must be empty. The key is a 32-byte value wrapped in an extra
  170|       |  // OCTET STRING layer.
  171|    144|  CBS inner;
  172|    144|  if (CBS_len(params) != 0 ||
  ------------------
  |  Branch (172:7): [True: 18, False: 126]
  ------------------
  173|    144|      !CBS_get_asn1(key, &inner, CBS_ASN1_OCTETSTRING) ||
  ------------------
  |  |  217|    126|#define CBS_ASN1_OCTETSTRING 0x4u
  ------------------
  |  Branch (173:7): [True: 1, False: 125]
  ------------------
  174|    144|      CBS_len(key) != 0) {
  ------------------
  |  Branch (174:7): [True: 19, False: 106]
  ------------------
  175|     38|    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
  ------------------
  |  |  441|     38|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  176|     38|    return 0;
  177|     38|  }
  178|       |
  179|    106|  return x25519_set_priv_raw(out, CBS_data(&inner), CBS_len(&inner));
  180|    144|}
p_x25519_asn1.c:x25519_priv_encode:
  182|     85|static int x25519_priv_encode(CBB *out, const EVP_PKEY *pkey) {
  183|     85|  const X25519_KEY *key = pkey->pkey;
  184|     85|  if (!key->has_private) {
  ------------------
  |  Branch (184:7): [True: 0, False: 85]
  ------------------
  185|      0|    OPENSSL_PUT_ERROR(EVP, EVP_R_NOT_A_PRIVATE_KEY);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  186|      0|    return 0;
  187|      0|  }
  188|       |
  189|       |  // See RFC 8410, section 7.
  190|     85|  CBB pkcs8, algorithm, oid, private_key, inner;
  191|     85|  if (!CBB_add_asn1(out, &pkcs8, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|     85|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|     85|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|     85|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (191:7): [True: 0, False: 85]
  ------------------
  192|     85|      !CBB_add_asn1_uint64(&pkcs8, 0 /* version */) ||
  ------------------
  |  Branch (192:7): [True: 0, False: 85]
  ------------------
  193|     85|      !CBB_add_asn1(&pkcs8, &algorithm, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|     85|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|     85|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|     85|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (193:7): [True: 0, False: 85]
  ------------------
  194|     85|      !CBB_add_asn1(&algorithm, &oid, CBS_ASN1_OBJECT) ||
  ------------------
  |  |  219|     85|#define CBS_ASN1_OBJECT 0x6u
  ------------------
  |  Branch (194:7): [True: 0, False: 85]
  ------------------
  195|     85|      !CBB_add_bytes(&oid, x25519_asn1_meth.oid, x25519_asn1_meth.oid_len) ||
  ------------------
  |  Branch (195:7): [True: 0, False: 85]
  ------------------
  196|     85|      !CBB_add_asn1(&pkcs8, &private_key, CBS_ASN1_OCTETSTRING) ||
  ------------------
  |  |  217|     85|#define CBS_ASN1_OCTETSTRING 0x4u
  ------------------
  |  Branch (196:7): [True: 0, False: 85]
  ------------------
  197|     85|      !CBB_add_asn1(&private_key, &inner, CBS_ASN1_OCTETSTRING) ||
  ------------------
  |  |  217|     85|#define CBS_ASN1_OCTETSTRING 0x4u
  ------------------
  |  Branch (197:7): [True: 0, False: 85]
  ------------------
  198|       |      // The PKCS#8 encoding stores only the 32-byte seed which is the first 32
  199|       |      // bytes of the private key.
  200|     85|      !CBB_add_bytes(&inner, key->priv, 32) ||
  ------------------
  |  Branch (200:7): [True: 0, False: 85]
  ------------------
  201|     85|      !CBB_flush(out)) {
  ------------------
  |  Branch (201:7): [True: 0, False: 85]
  ------------------
  202|      0|    OPENSSL_PUT_ERROR(EVP, EVP_R_ENCODE_ERROR);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  203|      0|    return 0;
  204|      0|  }
  205|       |
  206|     85|  return 1;
  207|     85|}
p_x25519_asn1.c:x25519_set_priv_raw:
   31|    106|static int x25519_set_priv_raw(EVP_PKEY *pkey, const uint8_t *in, size_t len) {
   32|    106|  if (len != 32) {
  ------------------
  |  Branch (32:7): [True: 21, False: 85]
  ------------------
   33|     21|    OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
  ------------------
  |  |  441|     21|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   34|     21|    return 0;
   35|     21|  }
   36|       |
   37|     85|  X25519_KEY *key = OPENSSL_malloc(sizeof(X25519_KEY));
   38|     85|  if (key == NULL) {
  ------------------
  |  Branch (38:7): [True: 0, False: 85]
  ------------------
   39|      0|    return 0;
   40|      0|  }
   41|       |
   42|     85|  OPENSSL_memcpy(key->priv, in, 32);
   43|     85|  X25519_public_from_private(key->pub, key->priv);
   44|     85|  key->has_private = 1;
   45|       |
   46|     85|  x25519_free(pkey);
   47|     85|  pkey->pkey = key;
   48|     85|  return 1;
   49|     85|}
p_x25519_asn1.c:x25519_free:
   26|    229|static void x25519_free(EVP_PKEY *pkey) {
   27|    229|  OPENSSL_free(pkey->pkey);
   28|    229|  pkey->pkey = NULL;
   29|    229|}

CRYPTO_new_ex_data:
  206|  3.11k|void CRYPTO_new_ex_data(CRYPTO_EX_DATA *ad) {
  207|  3.11k|  ad->sk = NULL;
  208|  3.11k|}
CRYPTO_free_ex_data:
  211|  3.11k|                         CRYPTO_EX_DATA *ad) {
  212|  3.11k|  if (ad->sk == NULL) {
  ------------------
  |  Branch (212:7): [True: 3.11k, False: 0]
  ------------------
  213|       |    // Nothing to do.
  214|  3.11k|    return;
  215|  3.11k|  }
  216|       |
  217|      0|  uint32_t num_funcs = CRYPTO_atomic_load_u32(&ex_data_class->num_funcs);
  218|       |  // |CRYPTO_get_ex_new_index| will not allocate indices beyond |INT_MAX|.
  219|      0|  assert(num_funcs <= (size_t)(INT_MAX - ex_data_class->num_reserved));
  220|       |
  221|       |  // Defer dereferencing |ex_data_class->funcs| and |funcs->next|. It must come
  222|       |  // after the |num_funcs| comparison to be correctly synchronized.
  223|      0|  CRYPTO_EX_DATA_FUNCS *const *funcs = &ex_data_class->funcs;
  224|      0|  for (uint32_t i = 0; i < num_funcs; i++) {
  ------------------
  |  Branch (224:24): [True: 0, False: 0]
  ------------------
  225|      0|    if ((*funcs)->free_func != NULL) {
  ------------------
  |  Branch (225:9): [True: 0, False: 0]
  ------------------
  226|      0|      int index = (int)i + ex_data_class->num_reserved;
  227|      0|      void *ptr = CRYPTO_get_ex_data(ad, index);
  228|      0|      (*funcs)->free_func(obj, ptr, ad, index, (*funcs)->argl, (*funcs)->argp);
  229|      0|    }
  230|      0|    funcs = &(*funcs)->next;
  231|      0|  }
  232|       |
  233|      0|  sk_void_free(ad->sk);
  234|      0|  ad->sk = NULL;
  235|      0|}

BN_add_word:
  138|    415|int BN_add_word(BIGNUM *a, BN_ULONG w) {
  139|    415|  BN_ULONG l;
  140|    415|  int i;
  141|       |
  142|       |  // degenerate case: w is zero
  143|    415|  if (!w) {
  ------------------
  |  Branch (143:7): [True: 0, False: 415]
  ------------------
  144|      0|    return 1;
  145|      0|  }
  146|       |
  147|       |  // degenerate case: a is zero
  148|    415|  if (BN_is_zero(a)) {
  ------------------
  |  Branch (148:7): [True: 0, False: 415]
  ------------------
  149|      0|    return BN_set_word(a, w);
  150|      0|  }
  151|       |
  152|       |  // handle 'a' when negative
  153|    415|  if (a->neg) {
  ------------------
  |  Branch (153:7): [True: 0, False: 415]
  ------------------
  154|      0|    a->neg = 0;
  155|      0|    i = BN_sub_word(a, w);
  156|      0|    if (!BN_is_zero(a)) {
  ------------------
  |  Branch (156:9): [True: 0, False: 0]
  ------------------
  157|      0|      a->neg = !(a->neg);
  158|      0|    }
  159|      0|    return i;
  160|      0|  }
  161|       |
  162|  1.33k|  for (i = 0; w != 0 && i < a->width; i++) {
  ------------------
  |  Branch (162:15): [True: 919, False: 415]
  |  Branch (162:25): [True: 919, False: 0]
  ------------------
  163|    919|    a->d[i] = l = a->d[i] + w;
  164|    919|    w = (w > l) ? 1 : 0;
  ------------------
  |  Branch (164:9): [True: 504, False: 415]
  ------------------
  165|    919|  }
  166|       |
  167|    415|  if (w && i == a->width) {
  ------------------
  |  Branch (167:7): [True: 0, False: 415]
  |  Branch (167:12): [True: 0, False: 0]
  ------------------
  168|      0|    if (!bn_wexpand(a, a->width + 1)) {
  ------------------
  |  Branch (168:9): [True: 0, False: 0]
  ------------------
  169|      0|      return 0;
  170|      0|    }
  171|      0|    a->width++;
  172|      0|    a->d[i] = w;
  173|      0|  }
  174|       |
  175|    415|  return 1;
  176|    415|}
BN_sub:
  178|      4|int BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) {
  179|      4|  int add = 0, neg = 0;
  180|      4|  const BIGNUM *tmp;
  181|       |
  182|       |  //  a -  b	a-b
  183|       |  //  a - -b	a+b
  184|       |  // -a -  b	-(a+b)
  185|       |  // -a - -b	b-a
  186|      4|  if (a->neg) {
  ------------------
  |  Branch (186:7): [True: 0, False: 4]
  ------------------
  187|      0|    if (b->neg) {
  ------------------
  |  Branch (187:9): [True: 0, False: 0]
  ------------------
  188|      0|      tmp = a;
  189|      0|      a = b;
  190|      0|      b = tmp;
  191|      0|    } else {
  192|      0|      add = 1;
  193|      0|      neg = 1;
  194|      0|    }
  195|      4|  } else {
  196|      4|    if (b->neg) {
  ------------------
  |  Branch (196:9): [True: 0, False: 4]
  ------------------
  197|      0|      add = 1;
  198|      0|      neg = 0;
  199|      0|    }
  200|      4|  }
  201|       |
  202|      4|  if (add) {
  ------------------
  |  Branch (202:7): [True: 0, False: 4]
  ------------------
  203|      0|    if (!BN_uadd(r, a, b)) {
  ------------------
  |  Branch (203:9): [True: 0, False: 0]
  ------------------
  204|      0|      return 0;
  205|      0|    }
  206|       |
  207|      0|    r->neg = neg;
  208|      0|    return 1;
  209|      0|  }
  210|       |
  211|      4|  if (BN_ucmp(a, b) < 0) {
  ------------------
  |  Branch (211:7): [True: 0, False: 4]
  ------------------
  212|      0|    if (!BN_usub(r, b, a)) {
  ------------------
  |  Branch (212:9): [True: 0, False: 0]
  ------------------
  213|      0|      return 0;
  214|      0|    }
  215|      0|    r->neg = 1;
  216|      4|  } else {
  217|      4|    if (!BN_usub(r, a, b)) {
  ------------------
  |  Branch (217:9): [True: 0, False: 4]
  ------------------
  218|      0|      return 0;
  219|      0|    }
  220|      4|    r->neg = 0;
  221|      4|  }
  222|       |
  223|      4|  return 1;
  224|      4|}
bn_usub_consttime:
  226|    303|int bn_usub_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) {
  227|       |  // |b| may have more words than |a| given non-minimal inputs, but all words
  228|       |  // beyond |a->width| must then be zero.
  229|    303|  int b_width = b->width;
  230|    303|  if (b_width > a->width) {
  ------------------
  |  Branch (230:7): [True: 0, False: 303]
  ------------------
  231|      0|    if (!bn_fits_in_words(b, a->width)) {
  ------------------
  |  Branch (231:9): [True: 0, False: 0]
  ------------------
  232|      0|      OPENSSL_PUT_ERROR(BN, BN_R_ARG2_LT_ARG3);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  233|      0|      return 0;
  234|      0|    }
  235|      0|    b_width = a->width;
  236|      0|  }
  237|       |
  238|    303|  if (!bn_wexpand(r, a->width)) {
  ------------------
  |  Branch (238:7): [True: 0, False: 303]
  ------------------
  239|      0|    return 0;
  240|      0|  }
  241|       |
  242|    303|  BN_ULONG borrow = bn_sub_words(r->d, a->d, b->d, b_width);
  243|    303|  for (int i = b_width; i < a->width; i++) {
  ------------------
  |  Branch (243:25): [True: 0, False: 303]
  ------------------
  244|       |    // |r| and |a| may alias, so use a temporary.
  245|      0|    BN_ULONG tmp = a->d[i];
  246|      0|    r->d[i] = a->d[i] - borrow;
  247|      0|    borrow = tmp < r->d[i];
  248|      0|  }
  249|       |
  250|    303|  if (borrow) {
  ------------------
  |  Branch (250:7): [True: 0, False: 303]
  ------------------
  251|      0|    OPENSSL_PUT_ERROR(BN, BN_R_ARG2_LT_ARG3);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  252|      0|    return 0;
  253|      0|  }
  254|       |
  255|    303|  r->width = a->width;
  256|    303|  r->neg = 0;
  257|    303|  return 1;
  258|    303|}
BN_usub:
  260|    303|int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) {
  261|    303|  if (!bn_usub_consttime(r, a, b)) {
  ------------------
  |  Branch (261:7): [True: 0, False: 303]
  ------------------
  262|      0|    return 0;
  263|      0|  }
  264|    303|  bn_set_minimal_width(r);
  265|    303|  return 1;
  266|    303|}

bn_mul_add_words:
   98|   119k|                          BN_ULONG w) {
   99|   119k|  BN_ULONG c1 = 0;
  100|       |
  101|   119k|  if (num == 0) {
  ------------------
  |  Branch (101:7): [True: 0, False: 119k]
  ------------------
  102|      0|    return (c1);
  103|      0|  }
  104|       |
  105|   980k|  while (num & ~3) {
  ------------------
  |  Branch (105:10): [True: 860k, False: 119k]
  ------------------
  106|   860k|    mul_add(rp[0], ap[0], w, c1);
  ------------------
  |  |   69|   860k|  do {                                                                     \
  |  |   70|   860k|    register BN_ULONG high, low;                                           \
  |  |   71|   860k|    __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \
  |  |   72|   860k|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   73|   860k|            : "+r"(carry), "+d"(high)                                      \
  |  |   74|   860k|            : "a"(low), "g"(0)                                             \
  |  |   75|   860k|            : "cc");                                                       \
  |  |   76|   860k|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   77|   860k|            : "+m"(r), "+d"(high)                                          \
  |  |   78|   860k|            : "r"(carry), "g"(0)                                           \
  |  |   79|   860k|            : "cc");                                                       \
  |  |   80|   860k|    (carry) = high;                                                        \
  |  |   81|   860k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (81:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  107|   860k|    mul_add(rp[1], ap[1], w, c1);
  ------------------
  |  |   69|   860k|  do {                                                                     \
  |  |   70|   860k|    register BN_ULONG high, low;                                           \
  |  |   71|   860k|    __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \
  |  |   72|   860k|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   73|   860k|            : "+r"(carry), "+d"(high)                                      \
  |  |   74|   860k|            : "a"(low), "g"(0)                                             \
  |  |   75|   860k|            : "cc");                                                       \
  |  |   76|   860k|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   77|   860k|            : "+m"(r), "+d"(high)                                          \
  |  |   78|   860k|            : "r"(carry), "g"(0)                                           \
  |  |   79|   860k|            : "cc");                                                       \
  |  |   80|   860k|    (carry) = high;                                                        \
  |  |   81|   860k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (81:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  108|   860k|    mul_add(rp[2], ap[2], w, c1);
  ------------------
  |  |   69|   860k|  do {                                                                     \
  |  |   70|   860k|    register BN_ULONG high, low;                                           \
  |  |   71|   860k|    __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \
  |  |   72|   860k|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   73|   860k|            : "+r"(carry), "+d"(high)                                      \
  |  |   74|   860k|            : "a"(low), "g"(0)                                             \
  |  |   75|   860k|            : "cc");                                                       \
  |  |   76|   860k|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   77|   860k|            : "+m"(r), "+d"(high)                                          \
  |  |   78|   860k|            : "r"(carry), "g"(0)                                           \
  |  |   79|   860k|            : "cc");                                                       \
  |  |   80|   860k|    (carry) = high;                                                        \
  |  |   81|   860k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (81:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  109|   860k|    mul_add(rp[3], ap[3], w, c1);
  ------------------
  |  |   69|   860k|  do {                                                                     \
  |  |   70|   860k|    register BN_ULONG high, low;                                           \
  |  |   71|   860k|    __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \
  |  |   72|   860k|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   73|   860k|            : "+r"(carry), "+d"(high)                                      \
  |  |   74|   860k|            : "a"(low), "g"(0)                                             \
  |  |   75|   860k|            : "cc");                                                       \
  |  |   76|   860k|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   77|   860k|            : "+m"(r), "+d"(high)                                          \
  |  |   78|   860k|            : "r"(carry), "g"(0)                                           \
  |  |   79|   860k|            : "cc");                                                       \
  |  |   80|   860k|    (carry) = high;                                                        \
  |  |   81|   860k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (81:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  110|   860k|    ap += 4;
  111|   860k|    rp += 4;
  112|   860k|    num -= 4;
  113|   860k|  }
  114|   119k|  if (num) {
  ------------------
  |  Branch (114:7): [True: 38.8k, False: 80.9k]
  ------------------
  115|  38.8k|    mul_add(rp[0], ap[0], w, c1);
  ------------------
  |  |   69|  38.8k|  do {                                                                     \
  |  |   70|  38.8k|    register BN_ULONG high, low;                                           \
  |  |   71|  38.8k|    __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \
  |  |   72|  38.8k|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   73|  38.8k|            : "+r"(carry), "+d"(high)                                      \
  |  |   74|  38.8k|            : "a"(low), "g"(0)                                             \
  |  |   75|  38.8k|            : "cc");                                                       \
  |  |   76|  38.8k|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   77|  38.8k|            : "+m"(r), "+d"(high)                                          \
  |  |   78|  38.8k|            : "r"(carry), "g"(0)                                           \
  |  |   79|  38.8k|            : "cc");                                                       \
  |  |   80|  38.8k|    (carry) = high;                                                        \
  |  |   81|  38.8k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (81:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  116|  38.8k|    if (--num == 0) {
  ------------------
  |  Branch (116:9): [True: 22.2k, False: 16.6k]
  ------------------
  117|  22.2k|      return c1;
  118|  22.2k|    }
  119|  16.6k|    mul_add(rp[1], ap[1], w, c1);
  ------------------
  |  |   69|  16.6k|  do {                                                                     \
  |  |   70|  16.6k|    register BN_ULONG high, low;                                           \
  |  |   71|  16.6k|    __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \
  |  |   72|  16.6k|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   73|  16.6k|            : "+r"(carry), "+d"(high)                                      \
  |  |   74|  16.6k|            : "a"(low), "g"(0)                                             \
  |  |   75|  16.6k|            : "cc");                                                       \
  |  |   76|  16.6k|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   77|  16.6k|            : "+m"(r), "+d"(high)                                          \
  |  |   78|  16.6k|            : "r"(carry), "g"(0)                                           \
  |  |   79|  16.6k|            : "cc");                                                       \
  |  |   80|  16.6k|    (carry) = high;                                                        \
  |  |   81|  16.6k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (81:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  120|  16.6k|    if (--num == 0) {
  ------------------
  |  Branch (120:9): [True: 7.04k, False: 9.61k]
  ------------------
  121|  7.04k|      return c1;
  122|  7.04k|    }
  123|  9.61k|    mul_add(rp[2], ap[2], w, c1);
  ------------------
  |  |   69|  9.61k|  do {                                                                     \
  |  |   70|  9.61k|    register BN_ULONG high, low;                                           \
  |  |   71|  9.61k|    __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "m"(a) : "cc"); \
  |  |   72|  9.61k|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   73|  9.61k|            : "+r"(carry), "+d"(high)                                      \
  |  |   74|  9.61k|            : "a"(low), "g"(0)                                             \
  |  |   75|  9.61k|            : "cc");                                                       \
  |  |   76|  9.61k|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   77|  9.61k|            : "+m"(r), "+d"(high)                                          \
  |  |   78|  9.61k|            : "r"(carry), "g"(0)                                           \
  |  |   79|  9.61k|            : "cc");                                                       \
  |  |   80|  9.61k|    (carry) = high;                                                        \
  |  |   81|  9.61k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (81:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  124|  9.61k|    return c1;
  125|  16.6k|  }
  126|       |
  127|  80.9k|  return c1;
  128|   119k|}
bn_mul_words:
  131|  2.74M|                      BN_ULONG w) {
  132|  2.74M|  BN_ULONG c1 = 0;
  133|       |
  134|  2.74M|  if (num == 0) {
  ------------------
  |  Branch (134:7): [True: 0, False: 2.74M]
  ------------------
  135|      0|    return c1;
  136|      0|  }
  137|       |
  138|  5.47M|  while (num & ~3) {
  ------------------
  |  Branch (138:10): [True: 2.73M, False: 2.74M]
  ------------------
  139|  2.73M|    mul(rp[0], ap[0], w, c1);
  ------------------
  |  |   84|  2.73M|  do {                                                                     \
  |  |   85|  2.73M|    register BN_ULONG high, low;                                           \
  |  |   86|  2.73M|    __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \
  |  |   87|  2.73M|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   88|  2.73M|            : "+r"(carry), "+d"(high)                                      \
  |  |   89|  2.73M|            : "a"(low), "g"(0)                                             \
  |  |   90|  2.73M|            : "cc");                                                       \
  |  |   91|  2.73M|    (r) = (carry);                                                         \
  |  |   92|  2.73M|    (carry) = high;                                                        \
  |  |   93|  2.73M|  } while (0)
  |  |  ------------------
  |  |  |  Branch (93:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  140|  2.73M|    mul(rp[1], ap[1], w, c1);
  ------------------
  |  |   84|  2.73M|  do {                                                                     \
  |  |   85|  2.73M|    register BN_ULONG high, low;                                           \
  |  |   86|  2.73M|    __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \
  |  |   87|  2.73M|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   88|  2.73M|            : "+r"(carry), "+d"(high)                                      \
  |  |   89|  2.73M|            : "a"(low), "g"(0)                                             \
  |  |   90|  2.73M|            : "cc");                                                       \
  |  |   91|  2.73M|    (r) = (carry);                                                         \
  |  |   92|  2.73M|    (carry) = high;                                                        \
  |  |   93|  2.73M|  } while (0)
  |  |  ------------------
  |  |  |  Branch (93:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  141|  2.73M|    mul(rp[2], ap[2], w, c1);
  ------------------
  |  |   84|  2.73M|  do {                                                                     \
  |  |   85|  2.73M|    register BN_ULONG high, low;                                           \
  |  |   86|  2.73M|    __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \
  |  |   87|  2.73M|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   88|  2.73M|            : "+r"(carry), "+d"(high)                                      \
  |  |   89|  2.73M|            : "a"(low), "g"(0)                                             \
  |  |   90|  2.73M|            : "cc");                                                       \
  |  |   91|  2.73M|    (r) = (carry);                                                         \
  |  |   92|  2.73M|    (carry) = high;                                                        \
  |  |   93|  2.73M|  } while (0)
  |  |  ------------------
  |  |  |  Branch (93:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  142|  2.73M|    mul(rp[3], ap[3], w, c1);
  ------------------
  |  |   84|  2.73M|  do {                                                                     \
  |  |   85|  2.73M|    register BN_ULONG high, low;                                           \
  |  |   86|  2.73M|    __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \
  |  |   87|  2.73M|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   88|  2.73M|            : "+r"(carry), "+d"(high)                                      \
  |  |   89|  2.73M|            : "a"(low), "g"(0)                                             \
  |  |   90|  2.73M|            : "cc");                                                       \
  |  |   91|  2.73M|    (r) = (carry);                                                         \
  |  |   92|  2.73M|    (carry) = high;                                                        \
  |  |   93|  2.73M|  } while (0)
  |  |  ------------------
  |  |  |  Branch (93:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  143|  2.73M|    ap += 4;
  144|  2.73M|    rp += 4;
  145|  2.73M|    num -= 4;
  146|  2.73M|  }
  147|  2.74M|  if (num) {
  ------------------
  |  Branch (147:7): [True: 25.0k, False: 2.72M]
  ------------------
  148|  25.0k|    mul(rp[0], ap[0], w, c1);
  ------------------
  |  |   84|  25.0k|  do {                                                                     \
  |  |   85|  25.0k|    register BN_ULONG high, low;                                           \
  |  |   86|  25.0k|    __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \
  |  |   87|  25.0k|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   88|  25.0k|            : "+r"(carry), "+d"(high)                                      \
  |  |   89|  25.0k|            : "a"(low), "g"(0)                                             \
  |  |   90|  25.0k|            : "cc");                                                       \
  |  |   91|  25.0k|    (r) = (carry);                                                         \
  |  |   92|  25.0k|    (carry) = high;                                                        \
  |  |   93|  25.0k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (93:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  149|  25.0k|    if (--num == 0) {
  ------------------
  |  Branch (149:9): [True: 22.9k, False: 2.13k]
  ------------------
  150|  22.9k|      return c1;
  151|  22.9k|    }
  152|  2.13k|    mul(rp[1], ap[1], w, c1);
  ------------------
  |  |   84|  2.13k|  do {                                                                     \
  |  |   85|  2.13k|    register BN_ULONG high, low;                                           \
  |  |   86|  2.13k|    __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \
  |  |   87|  2.13k|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   88|  2.13k|            : "+r"(carry), "+d"(high)                                      \
  |  |   89|  2.13k|            : "a"(low), "g"(0)                                             \
  |  |   90|  2.13k|            : "cc");                                                       \
  |  |   91|  2.13k|    (r) = (carry);                                                         \
  |  |   92|  2.13k|    (carry) = high;                                                        \
  |  |   93|  2.13k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (93:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  153|  2.13k|    if (--num == 0) {
  ------------------
  |  Branch (153:9): [True: 117, False: 2.01k]
  ------------------
  154|    117|      return c1;
  155|    117|    }
  156|  2.01k|    mul(rp[2], ap[2], w, c1);
  ------------------
  |  |   84|  2.01k|  do {                                                                     \
  |  |   85|  2.01k|    register BN_ULONG high, low;                                           \
  |  |   86|  2.01k|    __asm__("mulq %3" : "=a"(low), "=d"(high) : "a"(word), "g"(a) : "cc"); \
  |  |   87|  2.01k|    __asm__("addq %2,%0; adcq %3,%1"                                       \
  |  |   88|  2.01k|            : "+r"(carry), "+d"(high)                                      \
  |  |   89|  2.01k|            : "a"(low), "g"(0)                                             \
  |  |   90|  2.01k|            : "cc");                                                       \
  |  |   91|  2.01k|    (r) = (carry);                                                         \
  |  |   92|  2.01k|    (carry) = high;                                                        \
  |  |   93|  2.01k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (93:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  157|  2.01k|  }
  158|  2.72M|  return c1;
  159|  2.74M|}
bn_sqr_words:
  161|    201|void bn_sqr_words(BN_ULONG *r, const BN_ULONG *a, size_t n) {
  162|    201|  if (n == 0) {
  ------------------
  |  Branch (162:7): [True: 0, False: 201]
  ------------------
  163|      0|    return;
  164|      0|  }
  165|       |
  166|    449|  while (n & ~3) {
  ------------------
  |  Branch (166:10): [True: 248, False: 201]
  ------------------
  167|    248|    sqr(r[0], r[1], a[0]);
  ------------------
  |  |   95|    248|#define sqr(r0, r1, a) __asm__("mulq %2" : "=a"(r0), "=d"(r1) : "a"(a) : "cc");
  ------------------
  168|    248|    sqr(r[2], r[3], a[1]);
  ------------------
  |  |   95|    248|#define sqr(r0, r1, a) __asm__("mulq %2" : "=a"(r0), "=d"(r1) : "a"(a) : "cc");
  ------------------
  169|    248|    sqr(r[4], r[5], a[2]);
  ------------------
  |  |   95|    248|#define sqr(r0, r1, a) __asm__("mulq %2" : "=a"(r0), "=d"(r1) : "a"(a) : "cc");
  ------------------
  170|    248|    sqr(r[6], r[7], a[3]);
  ------------------
  |  |   95|    248|#define sqr(r0, r1, a) __asm__("mulq %2" : "=a"(r0), "=d"(r1) : "a"(a) : "cc");
  ------------------
  171|    248|    a += 4;
  172|    248|    r += 8;
  173|    248|    n -= 4;
  174|    248|  }
  175|    201|  if (n) {
  ------------------
  |  Branch (175:7): [True: 201, False: 0]
  ------------------
  176|    201|    sqr(r[0], r[1], a[0]);
  ------------------
  |  |   95|    201|#define sqr(r0, r1, a) __asm__("mulq %2" : "=a"(r0), "=d"(r1) : "a"(a) : "cc");
  ------------------
  177|    201|    if (--n == 0) {
  ------------------
  |  Branch (177:9): [True: 48, False: 153]
  ------------------
  178|     48|      return;
  179|     48|    }
  180|    153|    sqr(r[2], r[3], a[1]);
  ------------------
  |  |   95|    153|#define sqr(r0, r1, a) __asm__("mulq %2" : "=a"(r0), "=d"(r1) : "a"(a) : "cc");
  ------------------
  181|    153|    if (--n == 0) {
  ------------------
  |  Branch (181:9): [True: 152, False: 1]
  ------------------
  182|    152|      return;
  183|    152|    }
  184|      1|    sqr(r[4], r[5], a[2]);
  ------------------
  |  |   95|      1|#define sqr(r0, r1, a) __asm__("mulq %2" : "=a"(r0), "=d"(r1) : "a"(a) : "cc");
  ------------------
  185|      1|  }
  186|    201|}
bn_add_words:
  189|  3.81M|                      size_t n) {
  190|  3.81M|  BN_ULONG ret;
  191|  3.81M|  size_t i = 0;
  192|       |
  193|  3.81M|  if (n == 0) {
  ------------------
  |  Branch (193:7): [True: 0, False: 3.81M]
  ------------------
  194|      0|    return 0;
  195|      0|  }
  196|       |
  197|  3.81M|  __asm__ volatile (
  198|  3.81M|      "	subq	%0,%0		\n"  // clear carry
  199|  3.81M|      "	jmp	1f		\n"
  200|  3.81M|      ".p2align 4			\n"
  201|  3.81M|      "1:"
  202|  3.81M|      "	movq	(%4,%2,8),%0	\n"
  203|  3.81M|      "	adcq	(%5,%2,8),%0	\n"
  204|  3.81M|      "	movq	%0,(%3,%2,8)	\n"
  205|  3.81M|      "	lea	1(%2),%2	\n"
  206|  3.81M|      "	dec	%1		\n"
  207|  3.81M|      "	jnz	1b		\n"
  208|  3.81M|      "	sbbq	%0,%0		\n"
  209|  3.81M|      : "=&r"(ret), "+c"(n), "+r"(i)
  210|  3.81M|      : "r"(rp), "r"(ap), "r"(bp)
  211|  3.81M|      : "cc", "memory");
  212|       |
  213|  3.81M|  return ret & 1;
  214|  3.81M|}
bn_sub_words:
  217|  6.54M|                      size_t n) {
  218|  6.54M|  BN_ULONG ret;
  219|  6.54M|  size_t i = 0;
  220|       |
  221|  6.54M|  if (n == 0) {
  ------------------
  |  Branch (221:7): [True: 458, False: 6.54M]
  ------------------
  222|    458|    return 0;
  223|    458|  }
  224|       |
  225|  6.54M|  __asm__ volatile (
  226|  6.54M|      "	subq	%0,%0		\n"  // clear borrow
  227|  6.54M|      "	jmp	1f		\n"
  228|  6.54M|      ".p2align 4			\n"
  229|  6.54M|      "1:"
  230|  6.54M|      "	movq	(%4,%2,8),%0	\n"
  231|  6.54M|      "	sbbq	(%5,%2,8),%0	\n"
  232|  6.54M|      "	movq	%0,(%3,%2,8)	\n"
  233|  6.54M|      "	lea	1(%2),%2	\n"
  234|  6.54M|      "	dec	%1		\n"
  235|  6.54M|      "	jnz	1b		\n"
  236|  6.54M|      "	sbbq	%0,%0		\n"
  237|  6.54M|      : "=&r"(ret), "+c"(n), "+r"(i)
  238|  6.54M|      : "r"(rp), "r"(ap), "r"(bp)
  239|  6.54M|      : "cc", "memory");
  240|       |
  241|  6.54M|  return ret & 1;
  242|  6.54M|}
bn_mul_comba8:
  287|  6.86k|void bn_mul_comba8(BN_ULONG r[16], const BN_ULONG a[8], const BN_ULONG b[8]) {
  288|  6.86k|  BN_ULONG c1, c2, c3;
  289|       |
  290|  6.86k|  c1 = 0;
  291|  6.86k|  c2 = 0;
  292|  6.86k|  c3 = 0;
  293|  6.86k|  mul_add_c(a[0], b[0], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  294|  6.86k|  r[0] = c1;
  295|  6.86k|  c1 = 0;
  296|  6.86k|  mul_add_c(a[0], b[1], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  297|  6.86k|  mul_add_c(a[1], b[0], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  298|  6.86k|  r[1] = c2;
  299|  6.86k|  c2 = 0;
  300|  6.86k|  mul_add_c(a[2], b[0], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  301|  6.86k|  mul_add_c(a[1], b[1], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  302|  6.86k|  mul_add_c(a[0], b[2], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  303|  6.86k|  r[2] = c3;
  304|  6.86k|  c3 = 0;
  305|  6.86k|  mul_add_c(a[0], b[3], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  306|  6.86k|  mul_add_c(a[1], b[2], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  307|  6.86k|  mul_add_c(a[2], b[1], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  308|  6.86k|  mul_add_c(a[3], b[0], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  309|  6.86k|  r[3] = c1;
  310|  6.86k|  c1 = 0;
  311|  6.86k|  mul_add_c(a[4], b[0], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  312|  6.86k|  mul_add_c(a[3], b[1], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  313|  6.86k|  mul_add_c(a[2], b[2], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  314|  6.86k|  mul_add_c(a[1], b[3], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  315|  6.86k|  mul_add_c(a[0], b[4], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  316|  6.86k|  r[4] = c2;
  317|  6.86k|  c2 = 0;
  318|  6.86k|  mul_add_c(a[0], b[5], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  319|  6.86k|  mul_add_c(a[1], b[4], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  320|  6.86k|  mul_add_c(a[2], b[3], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  321|  6.86k|  mul_add_c(a[3], b[2], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  322|  6.86k|  mul_add_c(a[4], b[1], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  323|  6.86k|  mul_add_c(a[5], b[0], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  324|  6.86k|  r[5] = c3;
  325|  6.86k|  c3 = 0;
  326|  6.86k|  mul_add_c(a[6], b[0], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  327|  6.86k|  mul_add_c(a[5], b[1], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  328|  6.86k|  mul_add_c(a[4], b[2], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  329|  6.86k|  mul_add_c(a[3], b[3], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  330|  6.86k|  mul_add_c(a[2], b[4], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  331|  6.86k|  mul_add_c(a[1], b[5], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  332|  6.86k|  mul_add_c(a[0], b[6], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  333|  6.86k|  r[6] = c1;
  334|  6.86k|  c1 = 0;
  335|  6.86k|  mul_add_c(a[0], b[7], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  336|  6.86k|  mul_add_c(a[1], b[6], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  337|  6.86k|  mul_add_c(a[2], b[5], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  338|  6.86k|  mul_add_c(a[3], b[4], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  339|  6.86k|  mul_add_c(a[4], b[3], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  340|  6.86k|  mul_add_c(a[5], b[2], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  341|  6.86k|  mul_add_c(a[6], b[1], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  342|  6.86k|  mul_add_c(a[7], b[0], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  343|  6.86k|  r[7] = c2;
  344|  6.86k|  c2 = 0;
  345|  6.86k|  mul_add_c(a[7], b[1], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  346|  6.86k|  mul_add_c(a[6], b[2], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  347|  6.86k|  mul_add_c(a[5], b[3], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  348|  6.86k|  mul_add_c(a[4], b[4], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  349|  6.86k|  mul_add_c(a[3], b[5], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  350|  6.86k|  mul_add_c(a[2], b[6], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  351|  6.86k|  mul_add_c(a[1], b[7], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  352|  6.86k|  r[8] = c3;
  353|  6.86k|  c3 = 0;
  354|  6.86k|  mul_add_c(a[2], b[7], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  355|  6.86k|  mul_add_c(a[3], b[6], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  356|  6.86k|  mul_add_c(a[4], b[5], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  357|  6.86k|  mul_add_c(a[5], b[4], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  358|  6.86k|  mul_add_c(a[6], b[3], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  359|  6.86k|  mul_add_c(a[7], b[2], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  360|  6.86k|  r[9] = c1;
  361|  6.86k|  c1 = 0;
  362|  6.86k|  mul_add_c(a[7], b[3], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  363|  6.86k|  mul_add_c(a[6], b[4], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  364|  6.86k|  mul_add_c(a[5], b[5], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  365|  6.86k|  mul_add_c(a[4], b[6], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  366|  6.86k|  mul_add_c(a[3], b[7], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  367|  6.86k|  r[10] = c2;
  368|  6.86k|  c2 = 0;
  369|  6.86k|  mul_add_c(a[4], b[7], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  370|  6.86k|  mul_add_c(a[5], b[6], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  371|  6.86k|  mul_add_c(a[6], b[5], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  372|  6.86k|  mul_add_c(a[7], b[4], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  373|  6.86k|  r[11] = c3;
  374|  6.86k|  c3 = 0;
  375|  6.86k|  mul_add_c(a[7], b[5], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  376|  6.86k|  mul_add_c(a[6], b[6], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  377|  6.86k|  mul_add_c(a[5], b[7], c1, c2, c3);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  378|  6.86k|  r[12] = c1;
  379|  6.86k|  c1 = 0;
  380|  6.86k|  mul_add_c(a[6], b[7], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  381|  6.86k|  mul_add_c(a[7], b[6], c2, c3, c1);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  382|  6.86k|  r[13] = c2;
  383|  6.86k|  c2 = 0;
  384|  6.86k|  mul_add_c(a[7], b[7], c3, c1, c2);
  ------------------
  |  |  252|  6.86k|  do {                                                               \
  |  |  253|  6.86k|    BN_ULONG t1, t2;                                                 \
  |  |  254|  6.86k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  255|  6.86k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  256|  6.86k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  257|  6.86k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  258|  6.86k|            : "cc");                                                 \
  |  |  259|  6.86k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (259:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  385|  6.86k|  r[14] = c3;
  386|  6.86k|  r[15] = c1;
  387|  6.86k|}
bn_sqr_comba4:
  501|   519k|void bn_sqr_comba4(BN_ULONG r[8], const BN_ULONG a[4]) {
  502|   519k|  BN_ULONG c1, c2, c3;
  503|       |
  504|   519k|  c1 = 0;
  505|   519k|  c2 = 0;
  506|   519k|  c3 = 0;
  507|   519k|  sqr_add_c(a, 0, c1, c2, c3);
  ------------------
  |  |  262|   519k|  do {                                                            \
  |  |  263|   519k|    BN_ULONG t1, t2;                                              \
  |  |  264|   519k|    __asm__("mulq %2" : "=a"(t1), "=d"(t2) : "a"((a)[i]) : "cc"); \
  |  |  265|   519k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                  \
  |  |  266|   519k|            : "+r"(c0), "+r"(c1), "+r"(c2)                        \
  |  |  267|   519k|            : "r"(t1), "r"(t2), "g"(0)                            \
  |  |  268|   519k|            : "cc");                                              \
  |  |  269|   519k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (269:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  508|   519k|  r[0] = c1;
  509|   519k|  c1 = 0;
  510|   519k|  sqr_add_c2(a, 1, 0, c2, c3, c1);
  ------------------
  |  |  285|   519k|#define sqr_add_c2(a, i, j, c0, c1, c2) mul_add_c2((a)[i], (a)[j], c0, c1, c2)
  |  |  ------------------
  |  |  |  |  272|   519k|  do {                                                               \
  |  |  |  |  273|   519k|    BN_ULONG t1, t2;                                                 \
  |  |  |  |  274|   519k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  |  |  275|   519k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  |  |  276|   519k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  |  |  277|   519k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  |  |  278|   519k|            : "cc");                                                 \
  |  |  |  |  279|   519k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  |  |  280|   519k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  |  |  281|   519k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  |  |  282|   519k|            : "cc");                                                 \
  |  |  |  |  283|   519k|  } while (0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (283:12): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  511|   519k|  r[1] = c2;
  512|   519k|  c2 = 0;
  513|   519k|  sqr_add_c(a, 1, c3, c1, c2);
  ------------------
  |  |  262|   519k|  do {                                                            \
  |  |  263|   519k|    BN_ULONG t1, t2;                                              \
  |  |  264|   519k|    __asm__("mulq %2" : "=a"(t1), "=d"(t2) : "a"((a)[i]) : "cc"); \
  |  |  265|   519k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                  \
  |  |  266|   519k|            : "+r"(c0), "+r"(c1), "+r"(c2)                        \
  |  |  267|   519k|            : "r"(t1), "r"(t2), "g"(0)                            \
  |  |  268|   519k|            : "cc");                                              \
  |  |  269|   519k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (269:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  514|   519k|  sqr_add_c2(a, 2, 0, c3, c1, c2);
  ------------------
  |  |  285|   519k|#define sqr_add_c2(a, i, j, c0, c1, c2) mul_add_c2((a)[i], (a)[j], c0, c1, c2)
  |  |  ------------------
  |  |  |  |  272|   519k|  do {                                                               \
  |  |  |  |  273|   519k|    BN_ULONG t1, t2;                                                 \
  |  |  |  |  274|   519k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  |  |  275|   519k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  |  |  276|   519k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  |  |  277|   519k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  |  |  278|   519k|            : "cc");                                                 \
  |  |  |  |  279|   519k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  |  |  280|   519k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  |  |  281|   519k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  |  |  282|   519k|            : "cc");                                                 \
  |  |  |  |  283|   519k|  } while (0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (283:12): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  515|   519k|  r[2] = c3;
  516|   519k|  c3 = 0;
  517|   519k|  sqr_add_c2(a, 3, 0, c1, c2, c3);
  ------------------
  |  |  285|   519k|#define sqr_add_c2(a, i, j, c0, c1, c2) mul_add_c2((a)[i], (a)[j], c0, c1, c2)
  |  |  ------------------
  |  |  |  |  272|   519k|  do {                                                               \
  |  |  |  |  273|   519k|    BN_ULONG t1, t2;                                                 \
  |  |  |  |  274|   519k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  |  |  275|   519k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  |  |  276|   519k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  |  |  277|   519k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  |  |  278|   519k|            : "cc");                                                 \
  |  |  |  |  279|   519k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  |  |  280|   519k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  |  |  281|   519k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  |  |  282|   519k|            : "cc");                                                 \
  |  |  |  |  283|   519k|  } while (0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (283:12): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  518|   519k|  sqr_add_c2(a, 2, 1, c1, c2, c3);
  ------------------
  |  |  285|   519k|#define sqr_add_c2(a, i, j, c0, c1, c2) mul_add_c2((a)[i], (a)[j], c0, c1, c2)
  |  |  ------------------
  |  |  |  |  272|   519k|  do {                                                               \
  |  |  |  |  273|   519k|    BN_ULONG t1, t2;                                                 \
  |  |  |  |  274|   519k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  |  |  275|   519k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  |  |  276|   519k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  |  |  277|   519k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  |  |  278|   519k|            : "cc");                                                 \
  |  |  |  |  279|   519k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  |  |  280|   519k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  |  |  281|   519k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  |  |  282|   519k|            : "cc");                                                 \
  |  |  |  |  283|   519k|  } while (0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (283:12): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  519|   519k|  r[3] = c1;
  520|   519k|  c1 = 0;
  521|   519k|  sqr_add_c(a, 2, c2, c3, c1);
  ------------------
  |  |  262|   519k|  do {                                                            \
  |  |  263|   519k|    BN_ULONG t1, t2;                                              \
  |  |  264|   519k|    __asm__("mulq %2" : "=a"(t1), "=d"(t2) : "a"((a)[i]) : "cc"); \
  |  |  265|   519k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                  \
  |  |  266|   519k|            : "+r"(c0), "+r"(c1), "+r"(c2)                        \
  |  |  267|   519k|            : "r"(t1), "r"(t2), "g"(0)                            \
  |  |  268|   519k|            : "cc");                                              \
  |  |  269|   519k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (269:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  522|   519k|  sqr_add_c2(a, 3, 1, c2, c3, c1);
  ------------------
  |  |  285|   519k|#define sqr_add_c2(a, i, j, c0, c1, c2) mul_add_c2((a)[i], (a)[j], c0, c1, c2)
  |  |  ------------------
  |  |  |  |  272|   519k|  do {                                                               \
  |  |  |  |  273|   519k|    BN_ULONG t1, t2;                                                 \
  |  |  |  |  274|   519k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  |  |  275|   519k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  |  |  276|   519k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  |  |  277|   519k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  |  |  278|   519k|            : "cc");                                                 \
  |  |  |  |  279|   519k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  |  |  280|   519k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  |  |  281|   519k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  |  |  282|   519k|            : "cc");                                                 \
  |  |  |  |  283|   519k|  } while (0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (283:12): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  523|   519k|  r[4] = c2;
  524|   519k|  c2 = 0;
  525|   519k|  sqr_add_c2(a, 3, 2, c3, c1, c2);
  ------------------
  |  |  285|   519k|#define sqr_add_c2(a, i, j, c0, c1, c2) mul_add_c2((a)[i], (a)[j], c0, c1, c2)
  |  |  ------------------
  |  |  |  |  272|   519k|  do {                                                               \
  |  |  |  |  273|   519k|    BN_ULONG t1, t2;                                                 \
  |  |  |  |  274|   519k|    __asm__("mulq %3" : "=a"(t1), "=d"(t2) : "a"(a), "m"(b) : "cc"); \
  |  |  |  |  275|   519k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  |  |  276|   519k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  |  |  277|   519k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  |  |  278|   519k|            : "cc");                                                 \
  |  |  |  |  279|   519k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                     \
  |  |  |  |  280|   519k|            : "+r"(c0), "+r"(c1), "+r"(c2)                           \
  |  |  |  |  281|   519k|            : "r"(t1), "r"(t2), "g"(0)                               \
  |  |  |  |  282|   519k|            : "cc");                                                 \
  |  |  |  |  283|   519k|  } while (0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (283:12): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  526|   519k|  r[5] = c3;
  527|   519k|  c3 = 0;
  528|   519k|  sqr_add_c(a, 3, c1, c2, c3);
  ------------------
  |  |  262|   519k|  do {                                                            \
  |  |  263|   519k|    BN_ULONG t1, t2;                                              \
  |  |  264|   519k|    __asm__("mulq %2" : "=a"(t1), "=d"(t2) : "a"((a)[i]) : "cc"); \
  |  |  265|   519k|    __asm__("addq %3,%0; adcq %4,%1; adcq %5,%2"                  \
  |  |  266|   519k|            : "+r"(c0), "+r"(c1), "+r"(c2)                        \
  |  |  267|   519k|            : "r"(t1), "r"(t2), "g"(0)                            \
  |  |  268|   519k|            : "cc");                                              \
  |  |  269|   519k|  } while (0)
  |  |  ------------------
  |  |  |  Branch (269:12): [Folded - Ignored]
  |  |  ------------------
  ------------------
  529|   519k|  r[6] = c1;
  530|   519k|  r[7] = c2;
  531|   519k|}

BN_new:
   75|  30.7k|BIGNUM *BN_new(void) {
   76|  30.7k|  BIGNUM *bn = OPENSSL_malloc(sizeof(BIGNUM));
   77|       |
   78|  30.7k|  if (bn == NULL) {
  ------------------
  |  Branch (78:7): [True: 0, False: 30.7k]
  ------------------
   79|      0|    return NULL;
   80|      0|  }
   81|       |
   82|  30.7k|  OPENSSL_memset(bn, 0, sizeof(BIGNUM));
   83|  30.7k|  bn->flags = BN_FLG_MALLOCED;
  ------------------
  |  | 1026|  30.7k|#define BN_FLG_MALLOCED 0x01
  ------------------
   84|       |
   85|  30.7k|  return bn;
   86|  30.7k|}
BN_init:
   90|  4.18k|void BN_init(BIGNUM *bn) {
   91|  4.18k|  OPENSSL_memset(bn, 0, sizeof(BIGNUM));
   92|  4.18k|}
BN_free:
   94|  39.5k|void BN_free(BIGNUM *bn) {
   95|  39.5k|  if (bn == NULL) {
  ------------------
  |  Branch (95:7): [True: 4.73k, False: 34.8k]
  ------------------
   96|  4.73k|    return;
   97|  4.73k|  }
   98|       |
   99|  34.8k|  if ((bn->flags & BN_FLG_STATIC_DATA) == 0) {
  ------------------
  |  | 1027|  34.8k|#define BN_FLG_STATIC_DATA 0x02
  ------------------
  |  Branch (99:7): [True: 34.8k, False: 0]
  ------------------
  100|  34.8k|    OPENSSL_free(bn->d);
  101|  34.8k|  }
  102|       |
  103|  34.8k|  if (bn->flags & BN_FLG_MALLOCED) {
  ------------------
  |  | 1026|  34.8k|#define BN_FLG_MALLOCED 0x01
  ------------------
  |  Branch (103:7): [True: 30.7k, False: 4.16k]
  ------------------
  104|  30.7k|    OPENSSL_free(bn);
  105|  30.7k|  } else {
  106|  4.16k|    bn->d = NULL;
  107|  4.16k|  }
  108|  34.8k|}
BN_clear_free:
  110|  6.71k|void BN_clear_free(BIGNUM *bn) {
  111|  6.71k|  BN_free(bn);
  112|  6.71k|}
BN_copy:
  134|  32.9k|BIGNUM *BN_copy(BIGNUM *dest, const BIGNUM *src) {
  135|  32.9k|  if (src == dest) {
  ------------------
  |  Branch (135:7): [True: 1.76k, False: 31.1k]
  ------------------
  136|  1.76k|    return dest;
  137|  1.76k|  }
  138|       |
  139|  31.1k|  if (!bn_wexpand(dest, src->width)) {
  ------------------
  |  Branch (139:7): [True: 0, False: 31.1k]
  ------------------
  140|      0|    return NULL;
  141|      0|  }
  142|       |
  143|  31.1k|  OPENSSL_memcpy(dest->d, src->d, sizeof(src->d[0]) * src->width);
  144|       |
  145|  31.1k|  dest->width = src->width;
  146|  31.1k|  dest->neg = src->neg;
  147|  31.1k|  return dest;
  148|  31.1k|}
BN_num_bits_word:
  170|   564k|unsigned BN_num_bits_word(BN_ULONG l) {
  171|       |  // |BN_num_bits| is often called on RSA prime factors. These have public bit
  172|       |  // lengths, but all bits beyond the high bit are secret, so count bits in
  173|       |  // constant time.
  174|   564k|  BN_ULONG x, mask;
  175|   564k|  int bits = (l != 0);
  176|       |
  177|   564k|#if BN_BITS2 > 32
  178|       |  // Look at the upper half of |x|. |x| is at most 64 bits long.
  179|   564k|  x = l >> 32;
  180|       |  // Set |mask| to all ones if |x| (the top 32 bits of |l|) is non-zero and all
  181|       |  // all zeros otherwise.
  182|   564k|  mask = 0u - x;
  183|   564k|  mask = (0u - (mask >> (BN_BITS2 - 1)));
  ------------------
  |  |  151|   564k|#define BN_BITS2 64
  ------------------
  184|       |  // If |x| is non-zero, the lower half is included in the bit count in full,
  185|       |  // and we count the upper half. Otherwise, we count the lower half.
  186|   564k|  bits += 32 & mask;
  187|   564k|  l ^= (x ^ l) & mask;  // |l| is |x| if |mask| and remains |l| otherwise.
  188|   564k|#endif
  189|       |
  190|       |  // The remaining blocks are analogous iterations at lower powers of two.
  191|   564k|  x = l >> 16;
  192|   564k|  mask = 0u - x;
  193|   564k|  mask = (0u - (mask >> (BN_BITS2 - 1)));
  ------------------
  |  |  151|   564k|#define BN_BITS2 64
  ------------------
  194|   564k|  bits += 16 & mask;
  195|   564k|  l ^= (x ^ l) & mask;
  196|       |
  197|   564k|  x = l >> 8;
  198|   564k|  mask = 0u - x;
  199|   564k|  mask = (0u - (mask >> (BN_BITS2 - 1)));
  ------------------
  |  |  151|   564k|#define BN_BITS2 64
  ------------------
  200|   564k|  bits += 8 & mask;
  201|   564k|  l ^= (x ^ l) & mask;
  202|       |
  203|   564k|  x = l >> 4;
  204|   564k|  mask = 0u - x;
  205|   564k|  mask = (0u - (mask >> (BN_BITS2 - 1)));
  ------------------
  |  |  151|   564k|#define BN_BITS2 64
  ------------------
  206|   564k|  bits += 4 & mask;
  207|   564k|  l ^= (x ^ l) & mask;
  208|       |
  209|   564k|  x = l >> 2;
  210|   564k|  mask = 0u - x;
  211|   564k|  mask = (0u - (mask >> (BN_BITS2 - 1)));
  ------------------
  |  |  151|   564k|#define BN_BITS2 64
  ------------------
  212|   564k|  bits += 2 & mask;
  213|   564k|  l ^= (x ^ l) & mask;
  214|       |
  215|   564k|  x = l >> 1;
  216|   564k|  mask = 0u - x;
  217|   564k|  mask = (0u - (mask >> (BN_BITS2 - 1)));
  ------------------
  |  |  151|   564k|#define BN_BITS2 64
  ------------------
  218|   564k|  bits += 1 & mask;
  219|       |
  220|   564k|  return bits;
  221|   564k|}
BN_num_bits:
  223|   564k|unsigned BN_num_bits(const BIGNUM *bn) {
  224|   564k|  const int width = bn_minimal_width(bn);
  225|   564k|  if (width == 0) {
  ------------------
  |  Branch (225:7): [True: 2, False: 564k]
  ------------------
  226|      2|    return 0;
  227|      2|  }
  228|       |
  229|   564k|  return (width - 1) * BN_BITS2 + BN_num_bits_word(bn->d[width - 1]);
  ------------------
  |  |  151|   564k|#define BN_BITS2 64
  ------------------
  230|   564k|}
BN_num_bytes:
  232|  7.36k|unsigned BN_num_bytes(const BIGNUM *bn) {
  233|  7.36k|  return (BN_num_bits(bn) + 7) / 8;
  234|  7.36k|}
BN_zero:
  236|  4.49M|void BN_zero(BIGNUM *bn) {
  237|  4.49M|  bn->width = bn->neg = 0;
  238|  4.49M|}
BN_set_word:
  244|  2.70k|int BN_set_word(BIGNUM *bn, BN_ULONG value) {
  245|  2.70k|  if (value == 0) {
  ------------------
  |  Branch (245:7): [True: 0, False: 2.70k]
  ------------------
  246|      0|    BN_zero(bn);
  247|      0|    return 1;
  248|      0|  }
  249|       |
  250|  2.70k|  if (!bn_wexpand(bn, 1)) {
  ------------------
  |  Branch (250:7): [True: 0, False: 2.70k]
  ------------------
  251|      0|    return 0;
  252|      0|  }
  253|       |
  254|  2.70k|  bn->neg = 0;
  255|  2.70k|  bn->d[0] = value;
  256|  2.70k|  bn->width = 1;
  257|  2.70k|  return 1;
  258|  2.70k|}
bn_fits_in_words:
  306|  3.56M|int bn_fits_in_words(const BIGNUM *bn, size_t num) {
  307|       |  // All words beyond |num| must be zero.
  308|  3.56M|  BN_ULONG mask = 0;
  309|  9.29M|  for (size_t i = num; i < (size_t)bn->width; i++) {
  ------------------
  |  Branch (309:24): [True: 5.73M, False: 3.56M]
  ------------------
  310|  5.73M|    mask |= bn->d[i];
  311|  5.73M|  }
  312|  3.56M|  return mask == 0;
  313|  3.56M|}
bn_copy_words:
  315|  7.63k|int bn_copy_words(BN_ULONG *out, size_t num, const BIGNUM *bn) {
  316|  7.63k|  if (bn->neg) {
  ------------------
  |  Branch (316:7): [True: 0, False: 7.63k]
  ------------------
  317|      0|    OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  318|      0|    return 0;
  319|      0|  }
  320|       |
  321|  7.63k|  size_t width = (size_t)bn->width;
  322|  7.63k|  if (width > num) {
  ------------------
  |  Branch (322:7): [True: 142, False: 7.49k]
  ------------------
  323|    142|    if (!bn_fits_in_words(bn, num)) {
  ------------------
  |  Branch (323:9): [True: 141, False: 1]
  ------------------
  324|    141|      OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG);
  ------------------
  |  |  441|    141|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  325|    141|      return 0;
  326|    141|    }
  327|      1|    width = num;
  328|      1|  }
  329|       |
  330|  7.49k|  OPENSSL_memset(out, 0, sizeof(BN_ULONG) * num);
  331|  7.49k|  OPENSSL_memcpy(out, bn->d, sizeof(BN_ULONG) * width);
  332|  7.49k|  return 1;
  333|  7.63k|}
BN_is_negative:
  335|  20.6k|int BN_is_negative(const BIGNUM *bn) {
  336|  20.6k|  return bn->neg != 0;
  337|  20.6k|}
BN_set_negative:
  339|      4|void BN_set_negative(BIGNUM *bn, int sign) {
  340|      4|  if (sign && !BN_is_zero(bn)) {
  ------------------
  |  Branch (340:7): [True: 0, False: 4]
  |  Branch (340:15): [True: 0, False: 0]
  ------------------
  341|      0|    bn->neg = 1;
  342|      4|  } else {
  343|      4|    bn->neg = 0;
  344|      4|  }
  345|      4|}
bn_wexpand:
  347|  6.64M|int bn_wexpand(BIGNUM *bn, size_t words) {
  348|  6.64M|  BN_ULONG *a;
  349|       |
  350|  6.64M|  if (words <= (size_t)bn->dmax) {
  ------------------
  |  Branch (350:7): [True: 6.60M, False: 42.9k]
  ------------------
  351|  6.60M|    return 1;
  352|  6.60M|  }
  353|       |
  354|  42.9k|  if (words > BN_MAX_WORDS) {
  ------------------
  |  |   73|  42.9k|#define BN_MAX_WORDS (INT_MAX / (4 * BN_BITS2))
  |  |  ------------------
  |  |  |  |  151|  42.9k|#define BN_BITS2 64
  |  |  ------------------
  ------------------
  |  Branch (354:7): [True: 0, False: 42.9k]
  ------------------
  355|      0|    OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  356|      0|    return 0;
  357|      0|  }
  358|       |
  359|  42.9k|  if (bn->flags & BN_FLG_STATIC_DATA) {
  ------------------
  |  | 1027|  42.9k|#define BN_FLG_STATIC_DATA 0x02
  ------------------
  |  Branch (359:7): [True: 0, False: 42.9k]
  ------------------
  360|      0|    OPENSSL_PUT_ERROR(BN, BN_R_EXPAND_ON_STATIC_BIGNUM_DATA);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  361|      0|    return 0;
  362|      0|  }
  363|       |
  364|  42.9k|  a = OPENSSL_malloc(sizeof(BN_ULONG) * words);
  365|  42.9k|  if (a == NULL) {
  ------------------
  |  Branch (365:7): [True: 0, False: 42.9k]
  ------------------
  366|      0|    return 0;
  367|      0|  }
  368|       |
  369|  42.9k|  OPENSSL_memcpy(a, bn->d, sizeof(BN_ULONG) * bn->width);
  370|       |
  371|  42.9k|  OPENSSL_free(bn->d);
  372|  42.9k|  bn->d = a;
  373|  42.9k|  bn->dmax = (int)words;
  374|       |
  375|  42.9k|  return 1;
  376|  42.9k|}
bn_resize_words:
  386|  6.93k|int bn_resize_words(BIGNUM *bn, size_t words) {
  387|  6.93k|  if ((size_t)bn->width <= words) {
  ------------------
  |  Branch (387:7): [True: 6.92k, False: 9]
  ------------------
  388|  6.92k|    if (!bn_wexpand(bn, words)) {
  ------------------
  |  Branch (388:9): [True: 0, False: 6.92k]
  ------------------
  389|      0|      return 0;
  390|      0|    }
  391|  6.92k|    OPENSSL_memset(bn->d + bn->width, 0,
  392|  6.92k|                   (words - bn->width) * sizeof(BN_ULONG));
  393|  6.92k|    bn->width = (int)words;
  394|  6.92k|    return 1;
  395|  6.92k|  }
  396|       |
  397|       |  // All words beyond the new width must be zero.
  398|      9|  if (!bn_fits_in_words(bn, words)) {
  ------------------
  |  Branch (398:7): [True: 0, False: 9]
  ------------------
  399|      0|    OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  400|      0|    return 0;
  401|      0|  }
  402|      9|  bn->width = (int)words;
  403|      9|  return 1;
  404|      9|}
bn_select_words:
  407|  6.69M|                     const BN_ULONG *b, size_t num) {
  408|   118M|  for (size_t i = 0; i < num; i++) {
  ------------------
  |  Branch (408:22): [True: 111M, False: 6.69M]
  ------------------
  409|   111M|    static_assert(sizeof(BN_ULONG) <= sizeof(crypto_word_t),
  410|   111M|                  "crypto_word_t is too small");
  411|   111M|    r[i] = constant_time_select_w(mask, a[i], b[i]);
  412|   111M|  }
  413|  6.69M|}
bn_minimal_width:
  415|  6.03M|int bn_minimal_width(const BIGNUM *bn) {
  416|  6.03M|  int ret = bn->width;
  417|  10.9M|  while (ret > 0 && bn->d[ret - 1] == 0) {
  ------------------
  |  Branch (417:10): [True: 10.9M, False: 6.17k]
  |  Branch (417:21): [True: 4.94M, False: 6.02M]
  ------------------
  418|  4.94M|    ret--;
  419|  4.94M|  }
  420|  6.03M|  return ret;
  421|  6.03M|}
bn_set_minimal_width:
  423|  4.37M|void bn_set_minimal_width(BIGNUM *bn) {
  424|  4.37M|  bn->width = bn_minimal_width(bn);
  425|  4.37M|  if (bn->width == 0) {
  ------------------
  |  Branch (425:7): [True: 6.17k, False: 4.36M]
  ------------------
  426|  6.17k|    bn->neg = 0;
  427|  6.17k|  }
  428|  4.37M|}
bcm.c:BN_value_one_do_init:
  159|      1|DEFINE_METHOD_FUNCTION(BIGNUM, BN_value_one) {
  160|      1|  static const BN_ULONG kOneLimbs[1] = { 1 };
  161|      1|  out->d = (BN_ULONG*) kOneLimbs;
  162|      1|  out->width = 1;
  163|      1|  out->dmax = 1;
  164|      1|  out->neg = 0;
  165|      1|  out->flags = BN_FLG_STATIC_DATA;
  ------------------
  |  | 1027|      1|#define BN_FLG_STATIC_DATA 0x02
  ------------------
  166|      1|}

bn_big_endian_to_words:
   65|  12.7k|                            size_t in_len) {
   66|  2.10M|  for (size_t i = 0; i < out_len; i++) {
  ------------------
  |  Branch (66:22): [True: 2.10M, False: 2.15k]
  ------------------
   67|  2.10M|    if (in_len < sizeof(BN_ULONG)) {
  ------------------
  |  Branch (67:9): [True: 10.5k, False: 2.09M]
  ------------------
   68|       |      // Load the last partial word.
   69|  10.5k|      BN_ULONG word = 0;
   70|  32.4k|      for (size_t j = 0; j < in_len; j++) {
  ------------------
  |  Branch (70:26): [True: 21.8k, False: 10.5k]
  ------------------
   71|  21.8k|        word = (word << 8) | in[j];
   72|  21.8k|      }
   73|  10.5k|      in_len = 0;
   74|  10.5k|      out[i] = word;
   75|       |      // Fill the remainder with zeros.
   76|  10.5k|      OPENSSL_memset(out + i + 1, 0, (out_len - i - 1) * sizeof(BN_ULONG));
   77|  10.5k|      break;
   78|  10.5k|    }
   79|       |
   80|  2.09M|    in_len -= sizeof(BN_ULONG);
   81|  2.09M|    out[i] = CRYPTO_load_word_be(in + in_len);
   82|  2.09M|  }
   83|       |
   84|       |  // The caller should have sized the output to avoid truncation.
   85|  12.7k|  assert(in_len == 0);
   86|  12.7k|}
BN_bin2bn:
   88|  11.7k|BIGNUM *BN_bin2bn(const uint8_t *in, size_t len, BIGNUM *ret) {
   89|  11.7k|  BIGNUM *bn = NULL;
   90|  11.7k|  if (ret == NULL) {
  ------------------
  |  Branch (90:7): [True: 1.18k, False: 10.5k]
  ------------------
   91|  1.18k|    bn = BN_new();
   92|  1.18k|    if (bn == NULL) {
  ------------------
  |  Branch (92:9): [True: 0, False: 1.18k]
  ------------------
   93|      0|      return NULL;
   94|      0|    }
   95|  1.18k|    ret = bn;
   96|  1.18k|  }
   97|       |
   98|  11.7k|  if (len == 0) {
  ------------------
  |  Branch (98:7): [True: 2, False: 11.7k]
  ------------------
   99|      2|    ret->width = 0;
  100|      2|    return ret;
  101|      2|  }
  102|       |
  103|  11.7k|  size_t num_words = ((len - 1) / BN_BYTES) + 1;
  ------------------
  |  |  152|  11.7k|#define BN_BYTES 8
  ------------------
  104|  11.7k|  if (!bn_wexpand(ret, num_words)) {
  ------------------
  |  Branch (104:7): [True: 0, False: 11.7k]
  ------------------
  105|      0|    BN_free(bn);
  106|      0|    return NULL;
  107|      0|  }
  108|       |
  109|       |  // |bn_wexpand| must check bounds on |num_words| to write it into
  110|       |  // |ret->dmax|.
  111|  11.7k|  assert(num_words <= INT_MAX);
  112|  11.7k|  ret->width = (int)num_words;
  113|  11.7k|  ret->neg = 0;
  114|       |
  115|  11.7k|  bn_big_endian_to_words(ret->d, ret->width, in, len);
  116|  11.7k|  return ret;
  117|  11.7k|}
bn_words_to_big_endian:
  178|  5.62k|                            size_t in_len) {
  179|       |  // The caller should have selected an output length without truncation.
  180|  5.62k|  assert(fits_in_bytes(in, in_len, out_len));
  181|       |
  182|       |  // We only support little-endian platforms, so the internal representation is
  183|       |  // also little-endian as bytes. We can simply copy it in reverse.
  184|  5.62k|  const uint8_t *bytes = (const uint8_t *)in;
  185|  5.62k|  size_t num_bytes = in_len * sizeof(BN_ULONG);
  186|  5.62k|  if (out_len < num_bytes) {
  ------------------
  |  Branch (186:7): [True: 4.05k, False: 1.56k]
  ------------------
  187|  4.05k|    num_bytes = out_len;
  188|  4.05k|  }
  189|       |
  190|   279k|  for (size_t i = 0; i < num_bytes; i++) {
  ------------------
  |  Branch (190:22): [True: 273k, False: 5.62k]
  ------------------
  191|   273k|    out[out_len - i - 1] = bytes[i];
  192|   273k|  }
  193|       |  // Pad out the rest of the buffer with zeroes.
  194|  5.62k|  OPENSSL_memset(out, 0, out_len - num_bytes);
  195|  5.62k|}
BN_bn2bin_padded:
  222|  4.26k|int BN_bn2bin_padded(uint8_t *out, size_t len, const BIGNUM *in) {
  223|  4.26k|  if (!fits_in_bytes(in->d, in->width, len)) {
  ------------------
  |  Branch (223:7): [True: 0, False: 4.26k]
  ------------------
  224|      0|    return 0;
  225|      0|  }
  226|       |
  227|  4.26k|  bn_words_to_big_endian(out, len, in->d, in->width);
  228|  4.26k|  return 1;
  229|  4.26k|}
bcm.c:fits_in_bytes:
  155|  9.88k|                         size_t num_bytes) {
  156|  9.88k|  const uint8_t *bytes = (const uint8_t *)words;
  157|  9.88k|  size_t tot_bytes = num_words * sizeof(BN_ULONG);
  158|  9.88k|  uint8_t mask = 0;
  159|  52.2k|  for (size_t i = num_bytes; i < tot_bytes; i++) {
  ------------------
  |  Branch (159:30): [True: 42.3k, False: 9.88k]
  ------------------
  160|  42.3k|    mask |= bytes[i];
  161|  42.3k|  }
  162|  9.88k|  return mask == 0;
  163|  9.88k|}

BN_ucmp:
   99|  10.8k|int BN_ucmp(const BIGNUM *a, const BIGNUM *b) {
  100|  10.8k|  return bn_cmp_words_consttime(a->d, a->width, b->d, b->width);
  101|  10.8k|}
BN_cmp:
  103|  7.49k|int BN_cmp(const BIGNUM *a, const BIGNUM *b) {
  104|  7.49k|  if ((a == NULL) || (b == NULL)) {
  ------------------
  |  Branch (104:7): [True: 0, False: 7.49k]
  |  Branch (104:22): [True: 0, False: 7.49k]
  ------------------
  105|      0|    if (a != NULL) {
  ------------------
  |  Branch (105:9): [True: 0, False: 0]
  ------------------
  106|      0|      return -1;
  107|      0|    } else if (b != NULL) {
  ------------------
  |  Branch (107:16): [True: 0, False: 0]
  ------------------
  108|      0|      return 1;
  109|      0|    } else {
  110|      0|      return 0;
  111|      0|    }
  112|      0|  }
  113|       |
  114|       |  // We do not attempt to process the sign bit in constant time. Negative
  115|       |  // |BIGNUM|s should never occur in crypto, only calculators.
  116|  7.49k|  if (a->neg != b->neg) {
  ------------------
  |  Branch (116:7): [True: 0, False: 7.49k]
  ------------------
  117|      0|    if (a->neg) {
  ------------------
  |  Branch (117:9): [True: 0, False: 0]
  ------------------
  118|      0|      return -1;
  119|      0|    }
  120|      0|    return 1;
  121|      0|  }
  122|       |
  123|  7.49k|  int ret = BN_ucmp(a, b);
  124|  7.49k|  return a->neg ? -ret : ret;
  ------------------
  |  Branch (124:10): [True: 0, False: 7.49k]
  ------------------
  125|  7.49k|}
bn_less_than_words:
  127|  2.01k|int bn_less_than_words(const BN_ULONG *a, const BN_ULONG *b, size_t len) {
  128|  2.01k|  return bn_cmp_words_consttime(a, len, b, len) < 0;
  129|  2.01k|}
BN_abs_is_word:
  131|   512k|int BN_abs_is_word(const BIGNUM *bn, BN_ULONG w) {
  132|   512k|  if (bn->width == 0) {
  ------------------
  |  Branch (132:7): [True: 0, False: 512k]
  ------------------
  133|      0|    return w == 0;
  134|      0|  }
  135|   512k|  BN_ULONG mask = bn->d[0] ^ w;
  136|  2.01M|  for (int i = 1; i < bn->width; i++) {
  ------------------
  |  Branch (136:19): [True: 1.49M, False: 512k]
  ------------------
  137|  1.49M|    mask |= bn->d[i];
  138|  1.49M|  }
  139|   512k|  return mask == 0;
  140|   512k|}
BN_is_zero:
  153|  1.11M|int BN_is_zero(const BIGNUM *bn) {
  154|  1.11M|  return bn_fits_in_words(bn, 0);
  155|  1.11M|}
BN_is_one:
  157|   511k|int BN_is_one(const BIGNUM *bn) {
  158|   511k|  return bn->neg == 0 && BN_abs_is_word(bn, 1);
  ------------------
  |  Branch (158:10): [True: 511k, False: 0]
  |  Branch (158:26): [True: 13.1k, False: 498k]
  ------------------
  159|   511k|}
BN_is_odd:
  165|  16.0k|int BN_is_odd(const BIGNUM *bn) {
  166|  16.0k|  return bn->width > 0 && (bn->d[0] & 1) == 1;
  ------------------
  |  Branch (166:10): [True: 16.0k, False: 0]
  |  Branch (166:27): [True: 15.2k, False: 763]
  ------------------
  167|  16.0k|}
bcm.c:bn_cmp_words_consttime:
   68|  12.8k|                                  const BN_ULONG *b, size_t b_len) {
   69|  12.8k|  static_assert(sizeof(BN_ULONG) <= sizeof(crypto_word_t),
   70|  12.8k|                "crypto_word_t is too small");
   71|  12.8k|  int ret = 0;
   72|       |  // Process the common words in little-endian order.
   73|  12.8k|  size_t min = a_len < b_len ? a_len : b_len;
  ------------------
  |  Branch (73:16): [True: 6.08k, False: 6.80k]
  ------------------
   74|   346k|  for (size_t i = 0; i < min; i++) {
  ------------------
  |  Branch (74:22): [True: 334k, False: 12.8k]
  ------------------
   75|   334k|    crypto_word_t eq = constant_time_eq_w(a[i], b[i]);
   76|   334k|    crypto_word_t lt = constant_time_lt_w(a[i], b[i]);
   77|   334k|    ret =
   78|   334k|        constant_time_select_int(eq, ret, constant_time_select_int(lt, -1, 1));
   79|   334k|  }
   80|       |
   81|       |  // If |a| or |b| has non-zero words beyond |min|, they take precedence.
   82|  12.8k|  if (a_len < b_len) {
  ------------------
  |  Branch (82:7): [True: 6.08k, False: 6.80k]
  ------------------
   83|  6.08k|    crypto_word_t mask = 0;
   84|   798k|    for (size_t i = a_len; i < b_len; i++) {
  ------------------
  |  Branch (84:28): [True: 791k, False: 6.08k]
  ------------------
   85|   791k|      mask |= b[i];
   86|   791k|    }
   87|  6.08k|    ret = constant_time_select_int(constant_time_is_zero_w(mask), ret, -1);
   88|  6.80k|  } else if (b_len < a_len) {
  ------------------
  |  Branch (88:14): [True: 254, False: 6.54k]
  ------------------
   89|    254|    crypto_word_t mask = 0;
   90|   202k|    for (size_t i = b_len; i < a_len; i++) {
  ------------------
  |  Branch (90:28): [True: 202k, False: 254]
  ------------------
   91|   202k|      mask |= a[i];
   92|   202k|    }
   93|    254|    ret = constant_time_select_int(constant_time_is_zero_w(mask), ret, 1);
   94|    254|  }
   95|       |
   96|  12.8k|  return ret;
   97|  12.8k|}

BN_CTX_new:
  108|  1.60k|BN_CTX *BN_CTX_new(void) {
  109|  1.60k|  BN_CTX *ret = OPENSSL_malloc(sizeof(BN_CTX));
  110|  1.60k|  if (!ret) {
  ------------------
  |  Branch (110:7): [True: 0, False: 1.60k]
  ------------------
  111|      0|    return NULL;
  112|      0|  }
  113|       |
  114|       |  // Initialise the structure
  115|  1.60k|  ret->bignums = NULL;
  116|  1.60k|  BN_STACK_init(&ret->stack);
  117|  1.60k|  ret->used = 0;
  118|  1.60k|  ret->error = 0;
  119|  1.60k|  ret->defer_error = 0;
  120|  1.60k|  return ret;
  121|  1.60k|}
BN_CTX_free:
  123|  2.82k|void BN_CTX_free(BN_CTX *ctx) {
  124|  2.82k|  if (ctx == NULL) {
  ------------------
  |  Branch (124:7): [True: 1.21k, False: 1.60k]
  ------------------
  125|  1.21k|    return;
  126|  1.21k|  }
  127|       |
  128|       |  // All |BN_CTX_start| calls must be matched with |BN_CTX_end|, otherwise the
  129|       |  // function may use more memory than expected, potentially without bound if
  130|       |  // done in a loop. Assert that all |BIGNUM|s have been released.
  131|  1.60k|  assert(ctx->used == 0 || ctx->error);
  132|  1.60k|  sk_BIGNUM_pop_free(ctx->bignums, BN_free);
  133|  1.60k|  BN_STACK_cleanup(&ctx->stack);
  134|  1.60k|  OPENSSL_free(ctx);
  135|  1.60k|}
BN_CTX_start:
  137|  2.84M|void BN_CTX_start(BN_CTX *ctx) {
  138|  2.84M|  if (ctx->error) {
  ------------------
  |  Branch (138:7): [True: 0, False: 2.84M]
  ------------------
  139|       |    // Once an operation has failed, |ctx->stack| no longer matches the number
  140|       |    // of |BN_CTX_end| calls to come. Do nothing.
  141|      0|    return;
  142|      0|  }
  143|       |
  144|  2.84M|  if (!BN_STACK_push(&ctx->stack, ctx->used)) {
  ------------------
  |  Branch (144:7): [True: 0, False: 2.84M]
  ------------------
  145|      0|    ctx->error = 1;
  146|       |    // |BN_CTX_start| cannot fail, so defer the error to |BN_CTX_get|.
  147|      0|    ctx->defer_error = 1;
  148|      0|  }
  149|  2.84M|}
BN_CTX_get:
  151|  4.49M|BIGNUM *BN_CTX_get(BN_CTX *ctx) {
  152|       |  // Once any operation has failed, they all do.
  153|  4.49M|  if (ctx->error) {
  ------------------
  |  Branch (153:7): [True: 0, False: 4.49M]
  ------------------
  154|      0|    if (ctx->defer_error) {
  ------------------
  |  Branch (154:9): [True: 0, False: 0]
  ------------------
  155|      0|      OPENSSL_PUT_ERROR(BN, BN_R_TOO_MANY_TEMPORARY_VARIABLES);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  156|      0|      ctx->defer_error = 0;
  157|      0|    }
  158|      0|    return NULL;
  159|      0|  }
  160|       |
  161|  4.49M|  if (ctx->bignums == NULL) {
  ------------------
  |  Branch (161:7): [True: 1.52k, False: 4.48M]
  ------------------
  162|  1.52k|    ctx->bignums = sk_BIGNUM_new_null();
  163|  1.52k|    if (ctx->bignums == NULL) {
  ------------------
  |  Branch (163:9): [True: 0, False: 1.52k]
  ------------------
  164|      0|      ctx->error = 1;
  165|      0|      return NULL;
  166|      0|    }
  167|  1.52k|  }
  168|       |
  169|  4.49M|  if (ctx->used == sk_BIGNUM_num(ctx->bignums)) {
  ------------------
  |  Branch (169:7): [True: 20.0k, False: 4.47M]
  ------------------
  170|  20.0k|    BIGNUM *bn = BN_new();
  171|  20.0k|    if (bn == NULL || !sk_BIGNUM_push(ctx->bignums, bn)) {
  ------------------
  |  Branch (171:9): [True: 0, False: 20.0k]
  |  Branch (171:23): [True: 0, False: 20.0k]
  ------------------
  172|      0|      OPENSSL_PUT_ERROR(BN, BN_R_TOO_MANY_TEMPORARY_VARIABLES);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  173|      0|      BN_free(bn);
  174|      0|      ctx->error = 1;
  175|      0|      return NULL;
  176|      0|    }
  177|  20.0k|  }
  178|       |
  179|  4.49M|  BIGNUM *ret = sk_BIGNUM_value(ctx->bignums, ctx->used);
  180|  4.49M|  BN_zero(ret);
  181|       |  // This is bounded by |sk_BIGNUM_num|, so it cannot overflow.
  182|  4.49M|  ctx->used++;
  183|  4.49M|  return ret;
  184|  4.49M|}
BN_CTX_end:
  186|  2.84M|void BN_CTX_end(BN_CTX *ctx) {
  187|  2.84M|  if (ctx->error) {
  ------------------
  |  Branch (187:7): [True: 0, False: 2.84M]
  ------------------
  188|       |    // Once an operation has failed, |ctx->stack| no longer matches the number
  189|       |    // of |BN_CTX_end| calls to come. Do nothing.
  190|      0|    return;
  191|      0|  }
  192|       |
  193|  2.84M|  ctx->used = BN_STACK_pop(&ctx->stack);
  194|  2.84M|}
bcm.c:BN_STACK_init:
  199|  1.60k|static void BN_STACK_init(BN_STACK *st) {
  200|  1.60k|  st->indexes = NULL;
  201|  1.60k|  st->depth = st->size = 0;
  202|  1.60k|}
bcm.c:BN_STACK_cleanup:
  204|  1.60k|static void BN_STACK_cleanup(BN_STACK *st) {
  205|  1.60k|  OPENSSL_free(st->indexes);
  206|  1.60k|}
bcm.c:BN_STACK_push:
  208|  2.84M|static int BN_STACK_push(BN_STACK *st, size_t idx) {
  209|  2.84M|  if (st->depth == st->size) {
  ------------------
  |  Branch (209:7): [True: 1.60k, False: 2.84M]
  ------------------
  210|       |    // This function intentionally does not push to the error queue on error.
  211|       |    // Error-reporting is deferred to |BN_CTX_get|.
  212|  1.60k|    size_t new_size = st->size != 0 ? st->size * 3 / 2 : BN_CTX_START_FRAMES;
  ------------------
  |  |   67|  1.60k|#define BN_CTX_START_FRAMES 32
  ------------------
  |  Branch (212:23): [True: 0, False: 1.60k]
  ------------------
  213|  1.60k|    if (new_size <= st->size || new_size > ((size_t)-1) / sizeof(size_t)) {
  ------------------
  |  Branch (213:9): [True: 0, False: 1.60k]
  |  Branch (213:33): [True: 0, False: 1.60k]
  ------------------
  214|      0|      return 0;
  215|      0|    }
  216|  1.60k|    size_t *new_indexes =
  217|  1.60k|        OPENSSL_realloc(st->indexes, new_size * sizeof(size_t));
  218|  1.60k|    if (new_indexes == NULL) {
  ------------------
  |  Branch (218:9): [True: 0, False: 1.60k]
  ------------------
  219|      0|      return 0;
  220|      0|    }
  221|  1.60k|    st->indexes = new_indexes;
  222|  1.60k|    st->size = new_size;
  223|  1.60k|  }
  224|       |
  225|  2.84M|  st->indexes[st->depth] = idx;
  226|  2.84M|  st->depth++;
  227|  2.84M|  return 1;
  228|  2.84M|}
bcm.c:BN_STACK_pop:
  230|  2.84M|static size_t BN_STACK_pop(BN_STACK *st) {
  231|  2.84M|  assert(st->depth > 0);
  232|  2.84M|  st->depth--;
  233|  2.84M|  return st->indexes[st->depth];
  234|  2.84M|}

BN_div:
  195|   546k|           const BIGNUM *divisor, BN_CTX *ctx) {
  196|   546k|  int norm_shift, loop;
  197|   546k|  BIGNUM wnum;
  198|   546k|  BN_ULONG *resp, *wnump;
  199|   546k|  BN_ULONG d0, d1;
  200|   546k|  int num_n, div_n;
  201|       |
  202|       |  // This function relies on the historical minimal-width |BIGNUM| invariant.
  203|       |  // It is already not constant-time (constant-time reductions should use
  204|       |  // Montgomery logic), so we shrink all inputs and intermediate values to
  205|       |  // retain the previous behavior.
  206|       |
  207|       |  // Invalid zero-padding would have particularly bad consequences.
  208|   546k|  int numerator_width = bn_minimal_width(numerator);
  209|   546k|  int divisor_width = bn_minimal_width(divisor);
  210|   546k|  if ((numerator_width > 0 && numerator->d[numerator_width - 1] == 0) ||
  ------------------
  |  Branch (210:8): [True: 546k, False: 4]
  |  Branch (210:31): [True: 0, False: 546k]
  ------------------
  211|   546k|      (divisor_width > 0 && divisor->d[divisor_width - 1] == 0)) {
  ------------------
  |  Branch (211:8): [True: 546k, False: 0]
  |  Branch (211:29): [True: 0, False: 546k]
  ------------------
  212|      0|    OPENSSL_PUT_ERROR(BN, BN_R_NOT_INITIALIZED);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  213|      0|    return 0;
  214|      0|  }
  215|       |
  216|   546k|  if (BN_is_zero(divisor)) {
  ------------------
  |  Branch (216:7): [True: 0, False: 546k]
  ------------------
  217|      0|    OPENSSL_PUT_ERROR(BN, BN_R_DIV_BY_ZERO);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  218|      0|    return 0;
  219|      0|  }
  220|       |
  221|   546k|  BN_CTX_start(ctx);
  222|   546k|  BIGNUM *tmp = BN_CTX_get(ctx);
  223|   546k|  BIGNUM *snum = BN_CTX_get(ctx);
  224|   546k|  BIGNUM *sdiv = BN_CTX_get(ctx);
  225|   546k|  BIGNUM *res = NULL;
  226|   546k|  if (quotient == NULL) {
  ------------------
  |  Branch (226:7): [True: 546k, False: 0]
  ------------------
  227|   546k|    res = BN_CTX_get(ctx);
  228|   546k|  } else {
  229|      0|    res = quotient;
  230|      0|  }
  231|   546k|  if (sdiv == NULL || res == NULL) {
  ------------------
  |  Branch (231:7): [True: 0, False: 546k]
  |  Branch (231:23): [True: 0, False: 546k]
  ------------------
  232|      0|    goto err;
  233|      0|  }
  234|       |
  235|       |  // First we normalise the numbers
  236|   546k|  norm_shift = BN_BITS2 - (BN_num_bits(divisor) % BN_BITS2);
  ------------------
  |  |  151|   546k|#define BN_BITS2 64
  ------------------
                norm_shift = BN_BITS2 - (BN_num_bits(divisor) % BN_BITS2);
  ------------------
  |  |  151|   546k|#define BN_BITS2 64
  ------------------
  237|   546k|  if (!BN_lshift(sdiv, divisor, norm_shift)) {
  ------------------
  |  Branch (237:7): [True: 0, False: 546k]
  ------------------
  238|      0|    goto err;
  239|      0|  }
  240|   546k|  bn_set_minimal_width(sdiv);
  241|   546k|  sdiv->neg = 0;
  242|   546k|  norm_shift += BN_BITS2;
  ------------------
  |  |  151|   546k|#define BN_BITS2 64
  ------------------
  243|   546k|  if (!BN_lshift(snum, numerator, norm_shift)) {
  ------------------
  |  Branch (243:7): [True: 0, False: 546k]
  ------------------
  244|      0|    goto err;
  245|      0|  }
  246|   546k|  bn_set_minimal_width(snum);
  247|   546k|  snum->neg = 0;
  248|       |
  249|       |  // Since we don't want to have special-case logic for the case where snum is
  250|       |  // larger than sdiv, we pad snum with enough zeroes without changing its
  251|       |  // value.
  252|   546k|  if (snum->width <= sdiv->width + 1) {
  ------------------
  |  Branch (252:7): [True: 752, False: 545k]
  ------------------
  253|    752|    if (!bn_wexpand(snum, sdiv->width + 2)) {
  ------------------
  |  Branch (253:9): [True: 0, False: 752]
  ------------------
  254|      0|      goto err;
  255|      0|    }
  256|  1.61k|    for (int i = snum->width; i < sdiv->width + 2; i++) {
  ------------------
  |  Branch (256:31): [True: 864, False: 752]
  ------------------
  257|    864|      snum->d[i] = 0;
  258|    864|    }
  259|    752|    snum->width = sdiv->width + 2;
  260|   545k|  } else {
  261|   545k|    if (!bn_wexpand(snum, snum->width + 1)) {
  ------------------
  |  Branch (261:9): [True: 0, False: 545k]
  ------------------
  262|      0|      goto err;
  263|      0|    }
  264|   545k|    snum->d[snum->width] = 0;
  265|   545k|    snum->width++;
  266|   545k|  }
  267|       |
  268|   546k|  div_n = sdiv->width;
  269|   546k|  num_n = snum->width;
  270|   546k|  loop = num_n - div_n;
  271|       |  // Lets setup a 'window' into snum
  272|       |  // This is the part that corresponds to the current
  273|       |  // 'area' being divided
  274|   546k|  wnum.neg = 0;
  275|   546k|  wnum.d = &(snum->d[loop]);
  276|   546k|  wnum.width = div_n;
  277|       |  // only needed when BN_ucmp messes up the values between width and max
  278|   546k|  wnum.dmax = snum->dmax - loop;  // so we don't step out of bounds
  279|       |
  280|       |  // Get the top 2 words of sdiv
  281|       |  // div_n=sdiv->width;
  282|   546k|  d0 = sdiv->d[div_n - 1];
  283|   546k|  d1 = (div_n == 1) ? 0 : sdiv->d[div_n - 2];
  ------------------
  |  Branch (283:8): [True: 4.59k, False: 541k]
  ------------------
  284|       |
  285|       |  // pointer to the 'top' of snum
  286|   546k|  wnump = &(snum->d[num_n - 1]);
  287|       |
  288|       |  // Setup |res|. |numerator| and |res| may alias, so we save |numerator->neg|
  289|       |  // for later.
  290|   546k|  const int numerator_neg = numerator->neg;
  291|   546k|  res->neg = (numerator_neg ^ divisor->neg);
  292|   546k|  if (!bn_wexpand(res, loop + 1)) {
  ------------------
  |  Branch (292:7): [True: 0, False: 546k]
  ------------------
  293|      0|    goto err;
  294|      0|  }
  295|   546k|  res->width = loop - 1;
  296|   546k|  resp = &(res->d[loop - 1]);
  297|       |
  298|       |  // space for temp
  299|   546k|  if (!bn_wexpand(tmp, div_n + 1)) {
  ------------------
  |  Branch (299:7): [True: 0, False: 546k]
  ------------------
  300|      0|    goto err;
  301|      0|  }
  302|       |
  303|       |  // if res->width == 0 then clear the neg value otherwise decrease
  304|       |  // the resp pointer
  305|   546k|  if (res->width == 0) {
  ------------------
  |  Branch (305:7): [True: 0, False: 546k]
  ------------------
  306|      0|    res->neg = 0;
  307|   546k|  } else {
  308|   546k|    resp--;
  309|   546k|  }
  310|       |
  311|  3.27M|  for (int i = 0; i < loop - 1; i++, wnump--, resp--) {
  ------------------
  |  Branch (311:19): [True: 2.72M, False: 546k]
  ------------------
  312|  2.72M|    BN_ULONG q, l0;
  313|       |    // the first part of the loop uses the top two words of snum and sdiv to
  314|       |    // calculate a BN_ULONG q such that | wnum - sdiv * q | < sdiv
  315|  2.72M|    BN_ULONG n0, n1, rm = 0;
  316|       |
  317|  2.72M|    n0 = wnump[0];
  318|  2.72M|    n1 = wnump[-1];
  319|  2.72M|    if (n0 == d0) {
  ------------------
  |  Branch (319:9): [True: 10.4k, False: 2.71M]
  ------------------
  320|  10.4k|      q = BN_MASK2;
  ------------------
  |  |  154|  10.4k|#define BN_MASK2 (0xffffffffffffffffUL)
  ------------------
  321|  2.71M|    } else {
  322|       |      // n0 < d0
  323|  2.71M|      bn_div_rem_words(&q, &rm, n0, n1, d0);
  324|       |
  325|  2.71M|#ifdef BN_ULLONG
  326|  2.71M|      BN_ULLONG t2 = (BN_ULLONG)d1 * q;
  ------------------
  |  |  145|  2.71M|#define BN_ULLONG uint128_t
  ------------------
  327|  2.71M|      for (;;) {
  328|  2.71M|        if (t2 <= ((((BN_ULLONG)rm) << BN_BITS2) | wnump[-2])) {
  ------------------
  |  |  151|  2.71M|#define BN_BITS2 64
  ------------------
  |  Branch (328:13): [True: 1.88M, False: 824k]
  ------------------
  329|  1.88M|          break;
  330|  1.88M|        }
  331|   824k|        q--;
  332|   824k|        rm += d0;
  333|   824k|        if (rm < d0) {
  ------------------
  |  Branch (333:13): [True: 824k, False: 10]
  ------------------
  334|   824k|          break;  // don't let rm overflow
  335|   824k|        }
  336|     10|        t2 -= d1;
  337|     10|      }
  338|       |#else  // !BN_ULLONG
  339|       |      BN_ULONG t2l, t2h;
  340|       |      BN_UMULT_LOHI(t2l, t2h, d1, q);
  341|       |      for (;;) {
  342|       |        if (t2h < rm ||
  343|       |            (t2h == rm && t2l <= wnump[-2])) {
  344|       |          break;
  345|       |        }
  346|       |        q--;
  347|       |        rm += d0;
  348|       |        if (rm < d0) {
  349|       |          break;  // don't let rm overflow
  350|       |        }
  351|       |        if (t2l < d1) {
  352|       |          t2h--;
  353|       |        }
  354|       |        t2l -= d1;
  355|       |      }
  356|       |#endif  // !BN_ULLONG
  357|  2.71M|    }
  358|       |
  359|  2.72M|    l0 = bn_mul_words(tmp->d, sdiv->d, div_n, q);
  360|  2.72M|    tmp->d[div_n] = l0;
  361|  2.72M|    wnum.d--;
  362|       |    // ingore top values of the bignums just sub the two
  363|       |    // BN_ULONG arrays with bn_sub_words
  364|  2.72M|    if (bn_sub_words(wnum.d, wnum.d, tmp->d, div_n + 1)) {
  ------------------
  |  Branch (364:9): [True: 10.4k, False: 2.71M]
  ------------------
  365|       |      // Note: As we have considered only the leading
  366|       |      // two BN_ULONGs in the calculation of q, sdiv * q
  367|       |      // might be greater than wnum (but then (q-1) * sdiv
  368|       |      // is less or equal than wnum)
  369|  10.4k|      q--;
  370|  10.4k|      if (bn_add_words(wnum.d, wnum.d, sdiv->d, div_n)) {
  ------------------
  |  Branch (370:11): [True: 10.4k, False: 0]
  ------------------
  371|       |        // we can't have an overflow here (assuming
  372|       |        // that q != 0, but if q == 0 then tmp is
  373|       |        // zero anyway)
  374|  10.4k|        (*wnump)++;
  375|  10.4k|      }
  376|  10.4k|    }
  377|       |    // store part of the result
  378|  2.72M|    *resp = q;
  379|  2.72M|  }
  380|       |
  381|   546k|  bn_set_minimal_width(snum);
  382|       |
  383|   546k|  if (rem != NULL) {
  ------------------
  |  Branch (383:7): [True: 546k, False: 0]
  ------------------
  384|   546k|    if (!BN_rshift(rem, snum, norm_shift)) {
  ------------------
  |  Branch (384:9): [True: 0, False: 546k]
  ------------------
  385|      0|      goto err;
  386|      0|    }
  387|   546k|    if (!BN_is_zero(rem)) {
  ------------------
  |  Branch (387:9): [True: 543k, False: 2.70k]
  ------------------
  388|   543k|      rem->neg = numerator_neg;
  389|   543k|    }
  390|   546k|  }
  391|       |
  392|   546k|  bn_set_minimal_width(res);
  393|   546k|  BN_CTX_end(ctx);
  394|   546k|  return 1;
  395|       |
  396|      0|err:
  397|      0|  BN_CTX_end(ctx);
  398|      0|  return 0;
  399|   546k|}
BN_nnmod:
  401|   524k|int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx) {
  402|   524k|  if (!(BN_mod(r, m, d, ctx))) {
  ------------------
  |  |  547|   524k|  BN_div(NULL, (rem), (numerator), (divisor), (ctx))
  ------------------
  |  Branch (402:7): [True: 0, False: 524k]
  ------------------
  403|      0|    return 0;
  404|      0|  }
  405|   524k|  if (!r->neg) {
  ------------------
  |  Branch (405:7): [True: 524k, False: 0]
  ------------------
  406|   524k|    return 1;
  407|   524k|  }
  408|       |
  409|       |  // now -|d| < r < 0, so we have to set r := r + |d|.
  410|      0|  return (d->neg ? BN_sub : BN_add)(r, r, d);
  ------------------
  |  Branch (410:11): [True: 0, False: 0]
  ------------------
  411|   524k|}
bn_reduce_once:
  414|  4.33k|                        const BN_ULONG *m, size_t num) {
  415|  4.33k|  assert(r != a);
  416|       |  // |r| = |a| - |m|. |bn_sub_words| performs the bulk of the subtraction, and
  417|       |  // then we apply the borrow to |carry|.
  418|  4.33k|  carry -= bn_sub_words(r, a, m, num);
  419|       |  // We know 0 <= |a| < 2*|m|, so -|m| <= |r| < |m|.
  420|       |  //
  421|       |  // If 0 <= |r| < |m|, |r| fits in |num| words and |carry| is zero. We then
  422|       |  // wish to select |r| as the answer. Otherwise -m <= r < 0 and we wish to
  423|       |  // return |r| + |m|, or |a|. |carry| must then be -1 or all ones. In both
  424|       |  // cases, |carry| is a suitable input to |bn_select_words|.
  425|       |  //
  426|       |  // Although |carry| may be one if it was one on input and |bn_sub_words|
  427|       |  // returns zero, this would give |r| > |m|, violating our input assumptions.
  428|  4.33k|  assert(carry == 0 || carry == (BN_ULONG)-1);
  429|  4.33k|  bn_select_words(r, carry, a /* r < 0 */, r /* r >= 0 */, num);
  430|  4.33k|  return carry;
  431|  4.33k|}
bn_reduce_once_in_place:
  434|  2.75M|                                 BN_ULONG *tmp, size_t num) {
  435|       |  // See |bn_reduce_once| for why this logic works.
  436|  2.75M|  carry -= bn_sub_words(tmp, r, m, num);
  437|  2.75M|  assert(carry == 0 || carry == (BN_ULONG)-1);
  438|  2.75M|  bn_select_words(r, carry, r /* tmp < 0 */, tmp /* tmp >= 0 */, num);
  439|  2.75M|  return carry;
  440|  2.75M|}
bn_mod_sub_words:
  443|  1.03M|                      const BN_ULONG *m, BN_ULONG *tmp, size_t num) {
  444|       |  // r = a - b
  445|  1.03M|  BN_ULONG borrow = bn_sub_words(r, a, b, num);
  446|       |  // tmp = a - b + m
  447|  1.03M|  bn_add_words(tmp, r, m, num);
  448|  1.03M|  bn_select_words(r, 0 - borrow, tmp /* r < 0 */, r /* r >= 0 */, num);
  449|  1.03M|}
bn_mod_add_words:
  452|  2.75M|                      const BN_ULONG *m, BN_ULONG *tmp, size_t num) {
  453|  2.75M|  BN_ULONG carry = bn_add_words(r, a, b, num);
  454|  2.75M|  bn_reduce_once_in_place(r, carry, m, tmp, num);
  455|  2.75M|}
bn_mod_add_consttime:
  598|  1.22M|                         const BIGNUM *m, BN_CTX *ctx) {
  599|  1.22M|  BN_CTX_start(ctx);
  600|  1.22M|  a = bn_resized_from_ctx(a, m->width, ctx);
  601|  1.22M|  b = bn_resized_from_ctx(b, m->width, ctx);
  602|  1.22M|  BIGNUM *tmp = bn_scratch_space_from_ctx(m->width, ctx);
  603|  1.22M|  int ok = a != NULL && b != NULL && tmp != NULL &&
  ------------------
  |  Branch (603:12): [True: 1.22M, False: 0]
  |  Branch (603:25): [True: 1.22M, False: 0]
  |  Branch (603:38): [True: 1.22M, False: 0]
  ------------------
  604|  1.22M|           bn_wexpand(r, m->width);
  ------------------
  |  Branch (604:12): [True: 1.22M, False: 0]
  ------------------
  605|  1.22M|  if (ok) {
  ------------------
  |  Branch (605:7): [True: 1.22M, False: 0]
  ------------------
  606|  1.22M|    bn_mod_add_words(r->d, a->d, b->d, m->d, tmp->d, m->width);
  607|  1.22M|    r->width = m->width;
  608|  1.22M|    r->neg = 0;
  609|  1.22M|  }
  610|  1.22M|  BN_CTX_end(ctx);
  611|  1.22M|  return ok;
  612|  1.22M|}
bn_mod_sub_consttime:
  623|    681|                         const BIGNUM *m, BN_CTX *ctx) {
  624|    681|  BN_CTX_start(ctx);
  625|    681|  a = bn_resized_from_ctx(a, m->width, ctx);
  626|    681|  b = bn_resized_from_ctx(b, m->width, ctx);
  627|    681|  BIGNUM *tmp = bn_scratch_space_from_ctx(m->width, ctx);
  628|    681|  int ok = a != NULL && b != NULL && tmp != NULL &&
  ------------------
  |  Branch (628:12): [True: 681, False: 0]
  |  Branch (628:25): [True: 681, False: 0]
  |  Branch (628:38): [True: 681, False: 0]
  ------------------
  629|    681|           bn_wexpand(r, m->width);
  ------------------
  |  Branch (629:12): [True: 681, False: 0]
  ------------------
  630|    681|  if (ok) {
  ------------------
  |  Branch (630:7): [True: 681, False: 0]
  ------------------
  631|    681|    bn_mod_sub_words(r->d, a->d, b->d, m->d, tmp->d, m->width);
  632|    681|    r->width = m->width;
  633|    681|    r->neg = 0;
  634|    681|  }
  635|    681|  BN_CTX_end(ctx);
  636|    681|  return ok;
  637|    681|}
BN_mod_mul:
  649|   519k|               BN_CTX *ctx) {
  650|   519k|  BIGNUM *t;
  651|   519k|  int ret = 0;
  652|       |
  653|   519k|  BN_CTX_start(ctx);
  654|   519k|  t = BN_CTX_get(ctx);
  655|   519k|  if (t == NULL) {
  ------------------
  |  Branch (655:7): [True: 0, False: 519k]
  ------------------
  656|      0|    goto err;
  657|      0|  }
  658|       |
  659|   519k|  if (a == b) {
  ------------------
  |  Branch (659:7): [True: 497k, False: 21.6k]
  ------------------
  660|   497k|    if (!BN_sqr(t, a, ctx)) {
  ------------------
  |  Branch (660:9): [True: 0, False: 497k]
  ------------------
  661|      0|      goto err;
  662|      0|    }
  663|   497k|  } else {
  664|  21.6k|    if (!BN_mul(t, a, b, ctx)) {
  ------------------
  |  Branch (664:9): [True: 0, False: 21.6k]
  ------------------
  665|      0|      goto err;
  666|      0|    }
  667|  21.6k|  }
  668|       |
  669|   519k|  if (!BN_nnmod(r, t, m, ctx)) {
  ------------------
  |  Branch (669:7): [True: 0, False: 519k]
  ------------------
  670|      0|    goto err;
  671|      0|  }
  672|       |
  673|   519k|  ret = 1;
  674|       |
  675|   519k|err:
  676|   519k|  BN_CTX_end(ctx);
  677|   519k|  return ret;
  678|   519k|}
BN_mod_sqr:
  680|  21.7k|int BN_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *m, BN_CTX *ctx) {
  681|  21.7k|  if (!BN_sqr(r, a, ctx)) {
  ------------------
  |  Branch (681:7): [True: 0, False: 21.7k]
  ------------------
  682|      0|    return 0;
  683|      0|  }
  684|       |
  685|       |  // r->neg == 0,  thus we don't need BN_nnmod
  686|  21.7k|  return BN_mod(r, r, m, ctx);
  ------------------
  |  |  547|  21.7k|  BN_div(NULL, (rem), (numerator), (divisor), (ctx))
  ------------------
  687|  21.7k|}
bn_mod_lshift_consttime:
  713|  1.76k|                            BN_CTX *ctx) {
  714|  1.76k|  if (!BN_copy(r, a)) {
  ------------------
  |  Branch (714:7): [True: 0, False: 1.76k]
  ------------------
  715|      0|    return 0;
  716|      0|  }
  717|  1.22M|  for (int i = 0; i < n; i++) {
  ------------------
  |  Branch (717:19): [True: 1.22M, False: 1.76k]
  ------------------
  718|  1.22M|    if (!bn_mod_lshift1_consttime(r, r, m, ctx)) {
  ------------------
  |  Branch (718:9): [True: 0, False: 1.22M]
  ------------------
  719|      0|      return 0;
  720|      0|    }
  721|  1.22M|  }
  722|  1.76k|  return 1;
  723|  1.76k|}
bn_mod_lshift1_consttime:
  742|  1.22M|                             BN_CTX *ctx) {
  743|  1.22M|  return bn_mod_add_consttime(r, a, a, m, ctx);
  744|  1.22M|}
bcm.c:bn_div_rem_words:
  140|  2.71M|                                    BN_ULONG n0, BN_ULONG n1, BN_ULONG d0) {
  141|       |  // GCC and Clang generate function calls to |__udivdi3| and |__umoddi3| when
  142|       |  // the |BN_ULLONG|-based C code is used.
  143|       |  //
  144|       |  // GCC bugs:
  145|       |  //   * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=14224
  146|       |  //   * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=43721
  147|       |  //   * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=54183
  148|       |  //   * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58897
  149|       |  //   * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65668
  150|       |  //
  151|       |  // Clang bugs:
  152|       |  //   * https://llvm.org/bugs/show_bug.cgi?id=6397
  153|       |  //   * https://llvm.org/bugs/show_bug.cgi?id=12418
  154|       |  //
  155|       |  // These issues aren't specific to x86 and x86_64, so it might be worthwhile
  156|       |  // to add more assembly language implementations.
  157|       |#if defined(BN_CAN_USE_INLINE_ASM) && defined(OPENSSL_X86)
  158|       |  __asm__ volatile("divl %4"
  159|       |                   : "=a"(*quotient_out), "=d"(*rem_out)
  160|       |                   : "a"(n1), "d"(n0), "rm"(d0)
  161|       |                   : "cc");
  162|       |#elif defined(BN_CAN_USE_INLINE_ASM) && defined(OPENSSL_X86_64)
  163|  2.71M|  __asm__ volatile("divq %4"
  164|  2.71M|                   : "=a"(*quotient_out), "=d"(*rem_out)
  165|  2.71M|                   : "a"(n1), "d"(n0), "rm"(d0)
  166|  2.71M|                   : "cc");
  167|       |#else
  168|       |#if defined(BN_CAN_DIVIDE_ULLONG)
  169|       |  BN_ULLONG n = (((BN_ULLONG)n0) << BN_BITS2) | n1;
  170|       |  *quotient_out = (BN_ULONG)(n / d0);
  171|       |#else
  172|       |  *quotient_out = bn_div_words(n0, n1, d0);
  173|       |#endif
  174|       |  *rem_out = n1 - (*quotient_out * d0);
  175|       |#endif
  176|  2.71M|}
bcm.c:bn_resized_from_ctx:
  565|  2.45M|                                         BN_CTX *ctx) {
  566|  2.45M|  if ((size_t)bn->width >= width) {
  ------------------
  |  Branch (566:7): [True: 2.45M, False: 19]
  ------------------
  567|       |    // Any excess words must be zero.
  568|  2.45M|    assert(bn_fits_in_words(bn, width));
  569|  2.45M|    return bn;
  570|  2.45M|  }
  571|     19|  BIGNUM *ret = bn_scratch_space_from_ctx(width, ctx);
  572|     19|  if (ret == NULL ||
  ------------------
  |  Branch (572:7): [True: 0, False: 19]
  ------------------
  573|     19|      !BN_copy(ret, bn) ||
  ------------------
  |  Branch (573:7): [True: 0, False: 19]
  ------------------
  574|     19|      !bn_resize_words(ret, width)) {
  ------------------
  |  Branch (574:7): [True: 0, False: 19]
  ------------------
  575|      0|    return NULL;
  576|      0|  }
  577|     19|  return ret;
  578|     19|}
bcm.c:bn_scratch_space_from_ctx:
  548|  1.22M|static BIGNUM *bn_scratch_space_from_ctx(size_t width, BN_CTX *ctx) {
  549|  1.22M|  BIGNUM *ret = BN_CTX_get(ctx);
  550|  1.22M|  if (ret == NULL ||
  ------------------
  |  Branch (550:7): [True: 0, False: 1.22M]
  ------------------
  551|  1.22M|      !bn_wexpand(ret, width)) {
  ------------------
  |  Branch (551:7): [True: 0, False: 1.22M]
  ------------------
  552|      0|    return NULL;
  553|      0|  }
  554|  1.22M|  ret->neg = 0;
  555|  1.22M|  ret->width = (int)width;
  556|  1.22M|  return ret;
  557|  1.22M|}

BN_mod_exp_mont:
  588|    951|                    const BIGNUM *m, BN_CTX *ctx, const BN_MONT_CTX *mont) {
  589|    951|  if (!BN_is_odd(m)) {
  ------------------
  |  Branch (589:7): [True: 0, False: 951]
  ------------------
  590|      0|    OPENSSL_PUT_ERROR(BN, BN_R_CALLED_WITH_EVEN_MODULUS);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  591|      0|    return 0;
  592|      0|  }
  593|    951|  if (m->neg) {
  ------------------
  |  Branch (593:7): [True: 0, False: 951]
  ------------------
  594|      0|    OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  595|      0|    return 0;
  596|      0|  }
  597|       |  // |a| is secret, but |a < m| is not.
  598|    951|  if (a->neg || constant_time_declassify_int(BN_ucmp(a, m)) >= 0) {
  ------------------
  |  Branch (598:7): [True: 0, False: 951]
  |  Branch (598:17): [True: 0, False: 951]
  ------------------
  599|      0|    OPENSSL_PUT_ERROR(BN, BN_R_INPUT_NOT_REDUCED);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  600|      0|    return 0;
  601|      0|  }
  602|       |
  603|    951|  int bits = BN_num_bits(p);
  604|    951|  if (bits == 0) {
  ------------------
  |  Branch (604:7): [True: 0, False: 951]
  ------------------
  605|       |    // x**0 mod 1 is still zero.
  606|      0|    if (BN_abs_is_word(m, 1)) {
  ------------------
  |  Branch (606:9): [True: 0, False: 0]
  ------------------
  607|      0|      BN_zero(rr);
  608|      0|      return 1;
  609|      0|    }
  610|      0|    return BN_one(rr);
  611|      0|  }
  612|       |
  613|    951|  int ret = 0;
  614|    951|  BIGNUM *val[TABLE_SIZE];
  615|    951|  BN_MONT_CTX *new_mont = NULL;
  616|       |
  617|    951|  BN_CTX_start(ctx);
  618|    951|  BIGNUM *r = BN_CTX_get(ctx);
  619|    951|  val[0] = BN_CTX_get(ctx);
  620|    951|  if (r == NULL || val[0] == NULL) {
  ------------------
  |  Branch (620:7): [True: 0, False: 951]
  |  Branch (620:20): [True: 0, False: 951]
  ------------------
  621|      0|    goto err;
  622|      0|  }
  623|       |
  624|       |  // Allocate a montgomery context if it was not supplied by the caller.
  625|    951|  if (mont == NULL) {
  ------------------
  |  Branch (625:7): [True: 951, False: 0]
  ------------------
  626|    951|    new_mont = BN_MONT_CTX_new_consttime(m, ctx);
  627|    951|    if (new_mont == NULL) {
  ------------------
  |  Branch (627:9): [True: 0, False: 951]
  ------------------
  628|      0|      goto err;
  629|      0|    }
  630|    951|    mont = new_mont;
  631|    951|  }
  632|       |
  633|       |  // We exponentiate by looking at sliding windows of the exponent and
  634|       |  // precomputing powers of |a|. Windows may be shifted so they always end on a
  635|       |  // set bit, so only precompute odd powers. We compute val[i] = a^(2*i + 1)
  636|       |  // for i = 0 to 2^(window-1), all in Montgomery form.
  637|    951|  int window = BN_window_bits_for_exponent_size(bits);
  638|    951|  if (!BN_to_montgomery(val[0], a, mont, ctx)) {
  ------------------
  |  Branch (638:7): [True: 0, False: 951]
  ------------------
  639|      0|    goto err;
  640|      0|  }
  641|    951|  if (window > 1) {
  ------------------
  |  Branch (641:7): [True: 951, False: 0]
  ------------------
  642|    951|    BIGNUM *d = BN_CTX_get(ctx);
  643|    951|    if (d == NULL ||
  ------------------
  |  Branch (643:9): [True: 0, False: 951]
  ------------------
  644|    951|        !BN_mod_mul_montgomery(d, val[0], val[0], mont, ctx)) {
  ------------------
  |  Branch (644:9): [True: 0, False: 951]
  ------------------
  645|      0|      goto err;
  646|      0|    }
  647|  10.8k|    for (int i = 1; i < 1 << (window - 1); i++) {
  ------------------
  |  Branch (647:21): [True: 9.94k, False: 951]
  ------------------
  648|  9.94k|      val[i] = BN_CTX_get(ctx);
  649|  9.94k|      if (val[i] == NULL ||
  ------------------
  |  Branch (649:11): [True: 0, False: 9.94k]
  ------------------
  650|  9.94k|          !BN_mod_mul_montgomery(val[i], val[i - 1], d, mont, ctx)) {
  ------------------
  |  Branch (650:11): [True: 0, False: 9.94k]
  ------------------
  651|      0|        goto err;
  652|      0|      }
  653|  9.94k|    }
  654|    951|  }
  655|       |
  656|       |  // |p| is non-zero, so at least one window is non-zero. To save some
  657|       |  // multiplications, defer initializing |r| until then.
  658|    951|  int r_is_one = 1;
  659|    951|  int wstart = bits - 1;  // The top bit of the window.
  660|   112k|  for (;;) {
  661|   112k|    if (!BN_is_bit_set(p, wstart)) {
  ------------------
  |  Branch (661:9): [True: 88.0k, False: 24.5k]
  ------------------
  662|  88.0k|      if (!r_is_one && !BN_mod_mul_montgomery(r, r, r, mont, ctx)) {
  ------------------
  |  Branch (662:11): [True: 88.0k, False: 0]
  |  Branch (662:24): [True: 0, False: 88.0k]
  ------------------
  663|      0|        goto err;
  664|      0|      }
  665|  88.0k|      if (wstart == 0) {
  ------------------
  |  Branch (665:11): [True: 411, False: 87.6k]
  ------------------
  666|    411|        break;
  667|    411|      }
  668|  87.6k|      wstart--;
  669|  87.6k|      continue;
  670|  88.0k|    }
  671|       |
  672|       |    // We now have wstart on a set bit. Find the largest window we can use.
  673|  24.5k|    int wvalue = 1;
  674|  24.5k|    int wsize = 0;
  675|   105k|    for (int i = 1; i < window && i <= wstart; i++) {
  ------------------
  |  Branch (675:21): [True: 81.0k, False: 24.3k]
  |  Branch (675:35): [True: 80.7k, False: 270]
  ------------------
  676|  80.7k|      if (BN_is_bit_set(p, wstart - i)) {
  ------------------
  |  Branch (676:11): [True: 76.7k, False: 4.04k]
  ------------------
  677|  76.7k|        wvalue <<= (i - wsize);
  678|  76.7k|        wvalue |= 1;
  679|  76.7k|        wsize = i;
  680|  76.7k|      }
  681|  80.7k|    }
  682|       |
  683|       |    // Shift |r| to the end of the window.
  684|  24.5k|    if (!r_is_one) {
  ------------------
  |  Branch (684:9): [True: 23.6k, False: 951]
  ------------------
  685|   120k|      for (int i = 0; i < wsize + 1; i++) {
  ------------------
  |  Branch (685:23): [True: 97.2k, False: 23.6k]
  ------------------
  686|  97.2k|        if (!BN_mod_mul_montgomery(r, r, r, mont, ctx)) {
  ------------------
  |  Branch (686:13): [True: 0, False: 97.2k]
  ------------------
  687|      0|          goto err;
  688|      0|        }
  689|  97.2k|      }
  690|  23.6k|    }
  691|       |
  692|  24.5k|    assert(wvalue & 1);
  693|  24.5k|    assert(wvalue < (1 << window));
  694|  24.5k|    if (r_is_one) {
  ------------------
  |  Branch (694:9): [True: 951, False: 23.6k]
  ------------------
  695|    951|      if (!BN_copy(r, val[wvalue >> 1])) {
  ------------------
  |  Branch (695:11): [True: 0, False: 951]
  ------------------
  696|      0|        goto err;
  697|      0|      }
  698|  23.6k|    } else if (!BN_mod_mul_montgomery(r, r, val[wvalue >> 1], mont, ctx)) {
  ------------------
  |  Branch (698:16): [True: 0, False: 23.6k]
  ------------------
  699|      0|      goto err;
  700|      0|    }
  701|       |
  702|  24.5k|    r_is_one = 0;
  703|  24.5k|    if (wstart == wsize) {
  ------------------
  |  Branch (703:9): [True: 540, False: 24.0k]
  ------------------
  704|    540|      break;
  705|    540|    }
  706|  24.0k|    wstart -= wsize + 1;
  707|  24.0k|  }
  708|       |
  709|       |  // |p| is non-zero, so |r_is_one| must be cleared at some point.
  710|    951|  assert(!r_is_one);
  711|       |
  712|    951|  if (!BN_from_montgomery(rr, r, mont, ctx)) {
  ------------------
  |  Branch (712:7): [True: 0, False: 951]
  ------------------
  713|      0|    goto err;
  714|      0|  }
  715|    951|  ret = 1;
  716|       |
  717|    951|err:
  718|    951|  BN_MONT_CTX_free(new_mont);
  719|    951|  BN_CTX_end(ctx);
  720|    951|  return ret;
  721|    951|}
BN_mod_exp_mont_consttime:
  885|    815|                              const BN_MONT_CTX *mont) {
  886|    815|  int i, ret = 0, wvalue;
  887|    815|  BN_MONT_CTX *new_mont = NULL;
  888|       |
  889|    815|  unsigned char *powerbuf_free = NULL;
  890|    815|  size_t powerbuf_len = 0;
  891|    815|  BN_ULONG *powerbuf = NULL;
  892|       |
  893|    815|  if (!BN_is_odd(m)) {
  ------------------
  |  Branch (893:7): [True: 0, False: 815]
  ------------------
  894|      0|    OPENSSL_PUT_ERROR(BN, BN_R_CALLED_WITH_EVEN_MODULUS);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  895|      0|    return 0;
  896|      0|  }
  897|    815|  if (m->neg) {
  ------------------
  |  Branch (897:7): [True: 0, False: 815]
  ------------------
  898|      0|    OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  899|      0|    return 0;
  900|      0|  }
  901|    815|  if (a->neg || BN_ucmp(a, m) >= 0) {
  ------------------
  |  Branch (901:7): [True: 0, False: 815]
  |  Branch (901:17): [True: 0, False: 815]
  ------------------
  902|      0|    OPENSSL_PUT_ERROR(BN, BN_R_INPUT_NOT_REDUCED);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  903|      0|    return 0;
  904|      0|  }
  905|       |
  906|       |  // Use all bits stored in |p|, rather than |BN_num_bits|, so we do not leak
  907|       |  // whether the top bits are zero.
  908|    815|  int max_bits = p->width * BN_BITS2;
  ------------------
  |  |  151|    815|#define BN_BITS2 64
  ------------------
  909|    815|  int bits = max_bits;
  910|    815|  if (bits == 0) {
  ------------------
  |  Branch (910:7): [True: 0, False: 815]
  ------------------
  911|       |    // x**0 mod 1 is still zero.
  912|      0|    if (BN_abs_is_word(m, 1)) {
  ------------------
  |  Branch (912:9): [True: 0, False: 0]
  ------------------
  913|      0|      BN_zero(rr);
  914|      0|      return 1;
  915|      0|    }
  916|      0|    return BN_one(rr);
  917|      0|  }
  918|       |
  919|       |  // Allocate a montgomery context if it was not supplied by the caller.
  920|    815|  if (mont == NULL) {
  ------------------
  |  Branch (920:7): [True: 815, False: 0]
  ------------------
  921|    815|    new_mont = BN_MONT_CTX_new_consttime(m, ctx);
  922|    815|    if (new_mont == NULL) {
  ------------------
  |  Branch (922:9): [True: 0, False: 815]
  ------------------
  923|      0|      goto err;
  924|      0|    }
  925|    815|    mont = new_mont;
  926|    815|  }
  927|       |
  928|       |  // Use the width in |mont->N|, rather than the copy in |m|. The assembly
  929|       |  // implementation assumes it can use |top| to size R.
  930|    815|  int top = mont->N.width;
  931|       |
  932|    815|#if defined(OPENSSL_BN_ASM_MONT5) || defined(RSAZ_ENABLED)
  933|       |  // Share one large stack-allocated buffer between the RSAZ and non-RSAZ code
  934|       |  // paths. If we were to use separate static buffers for each then there is
  935|       |  // some chance that both large buffers would be allocated on the stack,
  936|       |  // causing the stack space requirement to be truly huge (~10KB).
  937|    815|  alignas(MOD_EXP_CTIME_ALIGN) BN_ULONG storage[MOD_EXP_CTIME_STORAGE_LEN];
  938|    815|#endif
  939|    815|#if defined(RSAZ_ENABLED)
  940|       |  // If the size of the operands allow it, perform the optimized RSAZ
  941|       |  // exponentiation. For further information see crypto/fipsmodule/bn/rsaz_exp.c
  942|       |  // and accompanying assembly modules.
  943|    815|  if (a->width == 16 && p->width == 16 && BN_num_bits(m) == 1024 &&
  ------------------
  |  Branch (943:7): [True: 230, False: 585]
  |  Branch (943:25): [True: 0, False: 230]
  |  Branch (943:43): [True: 0, False: 0]
  ------------------
  944|    815|      rsaz_avx2_preferred()) {
  ------------------
  |  Branch (944:7): [True: 0, False: 0]
  ------------------
  945|      0|    if (!bn_wexpand(rr, 16)) {
  ------------------
  |  Branch (945:9): [True: 0, False: 0]
  ------------------
  946|      0|      goto err;
  947|      0|    }
  948|      0|    RSAZ_1024_mod_exp_avx2(rr->d, a->d, p->d, m->d, mont->RR.d, mont->n0[0],
  949|      0|                           storage);
  950|      0|    rr->width = 16;
  951|      0|    rr->neg = 0;
  952|      0|    ret = 1;
  953|      0|    goto err;
  954|      0|  }
  955|    815|#endif
  956|       |
  957|       |  // Get the window size to use with size of p.
  958|    815|  int window = BN_window_bits_for_ctime_exponent_size(bits);
  ------------------
  |  |  876|    815|  ((b) > 937 ? 6 : (b) > 306 ? 5 : (b) > 89 ? 4 : (b) > 22 ? 3 : 1)
  |  |  ------------------
  |  |  |  Branch (876:4): [True: 0, False: 815]
  |  |  |  Branch (876:20): [True: 13, False: 802]
  |  |  |  Branch (876:36): [True: 6, False: 796]
  |  |  |  Branch (876:51): [True: 796, False: 0]
  |  |  ------------------
  ------------------
  959|    815|  assert(window <= BN_MAX_MOD_EXP_CTIME_WINDOW);
  960|       |
  961|       |  // Calculating |powerbuf_len| below cannot overflow because of the bound on
  962|       |  // Montgomery reduction.
  963|    815|  assert((size_t)top <= BN_MONTGOMERY_MAX_WORDS);
  964|    815|  static_assert(
  965|    815|      BN_MONTGOMERY_MAX_WORDS <=
  966|    815|          INT_MAX / sizeof(BN_ULONG) / ((1 << BN_MAX_MOD_EXP_CTIME_WINDOW) + 3),
  967|    815|      "powerbuf_len may overflow");
  968|       |
  969|    815|#if defined(OPENSSL_BN_ASM_MONT5)
  970|    815|  if (window >= 5) {
  ------------------
  |  Branch (970:7): [True: 13, False: 802]
  ------------------
  971|     13|    window = 5;  // ~5% improvement for RSA2048 sign, and even for RSA4096
  972|       |    // Reserve space for the |mont->N| copy.
  973|     13|    powerbuf_len += top * sizeof(mont->N.d[0]);
  974|     13|  }
  975|    815|#endif
  976|       |
  977|       |  // Allocate a buffer large enough to hold all of the pre-computed
  978|       |  // powers of |am|, |am| itself, and |tmp|.
  979|    815|  int num_powers = 1 << window;
  980|    815|  powerbuf_len += sizeof(m->d[0]) * top * (num_powers + 2);
  981|       |
  982|    815|#if defined(OPENSSL_BN_ASM_MONT5)
  983|    815|  if (powerbuf_len <= sizeof(storage)) {
  ------------------
  |  Branch (983:7): [True: 759, False: 56]
  ------------------
  984|    759|    powerbuf = storage;
  985|    759|  }
  986|       |  // |storage| is more than large enough to handle 1024-bit inputs.
  987|    815|  assert(powerbuf != NULL || top * BN_BITS2 > 1024);
  988|    815|#endif
  989|    815|  if (powerbuf == NULL) {
  ------------------
  |  Branch (989:7): [True: 56, False: 759]
  ------------------
  990|     56|    powerbuf_free = OPENSSL_malloc(powerbuf_len + MOD_EXP_CTIME_ALIGN);
  ------------------
  |  |  200|     56|#define MOD_EXP_CTIME_ALIGN 64
  ------------------
  991|     56|    if (powerbuf_free == NULL) {
  ------------------
  |  Branch (991:9): [True: 0, False: 56]
  ------------------
  992|      0|      goto err;
  993|      0|    }
  994|     56|    powerbuf = align_pointer(powerbuf_free, MOD_EXP_CTIME_ALIGN);
  ------------------
  |  |  200|     56|#define MOD_EXP_CTIME_ALIGN 64
  ------------------
  995|     56|  }
  996|    815|  OPENSSL_memset(powerbuf, 0, powerbuf_len);
  997|       |
  998|       |  // Place |tmp| and |am| right after powers table.
  999|    815|  BIGNUM tmp, am;
 1000|    815|  tmp.d = powerbuf + top * num_powers;
 1001|    815|  am.d = tmp.d + top;
 1002|    815|  tmp.width = am.width = 0;
 1003|    815|  tmp.dmax = am.dmax = top;
 1004|    815|  tmp.neg = am.neg = 0;
 1005|    815|  tmp.flags = am.flags = BN_FLG_STATIC_DATA;
  ------------------
  |  | 1027|    815|#define BN_FLG_STATIC_DATA 0x02
  ------------------
 1006|       |
 1007|    815|  if (!bn_one_to_montgomery(&tmp, mont, ctx) ||
  ------------------
  |  Branch (1007:7): [True: 0, False: 815]
  ------------------
 1008|    815|      !bn_resize_words(&tmp, top)) {
  ------------------
  |  Branch (1008:7): [True: 0, False: 815]
  ------------------
 1009|      0|    goto err;
 1010|      0|  }
 1011|       |
 1012|       |  // Prepare a^1 in the Montgomery domain.
 1013|    815|  assert(!a->neg);
 1014|    815|  assert(BN_ucmp(a, m) < 0);
 1015|    815|  if (!BN_to_montgomery(&am, a, mont, ctx) ||
  ------------------
  |  Branch (1015:7): [True: 0, False: 815]
  ------------------
 1016|    815|      !bn_resize_words(&am, top)) {
  ------------------
  |  Branch (1016:7): [True: 0, False: 815]
  ------------------
 1017|      0|    goto err;
 1018|      0|  }
 1019|       |
 1020|    815|#if defined(OPENSSL_BN_ASM_MONT5)
 1021|       |  // This optimization uses ideas from https://eprint.iacr.org/2011/239,
 1022|       |  // specifically optimization of cache-timing attack countermeasures,
 1023|       |  // pre-computation optimization, and Almost Montgomery Multiplication.
 1024|       |  //
 1025|       |  // The paper discusses a 4-bit window to optimize 512-bit modular
 1026|       |  // exponentiation, used in RSA-1024 with CRT, but RSA-1024 is no longer
 1027|       |  // important.
 1028|       |  //
 1029|       |  // |bn_mul_mont_gather5| and |bn_power5| implement the "almost" reduction
 1030|       |  // variant, so the values here may not be fully reduced. They are bounded by R
 1031|       |  // (i.e. they fit in |top| words), not |m|. Additionally, we pass these
 1032|       |  // "almost" reduced inputs into |bn_mul_mont|, which implements the normal
 1033|       |  // reduction variant. Given those inputs, |bn_mul_mont| may not give reduced
 1034|       |  // output, but it will still produce "almost" reduced output.
 1035|       |  //
 1036|       |  // TODO(davidben): Using "almost" reduction complicates analysis of this code,
 1037|       |  // and its interaction with other parts of the project. Determine whether this
 1038|       |  // is actually necessary for performance.
 1039|    815|  if (window == 5 && top > 1) {
  ------------------
  |  Branch (1039:7): [True: 13, False: 802]
  |  Branch (1039:22): [True: 13, False: 0]
  ------------------
 1040|       |    // Copy |mont->N| to improve cache locality.
 1041|     13|    BN_ULONG *np = am.d + top;
 1042|    564|    for (i = 0; i < top; i++) {
  ------------------
  |  Branch (1042:17): [True: 551, False: 13]
  ------------------
 1043|    551|      np[i] = mont->N.d[i];
 1044|    551|    }
 1045|       |
 1046|       |    // Fill |powerbuf| with the first 32 powers of |am|.
 1047|     13|    const BN_ULONG *n0 = mont->n0;
 1048|     13|    bn_scatter5(tmp.d, top, powerbuf, 0);
 1049|     13|    bn_scatter5(am.d, am.width, powerbuf, 1);
 1050|     13|    bn_mul_mont(tmp.d, am.d, am.d, np, n0, top);
 1051|     13|    bn_scatter5(tmp.d, top, powerbuf, 2);
 1052|       |
 1053|       |    // Square to compute powers of two.
 1054|     52|    for (i = 4; i < 32; i *= 2) {
  ------------------
  |  Branch (1054:17): [True: 39, False: 13]
  ------------------
 1055|     39|      bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
 1056|     39|      bn_scatter5(tmp.d, top, powerbuf, i);
 1057|     39|    }
 1058|       |    // Compute odd powers |i| based on |i - 1|, then all powers |i * 2^j|.
 1059|    208|    for (i = 3; i < 32; i += 2) {
  ------------------
  |  Branch (1059:17): [True: 195, False: 13]
  ------------------
 1060|    195|      bn_mul_mont_gather5(tmp.d, am.d, powerbuf, np, n0, top, i - 1);
 1061|    195|      bn_scatter5(tmp.d, top, powerbuf, i);
 1062|    338|      for (int j = 2 * i; j < 32; j *= 2) {
  ------------------
  |  Branch (1062:27): [True: 143, False: 195]
  ------------------
 1063|    143|        bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
 1064|    143|        bn_scatter5(tmp.d, top, powerbuf, j);
 1065|    143|      }
 1066|    195|    }
 1067|       |
 1068|     13|    bits--;
 1069|     78|    for (wvalue = 0, i = bits % 5; i >= 0; i--, bits--) {
  ------------------
  |  Branch (1069:36): [True: 65, False: 13]
  ------------------
 1070|     65|      wvalue = (wvalue << 1) + BN_is_bit_set(p, bits);
 1071|     65|    }
 1072|     13|    bn_gather5(tmp.d, top, powerbuf, wvalue);
 1073|       |
 1074|       |    // At this point |bits| is 4 mod 5 and at least -1. (|bits| is the first bit
 1075|       |    // that has not been read yet.)
 1076|     13|    assert(bits >= -1 && (bits == -1 || bits % 5 == 4));
 1077|       |
 1078|       |    // Scan the exponent one window at a time starting from the most
 1079|       |    // significant bits.
 1080|     13|    if (top & 7) {
  ------------------
  |  Branch (1080:9): [True: 12, False: 1]
  ------------------
 1081|    768|      while (bits >= 0) {
  ------------------
  |  Branch (1081:14): [True: 756, False: 12]
  ------------------
 1082|  4.53k|        for (wvalue = 0, i = 0; i < 5; i++, bits--) {
  ------------------
  |  Branch (1082:33): [True: 3.78k, False: 756]
  ------------------
 1083|  3.78k|          wvalue = (wvalue << 1) + BN_is_bit_set(p, bits);
 1084|  3.78k|        }
 1085|       |
 1086|    756|        bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
 1087|    756|        bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
 1088|    756|        bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
 1089|    756|        bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
 1090|    756|        bn_mul_mont(tmp.d, tmp.d, tmp.d, np, n0, top);
 1091|    756|        bn_mul_mont_gather5(tmp.d, tmp.d, powerbuf, np, n0, top, wvalue);
 1092|    756|      }
 1093|     12|    } else {
 1094|      1|      const uint8_t *p_bytes = (const uint8_t *)p->d;
 1095|      1|      assert(bits < max_bits);
 1096|       |      // |p = 0| has been handled as a special case, so |max_bits| is at least
 1097|       |      // one word.
 1098|      1|      assert(max_bits >= 64);
 1099|       |
 1100|       |      // If the first bit to be read lands in the last byte, unroll the first
 1101|       |      // iteration to avoid reading past the bounds of |p->d|. (After the first
 1102|       |      // iteration, we are guaranteed to be past the last byte.) Note |bits|
 1103|       |      // here is the top bit, inclusive.
 1104|      1|      if (bits - 4 >= max_bits - 8) {
  ------------------
  |  Branch (1104:11): [True: 0, False: 1]
  ------------------
 1105|       |        // Read five bits from |bits-4| through |bits|, inclusive.
 1106|      0|        wvalue = p_bytes[p->width * BN_BYTES - 1];
  ------------------
  |  |  152|      0|#define BN_BYTES 8
  ------------------
 1107|      0|        wvalue >>= (bits - 4) & 7;
 1108|      0|        wvalue &= 0x1f;
 1109|      0|        bits -= 5;
 1110|      0|        bn_power5(tmp.d, tmp.d, powerbuf, np, n0, top, wvalue);
 1111|      0|      }
 1112|     64|      while (bits >= 0) {
  ------------------
  |  Branch (1112:14): [True: 63, False: 1]
  ------------------
 1113|       |        // Read five bits from |bits-4| through |bits|, inclusive.
 1114|     63|        int first_bit = bits - 4;
 1115|     63|        uint16_t val;
 1116|     63|        OPENSSL_memcpy(&val, p_bytes + (first_bit >> 3), sizeof(val));
 1117|     63|        val >>= first_bit & 7;
 1118|     63|        val &= 0x1f;
 1119|     63|        bits -= 5;
 1120|     63|        bn_power5(tmp.d, tmp.d, powerbuf, np, n0, top, val);
 1121|     63|      }
 1122|      1|    }
 1123|       |    // The result is now in |tmp| in Montgomery form, but it may not be fully
 1124|       |    // reduced. This is within bounds for |BN_from_montgomery| (tmp < R <= m*R)
 1125|       |    // so it will, when converting from Montgomery form, produce a fully reduced
 1126|       |    // result.
 1127|       |    //
 1128|       |    // This differs from Figure 2 of the paper, which uses AMM(h, 1) to convert
 1129|       |    // from Montgomery form with unreduced output, followed by an extra
 1130|       |    // reduction step. In the paper's terminology, we replace steps 9 and 10
 1131|       |    // with MM(h, 1).
 1132|     13|  } else
 1133|    802|#endif
 1134|    802|  {
 1135|    802|    copy_to_prebuf(&tmp, top, powerbuf, 0, window);
 1136|    802|    copy_to_prebuf(&am, top, powerbuf, 1, window);
 1137|       |
 1138|       |    // If the window size is greater than 1, then calculate
 1139|       |    // val[i=2..2^winsize-1]. Powers are computed as a*a^(i-1)
 1140|       |    // (even powers could instead be computed as (a^(i/2))^2
 1141|       |    // to use the slight performance advantage of sqr over mul).
 1142|    802|    if (window > 1) {
  ------------------
  |  Branch (1142:9): [True: 802, False: 0]
  ------------------
 1143|    802|      if (!BN_mod_mul_montgomery(&tmp, &am, &am, mont, ctx)) {
  ------------------
  |  Branch (1143:11): [True: 0, False: 802]
  ------------------
 1144|      0|        goto err;
 1145|      0|      }
 1146|       |
 1147|    802|      copy_to_prebuf(&tmp, top, powerbuf, 2, window);
 1148|       |
 1149|  4.86k|      for (i = 3; i < num_powers; i++) {
  ------------------
  |  Branch (1149:19): [True: 4.05k, False: 802]
  ------------------
 1150|       |        // Calculate a^i = a^(i-1) * a
 1151|  4.05k|        if (!BN_mod_mul_montgomery(&tmp, &am, &tmp, mont, ctx)) {
  ------------------
  |  Branch (1151:13): [True: 0, False: 4.05k]
  ------------------
 1152|      0|          goto err;
 1153|      0|        }
 1154|       |
 1155|  4.05k|        copy_to_prebuf(&tmp, top, powerbuf, i, window);
 1156|  4.05k|      }
 1157|    802|    }
 1158|       |
 1159|    802|    bits--;
 1160|  1.62k|    for (wvalue = 0, i = bits % window; i >= 0; i--, bits--) {
  ------------------
  |  Branch (1160:41): [True: 820, False: 802]
  ------------------
 1161|    820|      wvalue = (wvalue << 1) + BN_is_bit_set(p, bits);
 1162|    820|    }
 1163|    802|    if (!copy_from_prebuf(&tmp, top, powerbuf, wvalue, window)) {
  ------------------
  |  Branch (1163:9): [True: 0, False: 802]
  ------------------
 1164|      0|      goto err;
 1165|      0|    }
 1166|       |
 1167|       |    // Scan the exponent one window at a time starting from the most
 1168|       |    // significant bits.
 1169|  17.7k|    while (bits >= 0) {
  ------------------
  |  Branch (1169:12): [True: 16.9k, False: 802]
  ------------------
 1170|  16.9k|      wvalue = 0;  // The 'value' of the window
 1171|       |
 1172|       |      // Scan the window, squaring the result as we go
 1173|  68.0k|      for (i = 0; i < window; i++, bits--) {
  ------------------
  |  Branch (1173:19): [True: 51.0k, False: 16.9k]
  ------------------
 1174|  51.0k|        if (!BN_mod_mul_montgomery(&tmp, &tmp, &tmp, mont, ctx)) {
  ------------------
  |  Branch (1174:13): [True: 0, False: 51.0k]
  ------------------
 1175|      0|          goto err;
 1176|      0|        }
 1177|  51.0k|        wvalue = (wvalue << 1) + BN_is_bit_set(p, bits);
 1178|  51.0k|      }
 1179|       |
 1180|       |      // Fetch the appropriate pre-computed value from the pre-buf
 1181|  16.9k|      if (!copy_from_prebuf(&am, top, powerbuf, wvalue, window)) {
  ------------------
  |  Branch (1181:11): [True: 0, False: 16.9k]
  ------------------
 1182|      0|        goto err;
 1183|      0|      }
 1184|       |
 1185|       |      // Multiply the result into the intermediate result
 1186|  16.9k|      if (!BN_mod_mul_montgomery(&tmp, &tmp, &am, mont, ctx)) {
  ------------------
  |  Branch (1186:11): [True: 0, False: 16.9k]
  ------------------
 1187|      0|        goto err;
 1188|      0|      }
 1189|  16.9k|    }
 1190|    802|  }
 1191|       |
 1192|       |  // Convert the final result from Montgomery to standard format. If we used the
 1193|       |  // |OPENSSL_BN_ASM_MONT5| codepath, |tmp| may not be fully reduced. It is only
 1194|       |  // bounded by R rather than |m|. However, that is still within bounds for
 1195|       |  // |BN_from_montgomery|, which implements full Montgomery reduction, not
 1196|       |  // "almost" Montgomery reduction.
 1197|    815|  if (!BN_from_montgomery(rr, &tmp, mont, ctx)) {
  ------------------
  |  Branch (1197:7): [True: 0, False: 815]
  ------------------
 1198|      0|    goto err;
 1199|      0|  }
 1200|    815|  ret = 1;
 1201|       |
 1202|    815|err:
 1203|    815|  BN_MONT_CTX_free(new_mont);
 1204|    815|  if (powerbuf != NULL && powerbuf_free == NULL) {
  ------------------
  |  Branch (1204:7): [True: 815, False: 0]
  |  Branch (1204:27): [True: 759, False: 56]
  ------------------
 1205|    759|    OPENSSL_cleanse(powerbuf, powerbuf_len);
 1206|    759|  }
 1207|    815|  OPENSSL_free(powerbuf_free);
 1208|    815|  return ret;
 1209|    815|}
bcm.c:BN_window_bits_for_exponent_size:
  400|    951|static int BN_window_bits_for_exponent_size(size_t b) {
  401|    951|  if (b > 671) {
  ------------------
  |  Branch (401:7): [True: 0, False: 951]
  ------------------
  402|      0|    return 6;
  403|      0|  }
  404|    951|  if (b > 239) {
  ------------------
  |  Branch (404:7): [True: 411, False: 540]
  ------------------
  405|    411|    return 5;
  406|    411|  }
  407|    540|  if (b > 79) {
  ------------------
  |  Branch (407:7): [True: 540, False: 0]
  ------------------
  408|    540|    return 4;
  409|    540|  }
  410|      0|  if (b > 23) {
  ------------------
  |  Branch (410:7): [True: 0, False: 0]
  ------------------
  411|      0|    return 3;
  412|      0|  }
  413|      0|  return 1;
  414|      0|}
bcm.c:copy_to_prebuf:
  840|  6.46k|                           int window) {
  841|  6.46k|  int ret = bn_copy_words(table + idx * top, top, b);
  842|  6.46k|  assert(ret);  // |b| is guaranteed to fit.
  843|  6.46k|  (void)ret;
  844|  6.46k|}
bcm.c:copy_from_prebuf:
  847|  17.7k|                            int window) {
  848|  17.7k|  if (!bn_wexpand(b, top)) {
  ------------------
  |  Branch (848:7): [True: 0, False: 17.7k]
  ------------------
  849|      0|    return 0;
  850|      0|  }
  851|       |
  852|  17.7k|  OPENSSL_memset(b->d, 0, sizeof(BN_ULONG) * top);
  853|  17.7k|  const int width = 1 << window;
  854|   161k|  for (int i = 0; i < width; i++, table += top) {
  ------------------
  |  Branch (854:19): [True: 143k, False: 17.7k]
  ------------------
  855|       |    // Use a value barrier to prevent Clang from adding a branch when |i != idx|
  856|       |    // and making this copy not constant time. Clang is still allowed to learn
  857|       |    // that |mask| is constant across the inner loop, so this won't inhibit any
  858|       |    // vectorization it might do.
  859|   143k|    BN_ULONG mask = value_barrier_w(constant_time_eq_int(i, idx));
  860|  2.62M|    for (int j = 0; j < top; j++) {
  ------------------
  |  Branch (860:21): [True: 2.48M, False: 143k]
  ------------------
  861|  2.48M|      b->d[j] |= table[j] & mask;
  862|  2.48M|    }
  863|   143k|  }
  864|       |
  865|  17.7k|  b->width = top;
  866|  17.7k|  return 1;
  867|  17.7k|}

bn_jacobi:
   63|  2.70k|int bn_jacobi(const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
   64|       |  // In 'tab', only odd-indexed entries are relevant:
   65|       |  // For any odd BIGNUM n,
   66|       |  //     tab[BN_lsw(n) & 7]
   67|       |  // is $(-1)^{(n^2-1)/8}$ (using TeX notation).
   68|       |  // Note that the sign of n does not matter.
   69|  2.70k|  static const int tab[8] = {0, 1, 0, -1, 0, -1, 0, 1};
   70|       |
   71|       |  // The Jacobi symbol is only defined for odd modulus.
   72|  2.70k|  if (!BN_is_odd(b)) {
  ------------------
  |  Branch (72:7): [True: 0, False: 2.70k]
  ------------------
   73|      0|    OPENSSL_PUT_ERROR(BN, BN_R_CALLED_WITH_EVEN_MODULUS);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   74|      0|    return -2;
   75|      0|  }
   76|       |
   77|       |  // Require b be positive.
   78|  2.70k|  if (BN_is_negative(b)) {
  ------------------
  |  Branch (78:7): [True: 0, False: 2.70k]
  ------------------
   79|      0|    OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   80|      0|    return -2;
   81|      0|  }
   82|       |
   83|  2.70k|  int ret = -2;
   84|  2.70k|  BN_CTX_start(ctx);
   85|  2.70k|  BIGNUM *A = BN_CTX_get(ctx);
   86|  2.70k|  BIGNUM *B = BN_CTX_get(ctx);
   87|  2.70k|  if (B == NULL) {
  ------------------
  |  Branch (87:7): [True: 0, False: 2.70k]
  ------------------
   88|      0|    goto end;
   89|      0|  }
   90|       |
   91|  2.70k|  if (!BN_copy(A, a) ||
  ------------------
  |  Branch (91:7): [True: 0, False: 2.70k]
  ------------------
   92|  2.70k|      !BN_copy(B, b)) {
  ------------------
  |  Branch (92:7): [True: 0, False: 2.70k]
  ------------------
   93|      0|    goto end;
   94|      0|  }
   95|       |
   96|       |  // Adapted from logic to compute the Kronecker symbol, originally implemented
   97|       |  // according to Henri Cohen, "A Course in Computational Algebraic Number
   98|       |  // Theory" (algorithm 1.4.10).
   99|       |
  100|  2.70k|  ret = 1;
  101|       |
  102|  7.29k|  while (1) {
  ------------------
  |  Branch (102:10): [Folded - Ignored]
  ------------------
  103|       |    // Cohen's step 3:
  104|       |
  105|       |    // B is positive and odd
  106|  7.29k|    if (BN_is_zero(A)) {
  ------------------
  |  Branch (106:9): [True: 2.70k, False: 4.59k]
  ------------------
  107|  2.70k|      ret = BN_is_one(B) ? ret : 0;
  ------------------
  |  Branch (107:13): [True: 2.70k, False: 0]
  ------------------
  108|  2.70k|      goto end;
  109|  2.70k|    }
  110|       |
  111|       |    // now A is non-zero
  112|  4.59k|    int i = 0;
  113|  8.64k|    while (!BN_is_bit_set(A, i)) {
  ------------------
  |  Branch (113:12): [True: 4.05k, False: 4.59k]
  ------------------
  114|  4.05k|      i++;
  115|  4.05k|    }
  116|  4.59k|    if (!BN_rshift(A, A, i)) {
  ------------------
  |  Branch (116:9): [True: 0, False: 4.59k]
  ------------------
  117|      0|      ret = -2;
  118|      0|      goto end;
  119|      0|    }
  120|  4.59k|    if (i & 1) {
  ------------------
  |  Branch (120:9): [True: 1.35k, False: 3.24k]
  ------------------
  121|       |      // i is odd
  122|       |      // multiply 'ret' by  $(-1)^{(B^2-1)/8}$
  123|  1.35k|      ret = ret * tab[BN_lsw(B) & 7];
  ------------------
  |  |   61|  1.35k|#define BN_lsw(n) (((n)->width == 0) ? (BN_ULONG) 0 : (n)->d[0])
  |  |  ------------------
  |  |  |  Branch (61:20): [True: 0, False: 1.35k]
  |  |  ------------------
  ------------------
  124|  1.35k|    }
  125|       |
  126|       |    // Cohen's step 4:
  127|       |    // multiply 'ret' by  $(-1)^{(A-1)(B-1)/4}$
  128|  4.59k|    if ((A->neg ? ~BN_lsw(A) : BN_lsw(A)) & BN_lsw(B) & 2) {
  ------------------
  |  |   61|      0|#define BN_lsw(n) (((n)->width == 0) ? (BN_ULONG) 0 : (n)->d[0])
  |  |  ------------------
  |  |  |  Branch (61:20): [True: 0, False: 0]
  |  |  ------------------
  ------------------
                  if ((A->neg ? ~BN_lsw(A) : BN_lsw(A)) & BN_lsw(B) & 2) {
  ------------------
  |  |   61|  4.59k|#define BN_lsw(n) (((n)->width == 0) ? (BN_ULONG) 0 : (n)->d[0])
  |  |  ------------------
  |  |  |  Branch (61:20): [True: 0, False: 4.59k]
  |  |  ------------------
  ------------------
                  if ((A->neg ? ~BN_lsw(A) : BN_lsw(A)) & BN_lsw(B) & 2) {
  ------------------
  |  |   61|  4.59k|#define BN_lsw(n) (((n)->width == 0) ? (BN_ULONG) 0 : (n)->d[0])
  |  |  ------------------
  |  |  |  Branch (61:20): [True: 0, False: 4.59k]
  |  |  ------------------
  ------------------
  |  Branch (128:9): [True: 0, False: 4.59k]
  |  Branch (128:10): [True: 0, False: 4.59k]
  ------------------
  129|      0|      ret = -ret;
  130|      0|    }
  131|       |
  132|       |    // (A, B) := (B mod |A|, |A|)
  133|  4.59k|    if (!BN_nnmod(B, B, A, ctx)) {
  ------------------
  |  Branch (133:9): [True: 0, False: 4.59k]
  ------------------
  134|      0|      ret = -2;
  135|      0|      goto end;
  136|      0|    }
  137|  4.59k|    BIGNUM *tmp = A;
  138|  4.59k|    A = B;
  139|  4.59k|    B = tmp;
  140|  4.59k|    tmp->neg = 0;
  141|  4.59k|  }
  142|       |
  143|  2.70k|end:
  144|  2.70k|  BN_CTX_end(ctx);
  145|  2.70k|  return ret;
  146|  2.70k|}

BN_MONT_CTX_new:
  124|  1.77k|BN_MONT_CTX *BN_MONT_CTX_new(void) {
  125|  1.77k|  BN_MONT_CTX *ret = OPENSSL_malloc(sizeof(BN_MONT_CTX));
  126|       |
  127|  1.77k|  if (ret == NULL) {
  ------------------
  |  Branch (127:7): [True: 0, False: 1.77k]
  ------------------
  128|      0|    return NULL;
  129|      0|  }
  130|       |
  131|  1.77k|  OPENSSL_memset(ret, 0, sizeof(BN_MONT_CTX));
  132|  1.77k|  BN_init(&ret->RR);
  133|  1.77k|  BN_init(&ret->N);
  134|       |
  135|  1.77k|  return ret;
  136|  1.77k|}
BN_MONT_CTX_free:
  138|  6.26k|void BN_MONT_CTX_free(BN_MONT_CTX *mont) {
  139|  6.26k|  if (mont == NULL) {
  ------------------
  |  Branch (139:7): [True: 4.50k, False: 1.76k]
  ------------------
  140|  4.50k|    return;
  141|  4.50k|  }
  142|       |
  143|  1.76k|  BN_free(&mont->RR);
  144|  1.76k|  BN_free(&mont->N);
  145|  1.76k|  OPENSSL_free(mont);
  146|  1.76k|}
BN_MONT_CTX_set:
  210|      7|int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx) {
  211|      7|  if (!bn_mont_ctx_set_N_and_n0(mont, mod)) {
  ------------------
  |  Branch (211:7): [True: 0, False: 7]
  ------------------
  212|      0|    return 0;
  213|      0|  }
  214|       |
  215|      7|  BN_CTX *new_ctx = NULL;
  216|      7|  if (ctx == NULL) {
  ------------------
  |  Branch (216:7): [True: 4, False: 3]
  ------------------
  217|      4|    new_ctx = BN_CTX_new();
  218|      4|    if (new_ctx == NULL) {
  ------------------
  |  Branch (218:9): [True: 0, False: 4]
  ------------------
  219|      0|      return 0;
  220|      0|    }
  221|      4|    ctx = new_ctx;
  222|      4|  }
  223|       |
  224|       |  // Save RR = R**2 (mod N). R is the smallest power of 2**BN_BITS2 such that R
  225|       |  // > mod. Even though the assembly on some 32-bit platforms works with 64-bit
  226|       |  // values, using |BN_BITS2| here, rather than |BN_MONT_CTX_N0_LIMBS *
  227|       |  // BN_BITS2|, is correct because R**2 will still be a multiple of the latter
  228|       |  // as |BN_MONT_CTX_N0_LIMBS| is either one or two.
  229|      7|  unsigned lgBigR = mont->N.width * BN_BITS2;
  ------------------
  |  |  151|      7|#define BN_BITS2 64
  ------------------
  230|      7|  BN_zero(&mont->RR);
  231|      7|  int ok = BN_set_bit(&mont->RR, lgBigR * 2) &&
  ------------------
  |  Branch (231:12): [True: 7, False: 0]
  ------------------
  232|      7|           BN_mod(&mont->RR, &mont->RR, &mont->N, ctx) &&
  ------------------
  |  |  547|     14|  BN_div(NULL, (rem), (numerator), (divisor), (ctx))
  |  |  ------------------
  |  |  |  Branch (547:3): [True: 7, False: 0]
  |  |  ------------------
  ------------------
  233|      7|           bn_resize_words(&mont->RR, mont->N.width);
  ------------------
  |  Branch (233:12): [True: 7, False: 0]
  ------------------
  234|      7|  BN_CTX_free(new_ctx);
  235|      7|  return ok;
  236|      7|}
BN_MONT_CTX_new_for_modulus:
  238|      7|BN_MONT_CTX *BN_MONT_CTX_new_for_modulus(const BIGNUM *mod, BN_CTX *ctx) {
  239|      7|  BN_MONT_CTX *mont = BN_MONT_CTX_new();
  240|      7|  if (mont == NULL ||
  ------------------
  |  Branch (240:7): [True: 0, False: 7]
  ------------------
  241|      7|      !BN_MONT_CTX_set(mont, mod, ctx)) {
  ------------------
  |  Branch (241:7): [True: 0, False: 7]
  ------------------
  242|      0|    BN_MONT_CTX_free(mont);
  243|      0|    return NULL;
  244|      0|  }
  245|      7|  return mont;
  246|      7|}
BN_MONT_CTX_new_consttime:
  248|  1.76k|BN_MONT_CTX *BN_MONT_CTX_new_consttime(const BIGNUM *mod, BN_CTX *ctx) {
  249|  1.76k|  BN_MONT_CTX *mont = BN_MONT_CTX_new();
  250|  1.76k|  if (mont == NULL ||
  ------------------
  |  Branch (250:7): [True: 0, False: 1.76k]
  ------------------
  251|  1.76k|      !bn_mont_ctx_set_N_and_n0(mont, mod)) {
  ------------------
  |  Branch (251:7): [True: 0, False: 1.76k]
  ------------------
  252|      0|    goto err;
  253|      0|  }
  254|  1.76k|  unsigned lgBigR = mont->N.width * BN_BITS2;
  ------------------
  |  |  151|  1.76k|#define BN_BITS2 64
  ------------------
  255|  1.76k|  if (!bn_mod_exp_base_2_consttime(&mont->RR, lgBigR * 2, &mont->N, ctx) ||
  ------------------
  |  Branch (255:7): [True: 0, False: 1.76k]
  ------------------
  256|  1.76k|      !bn_resize_words(&mont->RR, mont->N.width)) {
  ------------------
  |  Branch (256:7): [True: 0, False: 1.76k]
  ------------------
  257|      0|    goto err;
  258|      0|  }
  259|  1.76k|  return mont;
  260|       |
  261|      0|err:
  262|      0|  BN_MONT_CTX_free(mont);
  263|      0|  return NULL;
  264|  1.76k|}
BN_to_montgomery:
  286|  1.76k|                     BN_CTX *ctx) {
  287|  1.76k|  return BN_mod_mul_montgomery(ret, a, &mont->RR, mont, ctx);
  288|  1.76k|}
BN_from_montgomery:
  346|  2.44k|                       BN_CTX *ctx) {
  347|  2.44k|  int ret = 0;
  348|  2.44k|  BIGNUM *t;
  349|       |
  350|  2.44k|  BN_CTX_start(ctx);
  351|  2.44k|  t = BN_CTX_get(ctx);
  352|  2.44k|  if (t == NULL ||
  ------------------
  |  Branch (352:7): [True: 0, False: 2.44k]
  ------------------
  353|  2.44k|      !BN_copy(t, a)) {
  ------------------
  |  Branch (353:7): [True: 0, False: 2.44k]
  ------------------
  354|      0|    goto err;
  355|      0|  }
  356|       |
  357|  2.44k|  ret = BN_from_montgomery_word(r, t, mont);
  358|       |
  359|  2.44k|err:
  360|  2.44k|  BN_CTX_end(ctx);
  361|       |
  362|  2.44k|  return ret;
  363|  2.44k|}
bn_one_to_montgomery:
  365|    815|int bn_one_to_montgomery(BIGNUM *r, const BN_MONT_CTX *mont, BN_CTX *ctx) {
  366|       |  // If the high bit of |n| is set, R = 2^(width*BN_BITS2) < 2 * |n|, so we
  367|       |  // compute R - |n| rather than perform Montgomery reduction.
  368|    815|  const BIGNUM *n = &mont->N;
  369|    815|  if (n->width > 0 && (n->d[n->width - 1] >> (BN_BITS2 - 1)) != 0) {
  ------------------
  |  |  151|    815|#define BN_BITS2 64
  ------------------
  |  Branch (369:7): [True: 815, False: 0]
  |  Branch (369:23): [True: 139, False: 676]
  ------------------
  370|    139|    if (!bn_wexpand(r, n->width)) {
  ------------------
  |  Branch (370:9): [True: 0, False: 139]
  ------------------
  371|      0|      return 0;
  372|      0|    }
  373|    139|    r->d[0] = 0 - n->d[0];
  374|  1.77k|    for (int i = 1; i < n->width; i++) {
  ------------------
  |  Branch (374:21): [True: 1.63k, False: 139]
  ------------------
  375|  1.63k|      r->d[i] = ~n->d[i];
  376|  1.63k|    }
  377|    139|    r->width = n->width;
  378|    139|    r->neg = 0;
  379|    139|    return 1;
  380|    139|  }
  381|       |
  382|    676|  return BN_from_montgomery(r, &mont->RR, mont, ctx);
  383|    815|}
BN_mod_mul_montgomery:
  420|   294k|                          const BN_MONT_CTX *mont, BN_CTX *ctx) {
  421|   294k|  if (a->neg || b->neg) {
  ------------------
  |  Branch (421:7): [True: 0, False: 294k]
  |  Branch (421:17): [True: 0, False: 294k]
  ------------------
  422|      0|    OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  423|      0|    return 0;
  424|      0|  }
  425|       |
  426|   294k|#if defined(OPENSSL_BN_ASM_MONT)
  427|       |  // |bn_mul_mont| requires at least 128 bits of limbs, at least for x86.
  428|   294k|  int num = mont->N.width;
  429|   294k|  if (num >= (128 / BN_BITS2) &&
  ------------------
  |  |  151|   294k|#define BN_BITS2 64
  ------------------
  |  Branch (429:7): [True: 294k, False: 0]
  ------------------
  430|   294k|      a->width == num &&
  ------------------
  |  Branch (430:7): [True: 293k, False: 1.07k]
  ------------------
  431|   294k|      b->width == num) {
  ------------------
  |  Branch (431:7): [True: 293k, False: 0]
  ------------------
  432|   293k|    if (!bn_wexpand(r, num)) {
  ------------------
  |  Branch (432:9): [True: 0, False: 293k]
  ------------------
  433|      0|      return 0;
  434|      0|    }
  435|       |    // This bound is implied by |bn_mont_ctx_set_N_and_n0|. |bn_mul_mont|
  436|       |    // allocates |num| words on the stack, so |num| cannot be too large.
  437|   293k|    assert((size_t)num <= BN_MONTGOMERY_MAX_WORDS);
  438|   293k|    if (!bn_mul_mont(r->d, a->d, b->d, mont->N.d, mont->n0, num)) {
  ------------------
  |  Branch (438:9): [True: 0, False: 293k]
  ------------------
  439|       |      // The check above ensures this won't happen.
  440|      0|      assert(0);
  441|      0|      OPENSSL_PUT_ERROR(BN, ERR_R_INTERNAL_ERROR);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  442|      0|      return 0;
  443|      0|    }
  444|   293k|    r->neg = 0;
  445|   293k|    r->width = num;
  446|   293k|    return 1;
  447|   293k|  }
  448|  1.07k|#endif
  449|       |
  450|  1.07k|  return bn_mod_mul_montgomery_fallback(r, a, b, mont, ctx);
  451|   294k|}
bn_to_montgomery_small:
  459|    552|                            const BN_MONT_CTX *mont) {
  460|    552|  bn_mod_mul_montgomery_small(r, a, mont->RR.d, num, mont);
  461|    552|}
bn_from_montgomery_small:
  464|    822|                              size_t num_a, const BN_MONT_CTX *mont) {
  465|    822|  if (num_r != (size_t)mont->N.width || num_r > BN_SMALL_MAX_WORDS ||
  ------------------
  |  |  684|  1.64k|#define BN_SMALL_MAX_WORDS 9
  ------------------
  |  Branch (465:7): [True: 0, False: 822]
  |  Branch (465:41): [True: 0, False: 822]
  ------------------
  466|    822|      num_a > 2 * num_r) {
  ------------------
  |  Branch (466:7): [True: 0, False: 822]
  ------------------
  467|      0|    abort();
  468|      0|  }
  469|    822|  BN_ULONG tmp[BN_SMALL_MAX_WORDS * 2] = {0};
  470|    822|  OPENSSL_memcpy(tmp, a, num_a * sizeof(BN_ULONG));
  471|    822|  if (!bn_from_montgomery_in_place(r, num_r, tmp, 2 * num_r, mont)) {
  ------------------
  |  Branch (471:7): [True: 0, False: 822]
  ------------------
  472|      0|    abort();
  473|      0|  }
  474|    822|  OPENSSL_cleanse(tmp, 2 * num_r * sizeof(BN_ULONG));
  475|    822|}
bn_mod_mul_montgomery_small:
  479|  1.66M|                                 const BN_MONT_CTX *mont) {
  480|  1.66M|  if (num != (size_t)mont->N.width || num > BN_SMALL_MAX_WORDS) {
  ------------------
  |  |  684|  1.66M|#define BN_SMALL_MAX_WORDS 9
  ------------------
  |  Branch (480:7): [True: 0, False: 1.66M]
  |  Branch (480:39): [True: 0, False: 1.66M]
  ------------------
  481|      0|    abort();
  482|      0|  }
  483|       |
  484|  1.66M|#if defined(OPENSSL_BN_ASM_MONT)
  485|       |  // |bn_mul_mont| requires at least 128 bits of limbs, at least for x86.
  486|  1.66M|  if (num >= (128 / BN_BITS2)) {
  ------------------
  |  |  151|  1.66M|#define BN_BITS2 64
  ------------------
  |  Branch (486:7): [True: 1.66M, False: 0]
  ------------------
  487|  1.66M|    if (!bn_mul_mont(r, a, b, mont->N.d, mont->n0, num)) {
  ------------------
  |  Branch (487:9): [True: 0, False: 1.66M]
  ------------------
  488|      0|      abort();  // The check above ensures this won't happen.
  489|      0|    }
  490|  1.66M|    return;
  491|  1.66M|  }
  492|      0|#endif
  493|       |
  494|       |  // Compute the product.
  495|      0|  BN_ULONG tmp[2 * BN_SMALL_MAX_WORDS];
  496|      0|  if (a == b) {
  ------------------
  |  Branch (496:7): [True: 0, False: 0]
  ------------------
  497|      0|    bn_sqr_small(tmp, 2 * num, a, num);
  498|      0|  } else {
  499|      0|    bn_mul_small(tmp, 2 * num, a, num, b, num);
  500|      0|  }
  501|       |
  502|       |  // Reduce.
  503|      0|  if (!bn_from_montgomery_in_place(r, num, tmp, 2 * num, mont)) {
  ------------------
  |  Branch (503:7): [True: 0, False: 0]
  ------------------
  504|      0|    abort();
  505|      0|  }
  506|      0|  OPENSSL_cleanse(tmp, 2 * num * sizeof(BN_ULONG));
  507|      0|}
bcm.c:bn_mont_ctx_set_N_and_n0:
  162|  1.77k|static int bn_mont_ctx_set_N_and_n0(BN_MONT_CTX *mont, const BIGNUM *mod) {
  163|  1.77k|  if (BN_is_zero(mod)) {
  ------------------
  |  Branch (163:7): [True: 0, False: 1.77k]
  ------------------
  164|      0|    OPENSSL_PUT_ERROR(BN, BN_R_DIV_BY_ZERO);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  165|      0|    return 0;
  166|      0|  }
  167|  1.77k|  if (!BN_is_odd(mod)) {
  ------------------
  |  Branch (167:7): [True: 0, False: 1.77k]
  ------------------
  168|      0|    OPENSSL_PUT_ERROR(BN, BN_R_CALLED_WITH_EVEN_MODULUS);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  169|      0|    return 0;
  170|      0|  }
  171|  1.77k|  if (BN_is_negative(mod)) {
  ------------------
  |  Branch (171:7): [True: 0, False: 1.77k]
  ------------------
  172|      0|    OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  173|      0|    return 0;
  174|      0|  }
  175|  1.77k|  if (!bn_fits_in_words(mod, BN_MONTGOMERY_MAX_WORDS)) {
  ------------------
  |  |  363|  1.77k|#define BN_MONTGOMERY_MAX_WORDS (8 * 1024 / sizeof(BN_ULONG))
  ------------------
  |  Branch (175:7): [True: 0, False: 1.77k]
  ------------------
  176|      0|    OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  177|      0|    return 0;
  178|      0|  }
  179|       |
  180|       |  // Save the modulus.
  181|  1.77k|  if (!BN_copy(&mont->N, mod)) {
  ------------------
  |  Branch (181:7): [True: 0, False: 1.77k]
  ------------------
  182|      0|    OPENSSL_PUT_ERROR(BN, ERR_R_INTERNAL_ERROR);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  183|      0|    return 0;
  184|      0|  }
  185|       |  // |mont->N| is always stored minimally. Computing RR efficiently leaks the
  186|       |  // size of the modulus. While the modulus may be private in RSA (one of the
  187|       |  // primes), their sizes are public, so this is fine.
  188|  1.77k|  bn_set_minimal_width(&mont->N);
  189|       |
  190|       |  // Find n0 such that n0 * N == -1 (mod r).
  191|       |  //
  192|       |  // Only certain BN_BITS2<=32 platforms actually make use of n0[1]. For the
  193|       |  // others, we could use a shorter R value and use faster |BN_ULONG|-based
  194|       |  // math instead of |uint64_t|-based math, which would be double-precision.
  195|       |  // However, currently only the assembler files know which is which.
  196|  1.77k|  static_assert(BN_MONT_CTX_N0_LIMBS == 1 || BN_MONT_CTX_N0_LIMBS == 2,
  197|  1.77k|                "BN_MONT_CTX_N0_LIMBS value is invalid");
  198|  1.77k|  static_assert(sizeof(BN_ULONG) * BN_MONT_CTX_N0_LIMBS == sizeof(uint64_t),
  199|  1.77k|                "uint64_t is insufficient precision for n0");
  200|  1.77k|  uint64_t n0 = bn_mont_n0(&mont->N);
  201|  1.77k|  mont->n0[0] = (BN_ULONG)n0;
  202|       |#if BN_MONT_CTX_N0_LIMBS == 2
  203|       |  mont->n0[1] = (BN_ULONG)(n0 >> BN_BITS2);
  204|       |#else
  205|  1.77k|  mont->n0[1] = 0;
  206|  1.77k|#endif
  207|  1.77k|  return 1;
  208|  1.77k|}
bcm.c:BN_from_montgomery_word:
  322|  3.51k|                                   const BN_MONT_CTX *mont) {
  323|  3.51k|  if (r->neg) {
  ------------------
  |  Branch (323:7): [True: 0, False: 3.51k]
  ------------------
  324|      0|    OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  325|      0|    return 0;
  326|      0|  }
  327|       |
  328|  3.51k|  const BIGNUM *n = &mont->N;
  329|  3.51k|  if (n->width == 0) {
  ------------------
  |  Branch (329:7): [True: 0, False: 3.51k]
  ------------------
  330|      0|    ret->width = 0;
  331|      0|    return 1;
  332|      0|  }
  333|       |
  334|  3.51k|  int max = 2 * n->width;  // carry is stored separately
  335|  3.51k|  if (!bn_resize_words(r, max) ||
  ------------------
  |  Branch (335:7): [True: 0, False: 3.51k]
  ------------------
  336|  3.51k|      !bn_wexpand(ret, n->width)) {
  ------------------
  |  Branch (336:7): [True: 0, False: 3.51k]
  ------------------
  337|      0|    return 0;
  338|      0|  }
  339|       |
  340|  3.51k|  ret->width = n->width;
  341|  3.51k|  ret->neg = 0;
  342|  3.51k|  return bn_from_montgomery_in_place(ret->d, ret->width, r->d, r->width, mont);
  343|  3.51k|}
bcm.c:bn_mod_mul_montgomery_fallback:
  388|  1.07k|                                          BN_CTX *ctx) {
  389|  1.07k|  int ret = 0;
  390|       |
  391|  1.07k|  BN_CTX_start(ctx);
  392|  1.07k|  BIGNUM *tmp = BN_CTX_get(ctx);
  393|  1.07k|  if (tmp == NULL) {
  ------------------
  |  Branch (393:7): [True: 0, False: 1.07k]
  ------------------
  394|      0|    goto err;
  395|      0|  }
  396|       |
  397|  1.07k|  if (a == b) {
  ------------------
  |  Branch (397:7): [True: 0, False: 1.07k]
  ------------------
  398|      0|    if (!bn_sqr_consttime(tmp, a, ctx)) {
  ------------------
  |  Branch (398:9): [True: 0, False: 0]
  ------------------
  399|      0|      goto err;
  400|      0|    }
  401|  1.07k|  } else {
  402|  1.07k|    if (!bn_mul_consttime(tmp, a, b, ctx)) {
  ------------------
  |  Branch (402:9): [True: 0, False: 1.07k]
  ------------------
  403|      0|      goto err;
  404|      0|    }
  405|  1.07k|  }
  406|       |
  407|       |  // reduce from aRR to aR
  408|  1.07k|  if (!BN_from_montgomery_word(r, tmp, mont)) {
  ------------------
  |  Branch (408:7): [True: 0, False: 1.07k]
  ------------------
  409|      0|    goto err;
  410|      0|  }
  411|       |
  412|  1.07k|  ret = 1;
  413|       |
  414|  1.07k|err:
  415|  1.07k|  BN_CTX_end(ctx);
  416|  1.07k|  return ret;
  417|  1.07k|}
bcm.c:bn_from_montgomery_in_place:
  291|  4.33k|                                       size_t num_a, const BN_MONT_CTX *mont) {
  292|  4.33k|  const BN_ULONG *n = mont->N.d;
  293|  4.33k|  size_t num_n = mont->N.width;
  294|  4.33k|  if (num_r != num_n || num_a != 2 * num_n) {
  ------------------
  |  Branch (294:7): [True: 0, False: 4.33k]
  |  Branch (294:25): [True: 0, False: 4.33k]
  ------------------
  295|      0|    OPENSSL_PUT_ERROR(BN, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  296|      0|    return 0;
  297|      0|  }
  298|       |
  299|       |  // Add multiples of |n| to |r| until R = 2^(nl * BN_BITS2) divides it. On
  300|       |  // input, we had |r| < |n| * R, so now |r| < 2 * |n| * R. Note that |r|
  301|       |  // includes |carry| which is stored separately.
  302|  4.33k|  BN_ULONG n0 = mont->n0[0];
  303|  4.33k|  BN_ULONG carry = 0;
  304|  54.5k|  for (size_t i = 0; i < num_n; i++) {
  ------------------
  |  Branch (304:22): [True: 50.2k, False: 4.33k]
  ------------------
  305|  50.2k|    BN_ULONG v = bn_mul_add_words(a + i, n, num_n, a[i] * n0);
  306|  50.2k|    v += carry + a[i + num_n];
  307|  50.2k|    carry |= (v != a[i + num_n]);
  308|  50.2k|    carry &= (v <= a[i + num_n]);
  309|  50.2k|    a[i + num_n] = v;
  310|  50.2k|  }
  311|       |
  312|       |  // Shift |num_n| words to divide by R. We have |a| < 2 * |n|. Note that |a|
  313|       |  // includes |carry| which is stored separately.
  314|  4.33k|  a += num_n;
  315|       |
  316|       |  // |a| thus requires at most one additional subtraction |n| to be reduced.
  317|  4.33k|  bn_reduce_once(r, a, carry, n, num_n);
  318|  4.33k|  return 1;
  319|  4.33k|}

bn_mont_n0:
   33|  1.77k|uint64_t bn_mont_n0(const BIGNUM *n) {
   34|       |  // These conditions are checked by the caller, |BN_MONT_CTX_set| or
   35|       |  // |BN_MONT_CTX_new_consttime|.
   36|  1.77k|  assert(!BN_is_zero(n));
   37|  1.77k|  assert(!BN_is_negative(n));
   38|  1.77k|  assert(BN_is_odd(n));
   39|       |
   40|       |  // r == 2**(BN_MONT_CTX_N0_LIMBS * BN_BITS2) and LG_LITTLE_R == lg(r). This
   41|       |  // ensures that we can do integer division by |r| by simply ignoring
   42|       |  // |BN_MONT_CTX_N0_LIMBS| limbs. Similarly, we can calculate values modulo
   43|       |  // |r| by just looking at the lowest |BN_MONT_CTX_N0_LIMBS| limbs. This is
   44|       |  // what makes Montgomery multiplication efficient.
   45|       |  //
   46|       |  // As shown in Algorithm 1 of "Fast Prime Field Elliptic Curve Cryptography
   47|       |  // with 256 Bit Primes" by Shay Gueron and Vlad Krasnov, in the loop of a
   48|       |  // multi-limb Montgomery multiplication of |a * b (mod n)|, given the
   49|       |  // unreduced product |t == a * b|, we repeatedly calculate:
   50|       |  //
   51|       |  //    t1 := t % r         |t1| is |t|'s lowest limb (see previous paragraph).
   52|       |  //    t2 := t1*n0*n
   53|       |  //    t3 := t + t2
   54|       |  //    t := t3 / r         copy all limbs of |t3| except the lowest to |t|.
   55|       |  //
   56|       |  // In the last step, it would only make sense to ignore the lowest limb of
   57|       |  // |t3| if it were zero. The middle steps ensure that this is the case:
   58|       |  //
   59|       |  //                            t3 ==  0 (mod r)
   60|       |  //                        t + t2 ==  0 (mod r)
   61|       |  //                   t + t1*n0*n ==  0 (mod r)
   62|       |  //                       t1*n0*n == -t (mod r)
   63|       |  //                        t*n0*n == -t (mod r)
   64|       |  //                          n0*n == -1 (mod r)
   65|       |  //                            n0 == -1/n (mod r)
   66|       |  //
   67|       |  // Thus, in each iteration of the loop, we multiply by the constant factor
   68|       |  // |n0|, the negative inverse of n (mod r).
   69|       |
   70|       |  // n_mod_r = n % r. As explained above, this is done by taking the lowest
   71|       |  // |BN_MONT_CTX_N0_LIMBS| limbs of |n|.
   72|  1.77k|  uint64_t n_mod_r = n->d[0];
   73|       |#if BN_MONT_CTX_N0_LIMBS == 2
   74|       |  if (n->width > 1) {
   75|       |    n_mod_r |= (uint64_t)n->d[1] << BN_BITS2;
   76|       |  }
   77|       |#endif
   78|       |
   79|  1.77k|  return bn_neg_inv_mod_r_u64(n_mod_r);
   80|  1.77k|}
bn_mod_exp_base_2_consttime:
  163|  1.76k|                                BN_CTX *ctx) {
  164|  1.76k|  assert(!BN_is_zero(n));
  165|  1.76k|  assert(!BN_is_negative(n));
  166|  1.76k|  assert(BN_is_odd(n));
  167|       |
  168|  1.76k|  BN_zero(r);
  169|       |
  170|  1.76k|  unsigned n_bits = BN_num_bits(n);
  171|  1.76k|  assert(n_bits != 0);
  172|  1.76k|  assert(p > n_bits);
  173|  1.76k|  if (n_bits == 1) {
  ------------------
  |  Branch (173:7): [True: 0, False: 1.76k]
  ------------------
  174|      0|    return 1;
  175|      0|  }
  176|       |
  177|       |  // Set |r| to the larger power of two smaller than |n|, then shift with
  178|       |  // reductions the rest of the way.
  179|  1.76k|  if (!BN_set_bit(r, n_bits - 1) ||
  ------------------
  |  Branch (179:7): [True: 0, False: 1.76k]
  ------------------
  180|  1.76k|      !bn_mod_lshift_consttime(r, r, p - (n_bits - 1), n, ctx)) {
  ------------------
  |  Branch (180:7): [True: 0, False: 1.76k]
  ------------------
  181|      0|    return 0;
  182|      0|  }
  183|       |
  184|  1.76k|  return 1;
  185|  1.76k|}
bcm.c:bn_neg_inv_mod_r_u64:
  104|  1.77k|static uint64_t bn_neg_inv_mod_r_u64(uint64_t n) {
  105|  1.77k|  assert(n % 2 == 1);
  106|       |
  107|       |  // alpha == 2**(lg r - 1) == r / 2.
  108|  1.77k|  static const uint64_t alpha = UINT64_C(1) << (LG_LITTLE_R - 1);
  ------------------
  |  |   31|  1.77k|#define LG_LITTLE_R (BN_MONT_CTX_N0_LIMBS * BN_BITS2)
  |  |  ------------------
  |  |  |  |  158|  1.77k|#define BN_MONT_CTX_N0_LIMBS 1
  |  |  ------------------
  |  |               #define LG_LITTLE_R (BN_MONT_CTX_N0_LIMBS * BN_BITS2)
  |  |  ------------------
  |  |  |  |  151|  1.77k|#define BN_BITS2 64
  |  |  ------------------
  ------------------
  109|       |
  110|  1.77k|  const uint64_t beta = n;
  111|       |
  112|  1.77k|  uint64_t u = 1;
  113|  1.77k|  uint64_t v = 0;
  114|       |
  115|       |  // The invariant maintained from here on is:
  116|       |  // 2**(lg r - i) == u*2*alpha - v*beta.
  117|   115k|  for (size_t i = 0; i < LG_LITTLE_R; ++i) {
  ------------------
  |  |   31|   115k|#define LG_LITTLE_R (BN_MONT_CTX_N0_LIMBS * BN_BITS2)
  |  |  ------------------
  |  |  |  |  158|   115k|#define BN_MONT_CTX_N0_LIMBS 1
  |  |  ------------------
  |  |               #define LG_LITTLE_R (BN_MONT_CTX_N0_LIMBS * BN_BITS2)
  |  |  ------------------
  |  |  |  |  151|   115k|#define BN_BITS2 64
  |  |  ------------------
  ------------------
  |  Branch (117:22): [True: 113k, False: 1.77k]
  ------------------
  118|   113k|#if BN_BITS2 == 64 && defined(BN_ULLONG)
  119|   113k|    assert((BN_ULLONG)(1) << (LG_LITTLE_R - i) ==
  120|   113k|           ((BN_ULLONG)u * 2 * alpha) - ((BN_ULLONG)v * beta));
  121|   113k|#endif
  122|       |
  123|       |    // Delete a common factor of 2 in u and v if |u| is even. Otherwise, set
  124|       |    // |u = (u + beta) / 2| and |v = (v / 2) + alpha|.
  125|       |
  126|   113k|    uint64_t u_is_odd = UINT64_C(0) - (u & 1);  // Either 0xff..ff or 0.
  127|       |
  128|       |    // The addition can overflow, so use Dietz's method for it.
  129|       |    //
  130|       |    // Dietz calculates (x+y)/2 by (x⊕y)>>1 + x&y. This is valid for all
  131|       |    // (unsigned) x and y, even when x+y overflows. Evidence for 32-bit values
  132|       |    // (embedded in 64 bits to so that overflow can be ignored):
  133|       |    //
  134|       |    // (declare-fun x () (_ BitVec 64))
  135|       |    // (declare-fun y () (_ BitVec 64))
  136|       |    // (assert (let (
  137|       |    //    (one (_ bv1 64))
  138|       |    //    (thirtyTwo (_ bv32 64)))
  139|       |    //    (and
  140|       |    //      (bvult x (bvshl one thirtyTwo))
  141|       |    //      (bvult y (bvshl one thirtyTwo))
  142|       |    //      (not (=
  143|       |    //        (bvadd (bvlshr (bvxor x y) one) (bvand x y))
  144|       |    //        (bvlshr (bvadd x y) one)))
  145|       |    // )))
  146|       |    // (check-sat)
  147|   113k|    uint64_t beta_if_u_is_odd = beta & u_is_odd;  // Either |beta| or 0.
  148|   113k|    u = ((u ^ beta_if_u_is_odd) >> 1) + (u & beta_if_u_is_odd);
  149|       |
  150|   113k|    uint64_t alpha_if_u_is_odd = alpha & u_is_odd;  // Either |alpha| or 0.
  151|   113k|    v = (v >> 1) + alpha_if_u_is_odd;
  152|   113k|  }
  153|       |
  154|       |  // The invariant now shows that u*r - v*n == 1 since r == 2 * alpha.
  155|  1.77k|#if BN_BITS2 == 64 && defined(BN_ULLONG)
  156|  1.77k|  assert(1 == ((BN_ULLONG)u * 2 * alpha) - ((BN_ULLONG)v * beta));
  157|  1.77k|#endif
  158|       |
  159|  1.77k|  return v;
  160|  1.77k|}

BN_mul:
  515|  21.6k|int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
  516|  21.6k|  if (!bn_mul_impl(r, a, b, ctx)) {
  ------------------
  |  Branch (516:7): [True: 0, False: 21.6k]
  ------------------
  517|      0|    return 0;
  518|      0|  }
  519|       |
  520|       |  // This additionally fixes any negative zeros created by |bn_mul_impl|.
  521|  21.6k|  bn_set_minimal_width(r);
  522|  21.6k|  return 1;
  523|  21.6k|}
bn_mul_consttime:
  525|  1.17k|int bn_mul_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
  526|       |  // Prevent negative zeros.
  527|  1.17k|  if (a->neg || b->neg) {
  ------------------
  |  Branch (527:7): [True: 0, False: 1.17k]
  |  Branch (527:17): [True: 0, False: 1.17k]
  ------------------
  528|      0|    OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  529|      0|    return 0;
  530|      0|  }
  531|       |
  532|  1.17k|  return bn_mul_impl(r, a, b, ctx);
  533|  1.17k|}
bn_sqr_consttime:
  668|   519k|int bn_sqr_consttime(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx) {
  669|   519k|  int al = a->width;
  670|   519k|  if (al <= 0) {
  ------------------
  |  Branch (670:7): [True: 0, False: 519k]
  ------------------
  671|      0|    r->width = 0;
  672|      0|    r->neg = 0;
  673|      0|    return 1;
  674|      0|  }
  675|       |
  676|   519k|  int ret = 0;
  677|   519k|  BN_CTX_start(ctx);
  678|   519k|  BIGNUM *rr = (a != r) ? r : BN_CTX_get(ctx);
  ------------------
  |  Branch (678:16): [True: 509k, False: 9.86k]
  ------------------
  679|   519k|  BIGNUM *tmp = BN_CTX_get(ctx);
  680|   519k|  if (!rr || !tmp) {
  ------------------
  |  Branch (680:7): [True: 0, False: 519k]
  |  Branch (680:14): [True: 0, False: 519k]
  ------------------
  681|      0|    goto err;
  682|      0|  }
  683|       |
  684|   519k|  int max = 2 * al;  // Non-zero (from above)
  685|   519k|  if (!bn_wexpand(rr, max)) {
  ------------------
  |  Branch (685:7): [True: 0, False: 519k]
  ------------------
  686|      0|    goto err;
  687|      0|  }
  688|       |
  689|   519k|  if (al == 4) {
  ------------------
  |  Branch (689:7): [True: 519k, False: 201]
  ------------------
  690|   519k|    bn_sqr_comba4(rr->d, a->d);
  691|   519k|  } else if (al == 8) {
  ------------------
  |  Branch (691:14): [True: 0, False: 201]
  ------------------
  692|      0|    bn_sqr_comba8(rr->d, a->d);
  693|    201|  } else {
  694|    201|    if (al < BN_SQR_RECURSIVE_SIZE_NORMAL) {
  ------------------
  |  |   71|    201|#define BN_SQR_RECURSIVE_SIZE_NORMAL BN_MUL_RECURSIVE_SIZE_NORMAL
  |  |  ------------------
  |  |  |  |   70|    201|#define BN_MUL_RECURSIVE_SIZE_NORMAL 16
  |  |  ------------------
  ------------------
  |  Branch (694:9): [True: 201, False: 0]
  ------------------
  695|    201|      BN_ULONG t[BN_SQR_RECURSIVE_SIZE_NORMAL * 2];
  696|    201|      bn_sqr_normal(rr->d, a->d, al, t);
  697|    201|    } else {
  698|       |      // If |al| is a power of two, we can use |bn_sqr_recursive|.
  699|      0|      if (al != 0 && (al & (al - 1)) == 0) {
  ------------------
  |  Branch (699:11): [True: 0, False: 0]
  |  Branch (699:22): [True: 0, False: 0]
  ------------------
  700|      0|        if (!bn_wexpand(tmp, al * 4)) {
  ------------------
  |  Branch (700:13): [True: 0, False: 0]
  ------------------
  701|      0|          goto err;
  702|      0|        }
  703|      0|        bn_sqr_recursive(rr->d, a->d, al, tmp->d);
  704|      0|      } else {
  705|      0|        if (!bn_wexpand(tmp, max)) {
  ------------------
  |  Branch (705:13): [True: 0, False: 0]
  ------------------
  706|      0|          goto err;
  707|      0|        }
  708|      0|        bn_sqr_normal(rr->d, a->d, al, tmp->d);
  709|      0|      }
  710|      0|    }
  711|    201|  }
  712|       |
  713|   519k|  rr->neg = 0;
  714|   519k|  rr->width = max;
  715|       |
  716|   519k|  if (rr != r && !BN_copy(r, rr)) {
  ------------------
  |  Branch (716:7): [True: 9.86k, False: 509k]
  |  Branch (716:18): [True: 0, False: 9.86k]
  ------------------
  717|      0|    goto err;
  718|      0|  }
  719|   519k|  ret = 1;
  720|       |
  721|   519k|err:
  722|   519k|  BN_CTX_end(ctx);
  723|   519k|  return ret;
  724|   519k|}
BN_sqr:
  726|   519k|int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx) {
  727|   519k|  if (!bn_sqr_consttime(r, a, ctx)) {
  ------------------
  |  Branch (727:7): [True: 0, False: 519k]
  ------------------
  728|      0|    return 0;
  729|      0|  }
  730|       |
  731|   519k|  bn_set_minimal_width(r);
  732|   519k|  return 1;
  733|   519k|}
bcm.c:bn_abs_sub_part_words:
  172|  6.85k|                                      BN_ULONG *tmp) {
  173|  6.85k|  BN_ULONG borrow = bn_sub_part_words(tmp, a, b, cl, dl);
  174|  6.85k|  bn_sub_part_words(r, b, a, cl, -dl);
  175|  6.85k|  int r_len = cl + (dl < 0 ? -dl : dl);
  ------------------
  |  Branch (175:21): [True: 317, False: 6.53k]
  ------------------
  176|  6.85k|  borrow = 0 - borrow;
  177|  6.85k|  bn_select_words(r, borrow, r /* tmp < 0 */, tmp /* tmp >= 0 */, r_len);
  178|  6.85k|  return borrow;
  179|  6.85k|}
bcm.c:bn_sub_part_words:
  130|  13.7k|                                  const BN_ULONG *b, int cl, int dl) {
  131|  13.7k|  assert(cl >= 0);
  132|  13.7k|  BN_ULONG borrow = bn_sub_words(r, a, b, cl);
  133|  13.7k|  if (dl == 0) {
  ------------------
  |  Branch (133:7): [True: 12.4k, False: 1.27k]
  ------------------
  134|  12.4k|    return borrow;
  135|  12.4k|  }
  136|       |
  137|  1.27k|  r += cl;
  138|  1.27k|  a += cl;
  139|  1.27k|  b += cl;
  140|       |
  141|  1.27k|  if (dl < 0) {
  ------------------
  |  Branch (141:7): [True: 638, False: 638]
  ------------------
  142|       |    // |a| is shorter than |b|. Complete the subtraction as if the excess words
  143|       |    // in |a| were zeros.
  144|    638|    dl = -dl;
  145|  12.1k|    for (int i = 0; i < dl; i++) {
  ------------------
  |  Branch (145:21): [True: 11.5k, False: 638]
  ------------------
  146|  11.5k|      r[i] = 0u - b[i] - borrow;
  147|  11.5k|      borrow |= r[i] != 0;
  148|  11.5k|    }
  149|    638|  } else {
  150|       |    // |b| is shorter than |a|. Complete the subtraction as if the excess words
  151|       |    // in |b| were zeros.
  152|  12.1k|    for (int i = 0; i < dl; i++) {
  ------------------
  |  Branch (152:21): [True: 11.5k, False: 638]
  ------------------
  153|       |      // |r| and |a| may alias, so use a temporary.
  154|  11.5k|      BN_ULONG tmp = a[i];
  155|  11.5k|      r[i] = a[i] - borrow;
  156|  11.5k|      borrow = tmp < r[i];
  157|  11.5k|    }
  158|    638|  }
  159|       |
  160|  1.27k|  return borrow;
  161|  13.7k|}
bcm.c:bn_mul_impl:
  420|  22.8k|                       BN_CTX *ctx) {
  421|  22.8k|  int al = a->width;
  422|  22.8k|  int bl = b->width;
  423|  22.8k|  if (al == 0 || bl == 0) {
  ------------------
  |  Branch (423:7): [True: 2, False: 22.8k]
  |  Branch (423:18): [True: 0, False: 22.8k]
  ------------------
  424|      2|    BN_zero(r);
  425|      2|    return 1;
  426|      2|  }
  427|       |
  428|  22.8k|  int ret = 0;
  429|  22.8k|  BIGNUM *rr;
  430|  22.8k|  BN_CTX_start(ctx);
  431|  22.8k|  if (r == a || r == b) {
  ------------------
  |  Branch (431:7): [True: 0, False: 22.8k]
  |  Branch (431:17): [True: 0, False: 22.8k]
  ------------------
  432|      0|    rr = BN_CTX_get(ctx);
  433|      0|    if (rr == NULL) {
  ------------------
  |  Branch (433:9): [True: 0, False: 0]
  ------------------
  434|      0|      goto err;
  435|      0|    }
  436|  22.8k|  } else {
  437|  22.8k|    rr = r;
  438|  22.8k|  }
  439|  22.8k|  rr->neg = a->neg ^ b->neg;
  440|       |
  441|  22.8k|  int i = al - bl;
  442|  22.8k|  if (i == 0) {
  ------------------
  |  Branch (442:7): [True: 21.7k, False: 1.15k]
  ------------------
  443|  21.7k|    if (al == 8) {
  ------------------
  |  Branch (443:9): [True: 1, False: 21.7k]
  ------------------
  444|      1|      if (!bn_wexpand(rr, 16)) {
  ------------------
  |  Branch (444:11): [True: 0, False: 1]
  ------------------
  445|      0|        goto err;
  446|      0|      }
  447|      1|      rr->width = 16;
  448|      1|      bn_mul_comba8(rr->d, a->d, b->d);
  449|      1|      goto end;
  450|      1|    }
  451|  21.7k|  }
  452|       |
  453|  22.8k|  int top = al + bl;
  454|  22.8k|  static const int kMulNormalSize = 16;
  455|  22.8k|  if (al >= kMulNormalSize && bl >= kMulNormalSize) {
  ------------------
  |  Branch (455:7): [True: 329, False: 22.5k]
  |  Branch (455:31): [True: 318, False: 11]
  ------------------
  456|    318|    if (-1 <= i && i <= 1) {
  ------------------
  |  Branch (456:9): [True: 289, False: 29]
  |  Branch (456:20): [True: 277, False: 12]
  ------------------
  457|       |      // Find the largest power of two less than or equal to the larger length.
  458|    277|      int j;
  459|    277|      if (i >= 0) {
  ------------------
  |  Branch (459:11): [True: 24, False: 253]
  ------------------
  460|     24|        j = BN_num_bits_word((BN_ULONG)al);
  461|    253|      } else {
  462|    253|        j = BN_num_bits_word((BN_ULONG)bl);
  463|    253|      }
  464|    277|      j = 1 << (j - 1);
  465|    277|      assert(j <= al || j <= bl);
  466|    277|      BIGNUM *t = BN_CTX_get(ctx);
  467|    277|      if (t == NULL) {
  ------------------
  |  Branch (467:11): [True: 0, False: 277]
  ------------------
  468|      0|        goto err;
  469|      0|      }
  470|    277|      if (al > j || bl > j) {
  ------------------
  |  Branch (470:11): [True: 46, False: 231]
  |  Branch (470:21): [True: 222, False: 9]
  ------------------
  471|       |        // We know |al| and |bl| are at most one from each other, so if al > j,
  472|       |        // bl >= j, and vice versa. Thus we can use |bn_mul_part_recursive|.
  473|       |        //
  474|       |        // TODO(davidben): This codepath is almost unused in standard
  475|       |        // algorithms. Is this optimization necessary? See notes in
  476|       |        // https://boringssl-review.googlesource.com/q/I0bd604e2cd6a75c266f64476c23a730ca1721ea6
  477|    268|        assert(al >= j && bl >= j);
  478|    268|        if (!bn_wexpand(t, j * 8) ||
  ------------------
  |  Branch (478:13): [True: 0, False: 268]
  ------------------
  479|    268|            !bn_wexpand(rr, j * 4)) {
  ------------------
  |  Branch (479:13): [True: 0, False: 268]
  ------------------
  480|      0|          goto err;
  481|      0|        }
  482|    268|        bn_mul_part_recursive(rr->d, a->d, b->d, j, al - j, bl - j, t->d);
  483|    268|      } else {
  484|       |        // al <= j && bl <= j. Additionally, we know j <= al or j <= bl, so one
  485|       |        // of al - j or bl - j is zero. The other, by the bound on |i| above, is
  486|       |        // zero or -1. Thus, we can use |bn_mul_recursive|.
  487|      9|        if (!bn_wexpand(t, j * 4) ||
  ------------------
  |  Branch (487:13): [True: 0, False: 9]
  ------------------
  488|      9|            !bn_wexpand(rr, j * 2)) {
  ------------------
  |  Branch (488:13): [True: 0, False: 9]
  ------------------
  489|      0|          goto err;
  490|      0|        }
  491|      9|        bn_mul_recursive(rr->d, a->d, b->d, j, al - j, bl - j, t->d);
  492|      9|      }
  493|    277|      rr->width = top;
  494|    277|      goto end;
  495|    277|    }
  496|    318|  }
  497|       |
  498|  22.5k|  if (!bn_wexpand(rr, top)) {
  ------------------
  |  Branch (498:7): [True: 0, False: 22.5k]
  ------------------
  499|      0|    goto err;
  500|      0|  }
  501|  22.5k|  rr->width = top;
  502|  22.5k|  bn_mul_normal(rr->d, a->d, al, b->d, bl);
  503|       |
  504|  22.8k|end:
  505|  22.8k|  if (r != rr && !BN_copy(r, rr)) {
  ------------------
  |  Branch (505:7): [True: 0, False: 22.8k]
  |  Branch (505:18): [True: 0, False: 0]
  ------------------
  506|      0|    goto err;
  507|      0|  }
  508|  22.8k|  ret = 1;
  509|       |
  510|  22.8k|err:
  511|  22.8k|  BN_CTX_end(ctx);
  512|  22.8k|  return ret;
  513|  22.8k|}
bcm.c:bn_mul_part_recursive:
  312|    302|                                  BN_ULONG *t) {
  313|       |  // |n| is a power of two.
  314|    302|  assert(n != 0 && (n & (n - 1)) == 0);
  315|       |  // Check |tna| and |tnb| are in range.
  316|    302|  assert(0 <= tna && tna < n);
  317|    302|  assert(0 <= tnb && tnb < n);
  318|    302|  assert(-1 <= tna - tnb && tna - tnb <= 1);
  319|       |
  320|    302|  int n2 = n * 2;
  321|    302|  if (n < 8) {
  ------------------
  |  Branch (321:7): [True: 0, False: 302]
  ------------------
  322|      0|    bn_mul_normal(r, a, n + tna, b, n + tnb);
  323|      0|    OPENSSL_memset(r + n2 + tna + tnb, 0, n2 - tna - tnb);
  324|      0|    return;
  325|      0|  }
  326|       |
  327|       |  // Split |a| and |b| into a0,a1 and b0,b1, where a0 and b0 have size |n|. |a1|
  328|       |  // and |b1| have size |tna| and |tnb|, respectively.
  329|       |  // Split |t| into t0,t1,t2,t3, each of size |n|, with the remaining 4*|n| used
  330|       |  // for recursive calls.
  331|       |  // Split |r| into r0,r1,r2,r3. We must contribute a0*b0 to r0,r1, a0*a1+b0*b1
  332|       |  // to r1,r2, and a1*b1 to r2,r3. The middle term we will compute as:
  333|       |  //
  334|       |  //   a0*a1 + b0*b1 = (a0 - a1)*(b1 - b0) + a1*b1 + a0*b0
  335|       |
  336|       |  // t0 = a0 - a1 and t1 = b1 - b0. The result will be multiplied, so we XOR
  337|       |  // their sign masks, giving the sign of (a0 - a1)*(b1 - b0). t0 and t1
  338|       |  // themselves store the absolute value.
  339|    302|  BN_ULONG neg = bn_abs_sub_part_words(t, a, &a[n], tna, n - tna, &t[n2]);
  340|    302|  neg ^= bn_abs_sub_part_words(&t[n], &b[n], b, tnb, tnb - n, &t[n2]);
  341|       |
  342|       |  // Compute:
  343|       |  // t2,t3 = t0 * t1 = |(a0 - a1)*(b1 - b0)|
  344|       |  // r0,r1 = a0 * b0
  345|       |  // r2,r3 = a1 * b1
  346|    302|  if (n == 8) {
  ------------------
  |  Branch (346:7): [True: 0, False: 302]
  ------------------
  347|      0|    bn_mul_comba8(&t[n2], t, &t[n]);
  348|      0|    bn_mul_comba8(r, a, b);
  349|       |
  350|      0|    bn_mul_normal(&r[n2], &a[n], tna, &b[n], tnb);
  351|       |    // |bn_mul_normal| only writes |tna| + |tna| words. Zero the rest.
  352|      0|    OPENSSL_memset(&r[n2 + tna + tnb], 0, sizeof(BN_ULONG) * (n2 - tna - tnb));
  353|    302|  } else {
  354|    302|    BN_ULONG *p = &t[n2 * 2];
  355|    302|    bn_mul_recursive(&t[n2], t, &t[n], n, 0, 0, p);
  356|    302|    bn_mul_recursive(r, a, b, n, 0, 0, p);
  357|       |
  358|    302|    OPENSSL_memset(&r[n2], 0, sizeof(BN_ULONG) * n2);
  359|    302|    if (tna < BN_MUL_RECURSIVE_SIZE_NORMAL &&
  ------------------
  |  |   70|    604|#define BN_MUL_RECURSIVE_SIZE_NORMAL 16
  ------------------
  |  Branch (359:9): [True: 265, False: 37]
  ------------------
  360|    302|        tnb < BN_MUL_RECURSIVE_SIZE_NORMAL) {
  ------------------
  |  |   70|    265|#define BN_MUL_RECURSIVE_SIZE_NORMAL 16
  ------------------
  |  Branch (360:9): [True: 260, False: 5]
  ------------------
  361|    260|      bn_mul_normal(&r[n2], &a[n], tna, &b[n], tnb);
  362|    260|    } else {
  363|     42|      int i = n;
  364|     54|      for (;;) {
  365|     54|        i /= 2;
  366|     54|        if (i < tna || i < tnb) {
  ------------------
  |  Branch (366:13): [True: 33, False: 21]
  |  Branch (366:24): [True: 1, False: 20]
  ------------------
  367|       |          // E.g., n == 16, i == 8 and tna == 11. |tna| and |tnb| are within one
  368|       |          // of each other, so if |tna| is larger and tna > i, then we know
  369|       |          // tnb >= i, and this call is valid.
  370|     34|          bn_mul_part_recursive(&r[n2], &a[n], &b[n], i, tna - i, tnb - i, p);
  371|     34|          break;
  372|     34|        }
  373|     20|        if (i == tna || i == tnb) {
  ------------------
  |  Branch (373:13): [True: 3, False: 17]
  |  Branch (373:25): [True: 5, False: 12]
  ------------------
  374|       |          // If there is only a bottom half to the number, just do it. We know
  375|       |          // the larger of |tna - i| and |tnb - i| is zero. The other is zero or
  376|       |          // -1 by because of |tna| and |tnb| differ by at most one.
  377|      8|          bn_mul_recursive(&r[n2], &a[n], &b[n], i, tna - i, tnb - i, p);
  378|      8|          break;
  379|      8|        }
  380|       |
  381|       |        // This loop will eventually terminate when |i| falls below
  382|       |        // |BN_MUL_RECURSIVE_SIZE_NORMAL| because we know one of |tna| and |tnb|
  383|       |        // exceeds that.
  384|     20|      }
  385|     42|    }
  386|    302|  }
  387|       |
  388|       |  // t0,t1,c = r0,r1 + r2,r3 = a0*b0 + a1*b1
  389|    302|  BN_ULONG c = bn_add_words(t, r, &r[n2], n2);
  390|       |
  391|       |  // t2,t3,c = t0,t1,c + neg*t2,t3 = (a0 - a1)*(b1 - b0) + a1*b1 + a0*b0.
  392|       |  // The second term is stored as the absolute value, so we do this with a
  393|       |  // constant-time select.
  394|    302|  BN_ULONG c_neg = c - bn_sub_words(&t[n2 * 2], t, &t[n2], n2);
  395|    302|  BN_ULONG c_pos = c + bn_add_words(&t[n2], t, &t[n2], n2);
  396|    302|  bn_select_words(&t[n2], neg, &t[n2 * 2], &t[n2], n2);
  397|    302|  static_assert(sizeof(BN_ULONG) <= sizeof(crypto_word_t),
  398|    302|                "crypto_word_t is too small");
  399|    302|  c = constant_time_select_w(neg, c_neg, c_pos);
  400|       |
  401|       |  // We now have our three components. Add them together.
  402|       |  // r1,r2,c = r1,r2 + t2,t3,c
  403|    302|  c += bn_add_words(&r[n], &r[n], &t[n2], n2);
  404|       |
  405|       |  // Propagate the carry bit to the end.
  406|  8.39k|  for (int i = n + n2; i < n2 + n2; i++) {
  ------------------
  |  Branch (406:24): [True: 8.09k, False: 302]
  ------------------
  407|  8.09k|    BN_ULONG old = r[i];
  408|  8.09k|    r[i] = old + c;
  409|  8.09k|    c = r[i] < old;
  410|  8.09k|  }
  411|       |
  412|       |  // The product should fit without carries.
  413|    302|  assert(c == 0);
  414|    302|}
bcm.c:bn_mul_recursive:
  211|  3.16k|                             int n2, int dna, int dnb, BN_ULONG *t) {
  212|       |  // |n2| is a power of two.
  213|  3.16k|  assert(n2 != 0 && (n2 & (n2 - 1)) == 0);
  214|       |  // Check |dna| and |dnb| are in range.
  215|  3.16k|  assert(-BN_MUL_RECURSIVE_SIZE_NORMAL/2 <= dna && dna <= 0);
  216|  3.16k|  assert(-BN_MUL_RECURSIVE_SIZE_NORMAL/2 <= dnb && dnb <= 0);
  217|       |
  218|       |  // Only call bn_mul_comba 8 if n2 == 8 and the
  219|       |  // two arrays are complete [steve]
  220|  3.16k|  if (n2 == 8 && dna == 0 && dnb == 0) {
  ------------------
  |  Branch (220:7): [True: 42, False: 3.12k]
  |  Branch (220:18): [True: 33, False: 9]
  |  Branch (220:30): [True: 28, False: 5]
  ------------------
  221|     28|    bn_mul_comba8(r, a, b);
  222|     28|    return;
  223|     28|  }
  224|       |
  225|       |  // Else do normal multiply
  226|  3.14k|  if (n2 < BN_MUL_RECURSIVE_SIZE_NORMAL) {
  ------------------
  |  |   70|  3.14k|#define BN_MUL_RECURSIVE_SIZE_NORMAL 16
  ------------------
  |  Branch (226:7): [True: 14, False: 3.12k]
  ------------------
  227|     14|    bn_mul_normal(r, a, n2 + dna, b, n2 + dnb);
  228|     14|    if (dna + dnb < 0) {
  ------------------
  |  Branch (228:9): [True: 14, False: 0]
  ------------------
  229|     14|      OPENSSL_memset(&r[2 * n2 + dna + dnb], 0,
  230|     14|                     sizeof(BN_ULONG) * -(dna + dnb));
  231|     14|    }
  232|     14|    return;
  233|     14|  }
  234|       |
  235|       |  // Split |a| and |b| into a0,a1 and b0,b1, where a0 and b0 have size |n|.
  236|       |  // Split |t| into t0,t1,t2,t3, each of size |n|, with the remaining 4*|n| used
  237|       |  // for recursive calls.
  238|       |  // Split |r| into r0,r1,r2,r3. We must contribute a0*b0 to r0,r1, a0*a1+b0*b1
  239|       |  // to r1,r2, and a1*b1 to r2,r3. The middle term we will compute as:
  240|       |  //
  241|       |  //   a0*a1 + b0*b1 = (a0 - a1)*(b1 - b0) + a1*b1 + a0*b0
  242|       |  //
  243|       |  // Note that we know |n| >= |BN_MUL_RECURSIVE_SIZE_NORMAL|/2 above, so
  244|       |  // |tna| and |tnb| are non-negative.
  245|  3.12k|  int n = n2 / 2, tna = n + dna, tnb = n + dnb;
  246|       |
  247|       |  // t0 = a0 - a1 and t1 = b1 - b0. The result will be multiplied, so we XOR
  248|       |  // their sign masks, giving the sign of (a0 - a1)*(b1 - b0). t0 and t1
  249|       |  // themselves store the absolute value.
  250|  3.12k|  BN_ULONG neg = bn_abs_sub_part_words(t, a, &a[n], tna, n - tna, &t[n2]);
  251|  3.12k|  neg ^= bn_abs_sub_part_words(&t[n], &b[n], b, tnb, tnb - n, &t[n2]);
  252|       |
  253|       |  // Compute:
  254|       |  // t2,t3 = t0 * t1 = |(a0 - a1)*(b1 - b0)|
  255|       |  // r0,r1 = a0 * b0
  256|       |  // r2,r3 = a1 * b1
  257|  3.12k|  if (n == 4 && dna == 0 && dnb == 0) {
  ------------------
  |  Branch (257:7): [True: 0, False: 3.12k]
  |  Branch (257:17): [True: 0, False: 0]
  |  Branch (257:29): [True: 0, False: 0]
  ------------------
  258|      0|    bn_mul_comba4(&t[n2], t, &t[n]);
  259|       |
  260|      0|    bn_mul_comba4(r, a, b);
  261|      0|    bn_mul_comba4(&r[n2], &a[n], &b[n]);
  262|  3.12k|  } else if (n == 8 && dna == 0 && dnb == 0) {
  ------------------
  |  Branch (262:14): [True: 2.29k, False: 835]
  |  Branch (262:24): [True: 2.28k, False: 9]
  |  Branch (262:36): [True: 2.27k, False: 5]
  ------------------
  263|  2.27k|    bn_mul_comba8(&t[n2], t, &t[n]);
  264|       |
  265|  2.27k|    bn_mul_comba8(r, a, b);
  266|  2.27k|    bn_mul_comba8(&r[n2], &a[n], &b[n]);
  267|  2.27k|  } else {
  268|    849|    BN_ULONG *p = &t[n2 * 2];
  269|    849|    bn_mul_recursive(&t[n2], t, &t[n], n, 0, 0, p);
  270|    849|    bn_mul_recursive(r, a, b, n, 0, 0, p);
  271|    849|    bn_mul_recursive(&r[n2], &a[n], &b[n], n, dna, dnb, p);
  272|    849|  }
  273|       |
  274|       |  // t0,t1,c = r0,r1 + r2,r3 = a0*b0 + a1*b1
  275|  3.12k|  BN_ULONG c = bn_add_words(t, r, &r[n2], n2);
  276|       |
  277|       |  // t2,t3,c = t0,t1,c + neg*t2,t3 = (a0 - a1)*(b1 - b0) + a1*b1 + a0*b0.
  278|       |  // The second term is stored as the absolute value, so we do this with a
  279|       |  // constant-time select.
  280|  3.12k|  BN_ULONG c_neg = c - bn_sub_words(&t[n2 * 2], t, &t[n2], n2);
  281|  3.12k|  BN_ULONG c_pos = c + bn_add_words(&t[n2], t, &t[n2], n2);
  282|  3.12k|  bn_select_words(&t[n2], neg, &t[n2 * 2], &t[n2], n2);
  283|  3.12k|  static_assert(sizeof(BN_ULONG) <= sizeof(crypto_word_t),
  284|  3.12k|                "crypto_word_t is too small");
  285|  3.12k|  c = constant_time_select_w(neg, c_neg, c_pos);
  286|       |
  287|       |  // We now have our three components. Add them together.
  288|       |  // r1,r2,c = r1,r2 + t2,t3,c
  289|  3.12k|  c += bn_add_words(&r[n], &r[n], &t[n2], n2);
  290|       |
  291|       |  // Propagate the carry bit to the end.
  292|  40.7k|  for (int i = n + n2; i < n2 + n2; i++) {
  ------------------
  |  Branch (292:24): [True: 37.6k, False: 3.12k]
  ------------------
  293|  37.6k|    BN_ULONG old = r[i];
  294|  37.6k|    r[i] = old + c;
  295|  37.6k|    c = r[i] < old;
  296|  37.6k|  }
  297|       |
  298|       |  // The product should fit without carries.
  299|  3.12k|  assert(c == 0);
  300|  3.12k|}
bcm.c:bn_mul_normal:
   82|  22.8k|                          const BN_ULONG *b, size_t nb) {
   83|  22.8k|  if (na < nb) {
  ------------------
  |  Branch (83:7): [True: 1.10k, False: 21.7k]
  ------------------
   84|  1.10k|    size_t itmp = na;
   85|  1.10k|    na = nb;
   86|  1.10k|    nb = itmp;
   87|  1.10k|    const BN_ULONG *ltmp = a;
   88|  1.10k|    a = b;
   89|  1.10k|    b = ltmp;
   90|  1.10k|  }
   91|  22.8k|  BN_ULONG *rr = &(r[na]);
   92|  22.8k|  if (nb == 0) {
  ------------------
  |  Branch (92:7): [True: 229, False: 22.6k]
  ------------------
   93|    229|    OPENSSL_memset(r, 0, na * sizeof(BN_ULONG));
   94|    229|    return;
   95|    229|  }
   96|  22.6k|  rr[0] = bn_mul_words(r, a, na, b[0]);
   97|       |
   98|  23.5k|  for (;;) {
   99|  23.5k|    if (--nb == 0) {
  ------------------
  |  Branch (99:9): [True: 752, False: 22.7k]
  ------------------
  100|    752|      return;
  101|    752|    }
  102|  22.7k|    rr[1] = bn_mul_add_words(&(r[1]), a, na, b[1]);
  103|  22.7k|    if (--nb == 0) {
  ------------------
  |  Branch (103:9): [True: 222, False: 22.5k]
  ------------------
  104|    222|      return;
  105|    222|    }
  106|  22.5k|    rr[2] = bn_mul_add_words(&(r[2]), a, na, b[2]);
  107|  22.5k|    if (--nb == 0) {
  ------------------
  |  Branch (107:9): [True: 50, False: 22.4k]
  ------------------
  108|     50|      return;
  109|     50|    }
  110|  22.4k|    rr[3] = bn_mul_add_words(&(r[3]), a, na, b[3]);
  111|  22.4k|    if (--nb == 0) {
  ------------------
  |  Branch (111:9): [True: 21.5k, False: 882]
  ------------------
  112|  21.5k|      return;
  113|  21.5k|    }
  114|    882|    rr[4] = bn_mul_add_words(&(r[4]), a, na, b[4]);
  115|    882|    rr += 4;
  116|    882|    r += 4;
  117|    882|    b += 4;
  118|    882|  }
  119|  22.6k|}
bcm.c:bn_sqr_normal:
  551|    201|                          BN_ULONG *tmp) {
  552|    201|  if (n == 0) {
  ------------------
  |  Branch (552:7): [True: 0, False: 201]
  ------------------
  553|      0|    return;
  554|      0|  }
  555|       |
  556|    201|  size_t max = n * 2;
  557|    201|  const BN_ULONG *ap = a;
  558|    201|  BN_ULONG *rp = r;
  559|    201|  rp[0] = rp[max - 1] = 0;
  560|    201|  rp++;
  561|       |
  562|       |  // Compute the contribution of a[i] * a[j] for all i < j.
  563|    201|  if (n > 1) {
  ------------------
  |  Branch (563:7): [True: 201, False: 0]
  ------------------
  564|    201|    ap++;
  565|    201|    rp[n - 1] = bn_mul_words(rp, ap, n - 1, ap[-1]);
  566|    201|    rp += 2;
  567|    201|  }
  568|    201|  if (n > 2) {
  ------------------
  |  Branch (568:7): [True: 201, False: 0]
  ------------------
  569|  1.14k|    for (size_t i = n - 2; i > 0; i--) {
  ------------------
  |  Branch (569:28): [True: 945, False: 201]
  ------------------
  570|    945|      ap++;
  571|    945|      rp[i] = bn_mul_add_words(rp, ap, i, ap[-1]);
  572|    945|      rp += 2;
  573|    945|    }
  574|    201|  }
  575|       |
  576|       |  // The final result fits in |max| words, so none of the following operations
  577|       |  // will overflow.
  578|       |
  579|       |  // Double |r|, giving the contribution of a[i] * a[j] for all i != j.
  580|    201|  bn_add_words(r, r, r, max);
  581|       |
  582|       |  // Add in the contribution of a[i] * a[i] for all i.
  583|    201|  bn_sqr_words(tmp, a, n);
  584|    201|  bn_add_words(r, r, tmp, max);
  585|    201|}

BN_lshift:
   67|  1.09M|int BN_lshift(BIGNUM *r, const BIGNUM *a, int n) {
   68|  1.09M|  int i, nw, lb, rb;
   69|  1.09M|  BN_ULONG *t, *f;
   70|  1.09M|  BN_ULONG l;
   71|       |
   72|  1.09M|  if (n < 0) {
  ------------------
  |  Branch (72:7): [True: 0, False: 1.09M]
  ------------------
   73|      0|    OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   74|      0|    return 0;
   75|      0|  }
   76|       |
   77|  1.09M|  r->neg = a->neg;
   78|  1.09M|  nw = n / BN_BITS2;
  ------------------
  |  |  151|  1.09M|#define BN_BITS2 64
  ------------------
   79|  1.09M|  if (!bn_wexpand(r, a->width + nw + 1)) {
  ------------------
  |  Branch (79:7): [True: 0, False: 1.09M]
  ------------------
   80|      0|    return 0;
   81|      0|  }
   82|  1.09M|  lb = n % BN_BITS2;
  ------------------
  |  |  151|  1.09M|#define BN_BITS2 64
  ------------------
   83|  1.09M|  rb = BN_BITS2 - lb;
  ------------------
  |  |  151|  1.09M|#define BN_BITS2 64
  ------------------
   84|  1.09M|  f = a->d;
   85|  1.09M|  t = r->d;
   86|  1.09M|  t[a->width + nw] = 0;
   87|  1.09M|  if (lb == 0) {
  ------------------
  |  Branch (87:7): [True: 3.10k, False: 1.08M]
  ------------------
   88|  21.4k|    for (i = a->width - 1; i >= 0; i--) {
  ------------------
  |  Branch (88:28): [True: 18.3k, False: 3.10k]
  ------------------
   89|  18.3k|      t[nw + i] = f[i];
   90|  18.3k|    }
   91|  1.08M|  } else {
   92|  7.05M|    for (i = a->width - 1; i >= 0; i--) {
  ------------------
  |  Branch (92:28): [True: 5.96M, False: 1.08M]
  ------------------
   93|  5.96M|      l = f[i];
   94|  5.96M|      t[nw + i + 1] |= l >> rb;
   95|  5.96M|      t[nw + i] = l << lb;
   96|  5.96M|    }
   97|  1.08M|  }
   98|  1.09M|  OPENSSL_memset(t, 0, nw * sizeof(t[0]));
   99|  1.09M|  r->width = a->width + nw + 1;
  100|  1.09M|  bn_set_minimal_width(r);
  101|       |
  102|  1.09M|  return 1;
  103|  1.09M|}
bn_rshift_words:
  137|   551k|                     size_t num) {
  138|   551k|  unsigned shift_bits = shift % BN_BITS2;
  ------------------
  |  |  151|   551k|#define BN_BITS2 64
  ------------------
  139|   551k|  size_t shift_words = shift / BN_BITS2;
  ------------------
  |  |  151|   551k|#define BN_BITS2 64
  ------------------
  140|   551k|  if (shift_words >= num) {
  ------------------
  |  Branch (140:7): [True: 2.70k, False: 549k]
  ------------------
  141|  2.70k|    OPENSSL_memset(r, 0, num * sizeof(BN_ULONG));
  142|  2.70k|    return;
  143|  2.70k|  }
  144|   549k|  if (shift_bits == 0) {
  ------------------
  |  Branch (144:7): [True: 3.98k, False: 545k]
  ------------------
  145|  3.98k|    OPENSSL_memmove(r, a + shift_words, (num - shift_words) * sizeof(BN_ULONG));
  146|   545k|  } else {
  147|  2.13M|    for (size_t i = shift_words; i < num - 1; i++) {
  ------------------
  |  Branch (147:34): [True: 1.59M, False: 545k]
  ------------------
  148|  1.59M|      r[i - shift_words] =
  149|  1.59M|          (a[i] >> shift_bits) | (a[i + 1] << (BN_BITS2 - shift_bits));
  ------------------
  |  |  151|  1.59M|#define BN_BITS2 64
  ------------------
  150|  1.59M|    }
  151|   545k|    r[num - 1 - shift_words] = a[num - 1] >> shift_bits;
  152|   545k|  }
  153|   549k|  OPENSSL_memset(r + num - shift_words, 0, shift_words * sizeof(BN_ULONG));
  154|   549k|}
BN_rshift:
  156|   551k|int BN_rshift(BIGNUM *r, const BIGNUM *a, int n) {
  157|   551k|  if (n < 0) {
  ------------------
  |  Branch (157:7): [True: 0, False: 551k]
  ------------------
  158|      0|    OPENSSL_PUT_ERROR(BN, BN_R_NEGATIVE_NUMBER);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  159|      0|    return 0;
  160|      0|  }
  161|       |
  162|   551k|  if (!bn_wexpand(r, a->width)) {
  ------------------
  |  Branch (162:7): [True: 0, False: 551k]
  ------------------
  163|      0|    return 0;
  164|      0|  }
  165|   551k|  bn_rshift_words(r->d, a->d, n, a->width);
  166|   551k|  r->neg = a->neg;
  167|   551k|  r->width = a->width;
  168|   551k|  bn_set_minimal_width(r);
  169|   551k|  return 1;
  170|   551k|}
bn_rshift1_words:
  200|    270|void bn_rshift1_words(BN_ULONG *r, const BN_ULONG *a, size_t num) {
  201|    270|  if (num == 0) {
  ------------------
  |  Branch (201:7): [True: 0, False: 270]
  ------------------
  202|      0|    return;
  203|      0|  }
  204|    540|  for (size_t i = 0; i < num - 1; i++) {
  ------------------
  |  Branch (204:22): [True: 270, False: 270]
  ------------------
  205|    270|    r[i] = (a[i] >> 1) | (a[i + 1] << (BN_BITS2 - 1));
  ------------------
  |  |  151|    270|#define BN_BITS2 64
  ------------------
  206|    270|  }
  207|    270|  r[num - 1] = a[num - 1] >> 1;
  208|    270|}
BN_rshift1:
  210|    270|int BN_rshift1(BIGNUM *r, const BIGNUM *a) {
  211|    270|  if (!bn_wexpand(r, a->width)) {
  ------------------
  |  Branch (211:7): [True: 0, False: 270]
  ------------------
  212|      0|    return 0;
  213|      0|  }
  214|    270|  bn_rshift1_words(r->d, a->d, a->width);
  215|    270|  r->width = a->width;
  216|    270|  r->neg = a->neg;
  217|    270|  bn_set_minimal_width(r);
  218|    270|  return 1;
  219|    270|}
BN_set_bit:
  221|  1.77k|int BN_set_bit(BIGNUM *a, int n) {
  222|  1.77k|  if (n < 0) {
  ------------------
  |  Branch (222:7): [True: 0, False: 1.77k]
  ------------------
  223|      0|    return 0;
  224|      0|  }
  225|       |
  226|  1.77k|  int i = n / BN_BITS2;
  ------------------
  |  |  151|  1.77k|#define BN_BITS2 64
  ------------------
  227|  1.77k|  int j = n % BN_BITS2;
  ------------------
  |  |  151|  1.77k|#define BN_BITS2 64
  ------------------
  228|  1.77k|  if (a->width <= i) {
  ------------------
  |  Branch (228:7): [True: 1.77k, False: 0]
  ------------------
  229|  1.77k|    if (!bn_wexpand(a, i + 1)) {
  ------------------
  |  Branch (229:9): [True: 0, False: 1.77k]
  ------------------
  230|      0|      return 0;
  231|      0|    }
  232|  20.3k|    for (int k = a->width; k < i + 1; k++) {
  ------------------
  |  Branch (232:28): [True: 18.5k, False: 1.77k]
  ------------------
  233|  18.5k|      a->d[k] = 0;
  234|  18.5k|    }
  235|  1.77k|    a->width = i + 1;
  236|  1.77k|  }
  237|       |
  238|  1.77k|  a->d[i] |= (((BN_ULONG)1) << j);
  239|       |
  240|  1.77k|  return 1;
  241|  1.77k|}
bn_is_bit_set_words:
  261|   424k|int bn_is_bit_set_words(const BN_ULONG *a, size_t num, size_t bit) {
  262|   424k|  size_t i = bit / BN_BITS2;
  ------------------
  |  |  151|   424k|#define BN_BITS2 64
  ------------------
  263|   424k|  size_t j = bit % BN_BITS2;
  ------------------
  |  |  151|   424k|#define BN_BITS2 64
  ------------------
  264|   424k|  if (i >= num) {
  ------------------
  |  Branch (264:7): [True: 36, False: 424k]
  ------------------
  265|     36|    return 0;
  266|     36|  }
  267|   424k|  return (a[i] >> j) & 1;
  268|   424k|}
BN_is_bit_set:
  270|   284k|int BN_is_bit_set(const BIGNUM *a, int n) {
  271|   284k|  if (n < 0) {
  ------------------
  |  Branch (271:7): [True: 0, False: 284k]
  ------------------
  272|      0|    return 0;
  273|      0|  }
  274|   284k|  return bn_is_bit_set_words(a->d, a->width, n);
  275|   284k|}

BN_mod_sqrt:
   62|    681|BIGNUM *BN_mod_sqrt(BIGNUM *in, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) {
   63|       |  // Compute a square root of |a| mod |p| using the Tonelli/Shanks algorithm
   64|       |  // (cf. Henri Cohen, "A Course in Algebraic Computational Number Theory",
   65|       |  // algorithm 1.5.1). |p| is assumed to be a prime.
   66|       |
   67|    681|  BIGNUM *ret = in;
   68|    681|  int err = 1;
   69|    681|  int r;
   70|    681|  BIGNUM *A, *b, *q, *t, *x, *y;
   71|    681|  int e, i, j;
   72|       |
   73|    681|  if (!BN_is_odd(p) || BN_abs_is_word(p, 1)) {
  ------------------
  |  Branch (73:7): [True: 0, False: 681]
  |  Branch (73:24): [True: 0, False: 681]
  ------------------
   74|      0|    if (BN_abs_is_word(p, 2)) {
  ------------------
  |  Branch (74:9): [True: 0, False: 0]
  ------------------
   75|      0|      if (ret == NULL) {
  ------------------
  |  Branch (75:11): [True: 0, False: 0]
  ------------------
   76|      0|        ret = BN_new();
   77|      0|      }
   78|      0|      if (ret == NULL ||
  ------------------
  |  Branch (78:11): [True: 0, False: 0]
  ------------------
   79|      0|          !BN_set_word(ret, BN_is_bit_set(a, 0))) {
  ------------------
  |  Branch (79:11): [True: 0, False: 0]
  ------------------
   80|      0|        if (ret != in) {
  ------------------
  |  Branch (80:13): [True: 0, False: 0]
  ------------------
   81|      0|          BN_free(ret);
   82|      0|        }
   83|      0|        return NULL;
   84|      0|      }
   85|      0|      return ret;
   86|      0|    }
   87|       |
   88|      0|    OPENSSL_PUT_ERROR(BN, BN_R_P_IS_NOT_PRIME);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   89|      0|    return NULL;
   90|      0|  }
   91|       |
   92|    681|  if (BN_is_zero(a) || BN_is_one(a)) {
  ------------------
  |  Branch (92:7): [True: 0, False: 681]
  |  Branch (92:24): [True: 0, False: 681]
  ------------------
   93|      0|    if (ret == NULL) {
  ------------------
  |  Branch (93:9): [True: 0, False: 0]
  ------------------
   94|      0|      ret = BN_new();
   95|      0|    }
   96|      0|    if (ret == NULL ||
  ------------------
  |  Branch (96:9): [True: 0, False: 0]
  ------------------
   97|      0|        !BN_set_word(ret, BN_is_one(a))) {
  ------------------
  |  Branch (97:9): [True: 0, False: 0]
  ------------------
   98|      0|      if (ret != in) {
  ------------------
  |  Branch (98:11): [True: 0, False: 0]
  ------------------
   99|      0|        BN_free(ret);
  100|      0|      }
  101|      0|      return NULL;
  102|      0|    }
  103|      0|    return ret;
  104|      0|  }
  105|       |
  106|    681|  BN_CTX_start(ctx);
  107|    681|  A = BN_CTX_get(ctx);
  108|    681|  b = BN_CTX_get(ctx);
  109|    681|  q = BN_CTX_get(ctx);
  110|    681|  t = BN_CTX_get(ctx);
  111|    681|  x = BN_CTX_get(ctx);
  112|    681|  y = BN_CTX_get(ctx);
  113|    681|  if (y == NULL) {
  ------------------
  |  Branch (113:7): [True: 0, False: 681]
  ------------------
  114|      0|    goto end;
  115|      0|  }
  116|       |
  117|    681|  if (ret == NULL) {
  ------------------
  |  Branch (117:7): [True: 0, False: 681]
  ------------------
  118|      0|    ret = BN_new();
  119|      0|  }
  120|    681|  if (ret == NULL) {
  ------------------
  |  Branch (120:7): [True: 0, False: 681]
  ------------------
  121|      0|    goto end;
  122|      0|  }
  123|       |
  124|       |  // A = a mod p
  125|    681|  if (!BN_nnmod(A, a, p, ctx)) {
  ------------------
  |  Branch (125:7): [True: 0, False: 681]
  ------------------
  126|      0|    goto end;
  127|      0|  }
  128|       |
  129|       |  // now write  |p| - 1  as  2^e*q  where  q  is odd
  130|    681|  e = 1;
  131|  26.3k|  while (!BN_is_bit_set(p, e)) {
  ------------------
  |  Branch (131:10): [True: 25.6k, False: 681]
  ------------------
  132|  25.6k|    e++;
  133|  25.6k|  }
  134|       |  // we'll set  q  later (if needed)
  135|       |
  136|    681|  if (e == 1) {
  ------------------
  |  Branch (136:7): [True: 411, False: 270]
  ------------------
  137|       |    // The easy case:  (|p|-1)/2  is odd, so 2 has an inverse
  138|       |    // modulo  (|p|-1)/2,  and square roots can be computed
  139|       |    // directly by modular exponentiation.
  140|       |    // We have
  141|       |    //     2 * (|p|+1)/4 == 1   (mod (|p|-1)/2),
  142|       |    // so we can use exponent  (|p|+1)/4,  i.e.  (|p|-3)/4 + 1.
  143|    411|    if (!BN_rshift(q, p, 2)) {
  ------------------
  |  Branch (143:9): [True: 0, False: 411]
  ------------------
  144|      0|      goto end;
  145|      0|    }
  146|    411|    q->neg = 0;
  147|    411|    if (!BN_add_word(q, 1) ||
  ------------------
  |  Branch (147:9): [True: 0, False: 411]
  ------------------
  148|    411|        !BN_mod_exp_mont(ret, A, q, p, ctx, NULL)) {
  ------------------
  |  Branch (148:9): [True: 0, False: 411]
  ------------------
  149|      0|      goto end;
  150|      0|    }
  151|    411|    err = 0;
  152|    411|    goto vrfy;
  153|    411|  }
  154|       |
  155|    270|  if (e == 2) {
  ------------------
  |  Branch (155:7): [True: 0, False: 270]
  ------------------
  156|       |    // |p| == 5  (mod 8)
  157|       |    //
  158|       |    // In this case  2  is always a non-square since
  159|       |    // Legendre(2,p) = (-1)^((p^2-1)/8)  for any odd prime.
  160|       |    // So if  a  really is a square, then  2*a  is a non-square.
  161|       |    // Thus for
  162|       |    //      b := (2*a)^((|p|-5)/8),
  163|       |    //      i := (2*a)*b^2
  164|       |    // we have
  165|       |    //     i^2 = (2*a)^((1 + (|p|-5)/4)*2)
  166|       |    //         = (2*a)^((p-1)/2)
  167|       |    //         = -1;
  168|       |    // so if we set
  169|       |    //      x := a*b*(i-1),
  170|       |    // then
  171|       |    //     x^2 = a^2 * b^2 * (i^2 - 2*i + 1)
  172|       |    //         = a^2 * b^2 * (-2*i)
  173|       |    //         = a*(-i)*(2*a*b^2)
  174|       |    //         = a*(-i)*i
  175|       |    //         = a.
  176|       |    //
  177|       |    // (This is due to A.O.L. Atkin,
  178|       |    // <URL:
  179|       |    //http://listserv.nodak.edu/scripts/wa.exe?A2=ind9211&L=nmbrthry&O=T&P=562>,
  180|       |    // November 1992.)
  181|       |
  182|       |    // t := 2*a
  183|      0|    if (!bn_mod_lshift1_consttime(t, A, p, ctx)) {
  ------------------
  |  Branch (183:9): [True: 0, False: 0]
  ------------------
  184|      0|      goto end;
  185|      0|    }
  186|       |
  187|       |    // b := (2*a)^((|p|-5)/8)
  188|      0|    if (!BN_rshift(q, p, 3)) {
  ------------------
  |  Branch (188:9): [True: 0, False: 0]
  ------------------
  189|      0|      goto end;
  190|      0|    }
  191|      0|    q->neg = 0;
  192|      0|    if (!BN_mod_exp_mont(b, t, q, p, ctx, NULL)) {
  ------------------
  |  Branch (192:9): [True: 0, False: 0]
  ------------------
  193|      0|      goto end;
  194|      0|    }
  195|       |
  196|       |    // y := b^2
  197|      0|    if (!BN_mod_sqr(y, b, p, ctx)) {
  ------------------
  |  Branch (197:9): [True: 0, False: 0]
  ------------------
  198|      0|      goto end;
  199|      0|    }
  200|       |
  201|       |    // t := (2*a)*b^2 - 1
  202|      0|    if (!BN_mod_mul(t, t, y, p, ctx) ||
  ------------------
  |  Branch (202:9): [True: 0, False: 0]
  ------------------
  203|      0|        !BN_sub_word(t, 1)) {
  ------------------
  |  Branch (203:9): [True: 0, False: 0]
  ------------------
  204|      0|      goto end;
  205|      0|    }
  206|       |
  207|       |    // x = a*b*t
  208|      0|    if (!BN_mod_mul(x, A, b, p, ctx) ||
  ------------------
  |  Branch (208:9): [True: 0, False: 0]
  ------------------
  209|      0|        !BN_mod_mul(x, x, t, p, ctx)) {
  ------------------
  |  Branch (209:9): [True: 0, False: 0]
  ------------------
  210|      0|      goto end;
  211|      0|    }
  212|       |
  213|      0|    if (!BN_copy(ret, x)) {
  ------------------
  |  Branch (213:9): [True: 0, False: 0]
  ------------------
  214|      0|      goto end;
  215|      0|    }
  216|      0|    err = 0;
  217|      0|    goto vrfy;
  218|      0|  }
  219|       |
  220|       |  // e > 2, so we really have to use the Tonelli/Shanks algorithm.
  221|       |  // First, find some  y  that is not a square.
  222|    270|  if (!BN_copy(q, p)) {
  ------------------
  |  Branch (222:7): [True: 0, False: 270]
  ------------------
  223|      0|    goto end;  // use 'q' as temp
  224|      0|  }
  225|    270|  q->neg = 0;
  226|    270|  i = 2;
  227|  2.70k|  do {
  228|       |    // For efficiency, try small numbers first;
  229|       |    // if this fails, try random numbers.
  230|  2.70k|    if (i < 22) {
  ------------------
  |  Branch (230:9): [True: 2.70k, False: 0]
  ------------------
  231|  2.70k|      if (!BN_set_word(y, i)) {
  ------------------
  |  Branch (231:11): [True: 0, False: 2.70k]
  ------------------
  232|      0|        goto end;
  233|      0|      }
  234|  2.70k|    } else {
  235|      0|      if (!BN_pseudo_rand(y, BN_num_bits(p), 0, 0)) {
  ------------------
  |  Branch (235:11): [True: 0, False: 0]
  ------------------
  236|      0|        goto end;
  237|      0|      }
  238|      0|      if (BN_ucmp(y, p) >= 0) {
  ------------------
  |  Branch (238:11): [True: 0, False: 0]
  ------------------
  239|      0|        if (!(p->neg ? BN_add : BN_sub)(y, y, p)) {
  ------------------
  |  Branch (239:13): [True: 0, False: 0]
  |  Branch (239:15): [True: 0, False: 0]
  ------------------
  240|      0|          goto end;
  241|      0|        }
  242|      0|      }
  243|       |      // now 0 <= y < |p|
  244|      0|      if (BN_is_zero(y)) {
  ------------------
  |  Branch (244:11): [True: 0, False: 0]
  ------------------
  245|      0|        if (!BN_set_word(y, i)) {
  ------------------
  |  Branch (245:13): [True: 0, False: 0]
  ------------------
  246|      0|          goto end;
  247|      0|        }
  248|      0|      }
  249|      0|    }
  250|       |
  251|  2.70k|    r = bn_jacobi(y, q, ctx);  // here 'q' is |p|
  252|  2.70k|    if (r < -1) {
  ------------------
  |  Branch (252:9): [True: 0, False: 2.70k]
  ------------------
  253|      0|      goto end;
  254|      0|    }
  255|  2.70k|    if (r == 0) {
  ------------------
  |  Branch (255:9): [True: 0, False: 2.70k]
  ------------------
  256|       |      // m divides p
  257|      0|      OPENSSL_PUT_ERROR(BN, BN_R_P_IS_NOT_PRIME);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  258|      0|      goto end;
  259|      0|    }
  260|  2.70k|  } while (r == 1 && ++i < 82);
  ------------------
  |  Branch (260:12): [True: 2.43k, False: 270]
  |  Branch (260:22): [True: 2.43k, False: 0]
  ------------------
  261|       |
  262|    270|  if (r != -1) {
  ------------------
  |  Branch (262:7): [True: 0, False: 270]
  ------------------
  263|       |    // Many rounds and still no non-square -- this is more likely
  264|       |    // a bug than just bad luck.
  265|       |    // Even if  p  is not prime, we should have found some  y
  266|       |    // such that r == -1.
  267|      0|    OPENSSL_PUT_ERROR(BN, BN_R_TOO_MANY_ITERATIONS);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  268|      0|    goto end;
  269|      0|  }
  270|       |
  271|       |  // Here's our actual 'q':
  272|    270|  if (!BN_rshift(q, q, e)) {
  ------------------
  |  Branch (272:7): [True: 0, False: 270]
  ------------------
  273|      0|    goto end;
  274|      0|  }
  275|       |
  276|       |  // Now that we have some non-square, we can find an element
  277|       |  // of order  2^e  by computing its q'th power.
  278|    270|  if (!BN_mod_exp_mont(y, y, q, p, ctx, NULL)) {
  ------------------
  |  Branch (278:7): [True: 0, False: 270]
  ------------------
  279|      0|    goto end;
  280|      0|  }
  281|    270|  if (BN_is_one(y)) {
  ------------------
  |  Branch (281:7): [True: 0, False: 270]
  ------------------
  282|      0|    OPENSSL_PUT_ERROR(BN, BN_R_P_IS_NOT_PRIME);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  283|      0|    goto end;
  284|      0|  }
  285|       |
  286|       |  // Now we know that (if  p  is indeed prime) there is an integer
  287|       |  // k,  0 <= k < 2^e,  such that
  288|       |  //
  289|       |  //      a^q * y^k == 1   (mod p).
  290|       |  //
  291|       |  // As  a^q  is a square and  y  is not,  k  must be even.
  292|       |  // q+1  is even, too, so there is an element
  293|       |  //
  294|       |  //     X := a^((q+1)/2) * y^(k/2),
  295|       |  //
  296|       |  // and it satisfies
  297|       |  //
  298|       |  //     X^2 = a^q * a     * y^k
  299|       |  //         = a,
  300|       |  //
  301|       |  // so it is the square root that we are looking for.
  302|       |
  303|       |  // t := (q-1)/2  (note that  q  is odd)
  304|    270|  if (!BN_rshift1(t, q)) {
  ------------------
  |  Branch (304:7): [True: 0, False: 270]
  ------------------
  305|      0|    goto end;
  306|      0|  }
  307|       |
  308|       |  // x := a^((q-1)/2)
  309|    270|  if (BN_is_zero(t)) {  // special case: p = 2^e + 1
  ------------------
  |  Branch (309:7): [True: 0, False: 270]
  ------------------
  310|      0|    if (!BN_nnmod(t, A, p, ctx)) {
  ------------------
  |  Branch (310:9): [True: 0, False: 0]
  ------------------
  311|      0|      goto end;
  312|      0|    }
  313|      0|    if (BN_is_zero(t)) {
  ------------------
  |  Branch (313:9): [True: 0, False: 0]
  ------------------
  314|       |      // special case: a == 0  (mod p)
  315|      0|      BN_zero(ret);
  316|      0|      err = 0;
  317|      0|      goto end;
  318|      0|    } else if (!BN_one(x)) {
  ------------------
  |  Branch (318:16): [True: 0, False: 0]
  ------------------
  319|      0|      goto end;
  320|      0|    }
  321|    270|  } else {
  322|    270|    if (!BN_mod_exp_mont(x, A, t, p, ctx, NULL)) {
  ------------------
  |  Branch (322:9): [True: 0, False: 270]
  ------------------
  323|      0|      goto end;
  324|      0|    }
  325|    270|    if (BN_is_zero(x)) {
  ------------------
  |  Branch (325:9): [True: 0, False: 270]
  ------------------
  326|       |      // special case: a == 0  (mod p)
  327|      0|      BN_zero(ret);
  328|      0|      err = 0;
  329|      0|      goto end;
  330|      0|    }
  331|    270|  }
  332|       |
  333|       |  // b := a*x^2  (= a^q)
  334|    270|  if (!BN_mod_sqr(b, x, p, ctx) ||
  ------------------
  |  Branch (334:7): [True: 0, False: 270]
  ------------------
  335|    270|      !BN_mod_mul(b, b, A, p, ctx)) {
  ------------------
  |  Branch (335:7): [True: 0, False: 270]
  ------------------
  336|      0|    goto end;
  337|      0|  }
  338|       |
  339|       |  // x := a*x    (= a^((q+1)/2))
  340|    270|  if (!BN_mod_mul(x, x, A, p, ctx)) {
  ------------------
  |  Branch (340:7): [True: 0, False: 270]
  ------------------
  341|      0|    goto end;
  342|      0|  }
  343|       |
  344|  10.5k|  while (1) {
  ------------------
  |  Branch (344:10): [Folded - Ignored]
  ------------------
  345|       |    // Now  b  is  a^q * y^k  for some even  k  (0 <= k < 2^E
  346|       |    // where  E  refers to the original value of  e,  which we
  347|       |    // don't keep in a variable),  and  x  is  a^((q+1)/2) * y^(k/2).
  348|       |    //
  349|       |    // We have  a*b = x^2,
  350|       |    //    y^2^(e-1) = -1,
  351|       |    //    b^2^(e-1) = 1.
  352|  10.5k|    if (BN_is_one(b)) {
  ------------------
  |  Branch (352:9): [True: 214, False: 10.2k]
  ------------------
  353|    214|      if (!BN_copy(ret, x)) {
  ------------------
  |  Branch (353:11): [True: 0, False: 214]
  ------------------
  354|      0|        goto end;
  355|      0|      }
  356|    214|      err = 0;
  357|    214|      goto vrfy;
  358|    214|    }
  359|       |
  360|       |    // Find the smallest i, 0 < i < e, such that b^(2^i) = 1
  361|   497k|    for (i = 1; i < e; i++) {
  ------------------
  |  Branch (361:17): [True: 497k, False: 56]
  ------------------
  362|   497k|      if (i == 1) {
  ------------------
  |  Branch (362:11): [True: 10.2k, False: 487k]
  ------------------
  363|  10.2k|        if (!BN_mod_sqr(t, b, p, ctx)) {
  ------------------
  |  Branch (363:13): [True: 0, False: 10.2k]
  ------------------
  364|      0|          goto end;
  365|      0|        }
  366|   487k|      } else {
  367|   487k|        if (!BN_mod_mul(t, t, t, p, ctx)) {
  ------------------
  |  Branch (367:13): [True: 0, False: 487k]
  ------------------
  368|      0|          goto end;
  369|      0|        }
  370|   487k|      }
  371|   497k|      if (BN_is_one(t)) {
  ------------------
  |  Branch (371:11): [True: 10.2k, False: 487k]
  ------------------
  372|  10.2k|        break;
  373|  10.2k|      }
  374|   497k|    }
  375|       |    // If not found, a is not a square or p is not a prime.
  376|  10.2k|    if (i >= e) {
  ------------------
  |  Branch (376:9): [True: 56, False: 10.2k]
  ------------------
  377|     56|      OPENSSL_PUT_ERROR(BN, BN_R_NOT_A_SQUARE);
  ------------------
  |  |  441|     56|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  378|     56|      goto end;
  379|     56|    }
  380|       |
  381|       |    // t := y^2^(e - i - 1)
  382|  10.2k|    if (!BN_copy(t, y)) {
  ------------------
  |  Branch (382:9): [True: 0, False: 10.2k]
  ------------------
  383|      0|      goto end;
  384|      0|    }
  385|  20.0k|    for (j = e - i - 1; j > 0; j--) {
  ------------------
  |  Branch (385:25): [True: 9.86k, False: 10.2k]
  ------------------
  386|  9.86k|      if (!BN_mod_sqr(t, t, p, ctx)) {
  ------------------
  |  Branch (386:11): [True: 0, False: 9.86k]
  ------------------
  387|      0|        goto end;
  388|      0|      }
  389|  9.86k|    }
  390|  10.2k|    if (!BN_mod_mul(y, t, t, p, ctx) ||
  ------------------
  |  Branch (390:9): [True: 0, False: 10.2k]
  ------------------
  391|  10.2k|        !BN_mod_mul(x, x, t, p, ctx) ||
  ------------------
  |  Branch (391:9): [True: 0, False: 10.2k]
  ------------------
  392|  10.2k|        !BN_mod_mul(b, b, y, p, ctx)) {
  ------------------
  |  Branch (392:9): [True: 0, False: 10.2k]
  ------------------
  393|      0|      goto end;
  394|      0|    }
  395|       |
  396|       |    // e decreases each iteration, so this loop will terminate.
  397|  10.2k|    assert(i < e);
  398|  10.2k|    e = i;
  399|  10.2k|  }
  400|       |
  401|    625|vrfy:
  402|    625|  if (!err) {
  ------------------
  |  Branch (402:7): [True: 625, False: 0]
  ------------------
  403|       |    // Verify the result. The input might have been not a square.
  404|    625|    if (!BN_mod_sqr(x, ret, p, ctx)) {
  ------------------
  |  Branch (404:9): [True: 0, False: 625]
  ------------------
  405|      0|      err = 1;
  406|      0|    }
  407|       |
  408|    625|    if (!err && 0 != BN_cmp(x, A)) {
  ------------------
  |  Branch (408:9): [True: 625, False: 0]
  |  Branch (408:17): [True: 144, False: 481]
  ------------------
  409|    144|      OPENSSL_PUT_ERROR(BN, BN_R_NOT_A_SQUARE);
  ------------------
  |  |  441|    144|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  410|    144|      err = 1;
  411|    144|    }
  412|    625|  }
  413|       |
  414|    681|end:
  415|    681|  if (err) {
  ------------------
  |  Branch (415:7): [True: 200, False: 481]
  ------------------
  416|    200|    if (ret != in) {
  ------------------
  |  Branch (416:9): [True: 0, False: 200]
  ------------------
  417|      0|      BN_clear_free(ret);
  418|      0|    }
  419|    200|    ret = NULL;
  420|    200|  }
  421|    681|  BN_CTX_end(ctx);
  422|    681|  return ret;
  423|    625|}

BN_value_one:
   56|      4|  accessor_decorations type *name(void) {                                     \
   57|      4|    CRYPTO_once(name##_once_bss_get(), name##_init);                          \
   58|      4|    /* See http://c-faq.com/ansi/constmismatch.html for why the following     \
   59|      4|     * cast is needed. */                                                     \
   60|      4|    return (const type *)name##_storage_bss_get();                            \
   61|      4|  }                                                                           \
OPENSSL_built_in_curves:
   56|  3.31k|  accessor_decorations type *name(void) {                                     \
   57|  3.31k|    CRYPTO_once(name##_once_bss_get(), name##_init);                          \
   58|  3.31k|    /* See http://c-faq.com/ansi/constmismatch.html for why the following     \
   59|  3.31k|     * cast is needed. */                                                     \
   60|  3.31k|    return (const type *)name##_storage_bss_get();                            \
   61|  3.31k|  }                                                                           \
EC_GFp_mont_method:
   56|      2|  accessor_decorations type *name(void) {                                     \
   57|      2|    CRYPTO_once(name##_once_bss_get(), name##_init);                          \
   58|      2|    /* See http://c-faq.com/ansi/constmismatch.html for why the following     \
   59|      2|     * cast is needed. */                                                     \
   60|      2|    return (const type *)name##_storage_bss_get();                            \
   61|      2|  }                                                                           \
EC_GFp_nistp224_method:
   56|      1|  accessor_decorations type *name(void) {                                     \
   57|      1|    CRYPTO_once(name##_once_bss_get(), name##_init);                          \
   58|      1|    /* See http://c-faq.com/ansi/constmismatch.html for why the following     \
   59|      1|     * cast is needed. */                                                     \
   60|      1|    return (const type *)name##_storage_bss_get();                            \
   61|      1|  }                                                                           \
EC_GFp_nistz256_method:
   56|      1|  accessor_decorations type *name(void) {                                     \
   57|      1|    CRYPTO_once(name##_once_bss_get(), name##_init);                          \
   58|      1|    /* See http://c-faq.com/ansi/constmismatch.html for why the following     \
   59|      1|     * cast is needed. */                                                     \
   60|      1|    return (const type *)name##_storage_bss_get();                            \
   61|      1|  }                                                                           \
RSA_default_method:
   56|    603|  accessor_decorations type *name(void) {                                     \
   57|    603|    CRYPTO_once(name##_once_bss_get(), name##_init);                          \
   58|    603|    /* See http://c-faq.com/ansi/constmismatch.html for why the following     \
   59|    603|     * cast is needed. */                                                     \
   60|    603|    return (const type *)name##_storage_bss_get();                            \
   61|    603|  }                                                                           \
bcm.c:BN_value_one_once_bss_get:
   42|      4|  static CRYPTO_once_t *name##_bss_get(void) { return &name; }
bcm.c:BN_value_one_init:
   55|      1|  static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \
bcm.c:BN_value_one_storage_bss_get:
   39|      5|  static type *name##_bss_get(void) { return &name; }
bcm.c:OPENSSL_built_in_curves_once_bss_get:
   42|  3.31k|  static CRYPTO_once_t *name##_bss_get(void) { return &name; }
bcm.c:OPENSSL_built_in_curves_init:
   55|      1|  static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \
bcm.c:OPENSSL_built_in_curves_storage_bss_get:
   39|  3.31k|  static type *name##_bss_get(void) { return &name; }
bcm.c:built_in_groups_bss_get:
   39|  1.56k|  static type *name##_bss_get(void) { return &name; }
bcm.c:built_in_groups_lock_bss_get:
   45|  3.13k|  static struct CRYPTO_STATIC_MUTEX *name##_bss_get(void) { return &name; }
bcm.c:g_ec_ex_data_class_bss_get:
   48|  1.16k|  static CRYPTO_EX_DATA_CLASS *name##_bss_get(void) { return &name; }
bcm.c:EC_GFp_mont_method_once_bss_get:
   42|      2|  static CRYPTO_once_t *name##_bss_get(void) { return &name; }
bcm.c:EC_GFp_mont_method_init:
   55|      1|  static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \
bcm.c:EC_GFp_mont_method_storage_bss_get:
   39|      3|  static type *name##_bss_get(void) { return &name; }
bcm.c:EC_GFp_nistp224_method_once_bss_get:
   42|      1|  static CRYPTO_once_t *name##_bss_get(void) { return &name; }
bcm.c:EC_GFp_nistp224_method_init:
   55|      1|  static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \
bcm.c:EC_GFp_nistp224_method_storage_bss_get:
   39|      2|  static type *name##_bss_get(void) { return &name; }
bcm.c:EC_GFp_nistz256_method_once_bss_get:
   42|      1|  static CRYPTO_once_t *name##_bss_get(void) { return &name; }
bcm.c:EC_GFp_nistz256_method_init:
   55|      1|  static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \
bcm.c:EC_GFp_nistz256_method_storage_bss_get:
   39|      2|  static type *name##_bss_get(void) { return &name; }
bcm.c:g_rsa_ex_data_class_bss_get:
   48|    603|  static CRYPTO_EX_DATA_CLASS *name##_bss_get(void) { return &name; }
bcm.c:RSA_default_method_once_bss_get:
   42|    603|  static CRYPTO_once_t *name##_bss_get(void) { return &name; }
bcm.c:RSA_default_method_init:
   55|      1|  static void name##_init(void) { name##_do_init(name##_storage_bss_get()); } \
bcm.c:RSA_default_method_storage_bss_get:
   39|    604|  static type *name##_bss_get(void) { return &name; }

ec_group_new:
  273|      4|EC_GROUP *ec_group_new(const EC_METHOD *meth) {
  274|      4|  EC_GROUP *ret;
  275|       |
  276|      4|  if (meth == NULL) {
  ------------------
  |  Branch (276:7): [True: 0, False: 4]
  ------------------
  277|      0|    OPENSSL_PUT_ERROR(EC, EC_R_SLOT_FULL);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  278|      0|    return NULL;
  279|      0|  }
  280|       |
  281|      4|  if (meth->group_init == 0) {
  ------------------
  |  Branch (281:7): [True: 0, False: 4]
  ------------------
  282|      0|    OPENSSL_PUT_ERROR(EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  283|      0|    return NULL;
  284|      0|  }
  285|       |
  286|      4|  ret = OPENSSL_malloc(sizeof(EC_GROUP));
  287|      4|  if (ret == NULL) {
  ------------------
  |  Branch (287:7): [True: 0, False: 4]
  ------------------
  288|      0|    return NULL;
  289|      0|  }
  290|      4|  OPENSSL_memset(ret, 0, sizeof(EC_GROUP));
  291|       |
  292|      4|  ret->references = 1;
  293|      4|  ret->meth = meth;
  294|      4|  BN_init(&ret->order);
  295|       |
  296|      4|  if (!meth->group_init(ret)) {
  ------------------
  |  Branch (296:7): [True: 0, False: 4]
  ------------------
  297|      0|    OPENSSL_free(ret);
  298|      0|    return NULL;
  299|      0|  }
  300|       |
  301|      4|  return ret;
  302|      4|}
EC_GROUP_new_by_curve_name:
  505|  1.56k|EC_GROUP *EC_GROUP_new_by_curve_name(int nid) {
  506|  1.56k|  struct built_in_groups_st *groups = built_in_groups_bss_get();
  507|  1.56k|  EC_GROUP **group_ptr = NULL;
  508|  1.56k|  const struct built_in_curves *const curves = OPENSSL_built_in_curves();
  509|  1.56k|  const struct built_in_curve *curve = NULL;
  510|  4.28k|  for (size_t i = 0; i < OPENSSL_NUM_BUILT_IN_CURVES; i++) {
  ------------------
  |  |  780|  4.28k|#define OPENSSL_NUM_BUILT_IN_CURVES 4
  ------------------
  |  Branch (510:22): [True: 4.28k, False: 0]
  ------------------
  511|  4.28k|    if (curves->curves[i].nid == nid) {
  ------------------
  |  Branch (511:9): [True: 1.56k, False: 2.71k]
  ------------------
  512|  1.56k|      curve = &curves->curves[i];
  513|  1.56k|      group_ptr = &groups->groups[i];
  514|  1.56k|      break;
  515|  1.56k|    }
  516|  4.28k|  }
  517|       |
  518|  1.56k|  if (curve == NULL) {
  ------------------
  |  Branch (518:7): [True: 0, False: 1.56k]
  ------------------
  519|      0|    OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  520|      0|    return NULL;
  521|      0|  }
  522|       |
  523|  1.56k|  CRYPTO_STATIC_MUTEX_lock_read(built_in_groups_lock_bss_get());
  524|  1.56k|  EC_GROUP *ret = *group_ptr;
  525|  1.56k|  CRYPTO_STATIC_MUTEX_unlock_read(built_in_groups_lock_bss_get());
  526|  1.56k|  if (ret != NULL) {
  ------------------
  |  Branch (526:7): [True: 1.55k, False: 4]
  ------------------
  527|  1.55k|    return ret;
  528|  1.55k|  }
  529|       |
  530|      4|  ret = ec_group_new_from_data(curve);
  531|      4|  if (ret == NULL) {
  ------------------
  |  Branch (531:7): [True: 0, False: 4]
  ------------------
  532|      0|    return NULL;
  533|      0|  }
  534|       |
  535|      4|  EC_GROUP *to_free = NULL;
  536|      4|  CRYPTO_STATIC_MUTEX_lock_write(built_in_groups_lock_bss_get());
  537|      4|  if (*group_ptr == NULL) {
  ------------------
  |  Branch (537:7): [True: 4, False: 0]
  ------------------
  538|      4|    *group_ptr = ret;
  539|       |    // Filling in |ret->curve_name| makes |EC_GROUP_free| and |EC_GROUP_dup|
  540|       |    // into no-ops. At this point, |ret| is considered static.
  541|      4|    ret->curve_name = nid;
  542|      4|  } else {
  543|      0|    to_free = ret;
  544|      0|    ret = *group_ptr;
  545|      0|  }
  546|      4|  CRYPTO_STATIC_MUTEX_unlock_write(built_in_groups_lock_bss_get());
  547|       |
  548|      4|  EC_GROUP_free(to_free);
  549|      4|  return ret;
  550|      4|}
EC_GROUP_free:
  552|  7.14k|void EC_GROUP_free(EC_GROUP *group) {
  553|  7.14k|  if (group == NULL ||
  ------------------
  |  Branch (553:7): [True: 3.24k, False: 3.89k]
  ------------------
  554|       |      // Built-in curves are static.
  555|  7.14k|      group->curve_name != NID_undef ||
  ------------------
  |  |   85|  11.0k|#define NID_undef 0
  ------------------
  |  Branch (555:7): [True: 3.89k, False: 0]
  ------------------
  556|  7.14k|      !CRYPTO_refcount_dec_and_test_zero(&group->references)) {
  ------------------
  |  Branch (556:7): [True: 0, False: 0]
  ------------------
  557|  7.14k|    return;
  558|  7.14k|  }
  559|       |
  560|      0|  if (group->meth->group_finish != NULL) {
  ------------------
  |  Branch (560:7): [True: 0, False: 0]
  ------------------
  561|      0|    group->meth->group_finish(group);
  562|      0|  }
  563|       |
  564|      0|  ec_point_free(group->generator, 0 /* don't free group */);
  565|      0|  BN_free(&group->order);
  566|      0|  BN_MONT_CTX_free(group->order_mont);
  567|       |
  568|      0|  OPENSSL_free(group);
  569|      0|}
EC_GROUP_dup:
  571|  2.33k|EC_GROUP *EC_GROUP_dup(const EC_GROUP *a) {
  572|  2.33k|  if (a == NULL ||
  ------------------
  |  Branch (572:7): [True: 0, False: 2.33k]
  ------------------
  573|       |      // Built-in curves are static.
  574|  2.33k|      a->curve_name != NID_undef) {
  ------------------
  |  |   85|  2.33k|#define NID_undef 0
  ------------------
  |  Branch (574:7): [True: 2.33k, False: 4]
  ------------------
  575|  2.33k|    return (EC_GROUP *)a;
  576|  2.33k|  }
  577|       |
  578|       |  // Groups are logically immutable (but for |EC_GROUP_set_generator| which must
  579|       |  // be called early on), so we simply take a reference.
  580|      4|  EC_GROUP *group = (EC_GROUP *)a;
  581|      4|  CRYPTO_refcount_inc(&group->references);
  582|      4|  return group;
  583|  2.33k|}
EC_GROUP_cmp:
  585|  2.85k|int EC_GROUP_cmp(const EC_GROUP *a, const EC_GROUP *b, BN_CTX *ignored) {
  586|       |  // Note this function returns 0 if equal and non-zero otherwise.
  587|  2.85k|  if (a == b) {
  ------------------
  |  Branch (587:7): [True: 2.85k, False: 1]
  ------------------
  588|  2.85k|    return 0;
  589|  2.85k|  }
  590|      1|  if (a->curve_name != b->curve_name) {
  ------------------
  |  Branch (590:7): [True: 1, False: 0]
  ------------------
  591|      1|    return 1;
  592|      1|  }
  593|      0|  if (a->curve_name != NID_undef) {
  ------------------
  |  |   85|      0|#define NID_undef 0
  ------------------
  |  Branch (593:7): [True: 0, False: 0]
  ------------------
  594|       |    // Built-in curves may be compared by curve name alone.
  595|      0|    return 0;
  596|      0|  }
  597|       |
  598|       |  // |a| and |b| are both custom curves. We compare the entire curve
  599|       |  // structure. If |a| or |b| is incomplete (due to legacy OpenSSL mistakes,
  600|       |  // custom curve construction is sadly done in two parts) but otherwise not the
  601|       |  // same object, we consider them always unequal.
  602|      0|  return a->meth != b->meth ||
  ------------------
  |  Branch (602:10): [True: 0, False: 0]
  ------------------
  603|      0|         a->generator == NULL ||
  ------------------
  |  Branch (603:10): [True: 0, False: 0]
  ------------------
  604|      0|         b->generator == NULL ||
  ------------------
  |  Branch (604:10): [True: 0, False: 0]
  ------------------
  605|      0|         BN_cmp(&a->order, &b->order) != 0 ||
  ------------------
  |  Branch (605:10): [True: 0, False: 0]
  ------------------
  606|      0|         BN_cmp(&a->field, &b->field) != 0 ||
  ------------------
  |  Branch (606:10): [True: 0, False: 0]
  ------------------
  607|      0|         !ec_felem_equal(a, &a->a, &b->a) ||
  ------------------
  |  Branch (607:10): [True: 0, False: 0]
  ------------------
  608|      0|         !ec_felem_equal(a, &a->b, &b->b) ||
  ------------------
  |  Branch (608:10): [True: 0, False: 0]
  ------------------
  609|      0|         !ec_GFp_simple_points_equal(a, &a->generator->raw, &b->generator->raw);
  ------------------
  |  Branch (609:10): [True: 0, False: 0]
  ------------------
  610|      0|}
EC_GROUP_get0_order:
  616|     27|const BIGNUM *EC_GROUP_get0_order(const EC_GROUP *group) {
  617|     27|  assert(!BN_is_zero(&group->order));
  618|     27|  return &group->order;
  619|     27|}
EC_GROUP_get_curve_GFp:
  639|    681|                           BIGNUM *out_b, BN_CTX *ctx) {
  640|    681|  return ec_GFp_simple_group_get_curve(group, out_p, out_a, out_b);
  641|    681|}
EC_GROUP_get_curve_name:
  643|     27|int EC_GROUP_get_curve_name(const EC_GROUP *group) { return group->curve_name; }
EC_POINT_new:
  679|  1.17k|EC_POINT *EC_POINT_new(const EC_GROUP *group) {
  680|  1.17k|  if (group == NULL) {
  ------------------
  |  Branch (680:7): [True: 0, False: 1.17k]
  ------------------
  681|      0|    OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  682|      0|    return NULL;
  683|      0|  }
  684|       |
  685|  1.17k|  EC_POINT *ret = OPENSSL_malloc(sizeof *ret);
  686|  1.17k|  if (ret == NULL) {
  ------------------
  |  Branch (686:7): [True: 0, False: 1.17k]
  ------------------
  687|      0|    return NULL;
  688|      0|  }
  689|       |
  690|  1.17k|  ret->group = EC_GROUP_dup(group);
  691|  1.17k|  ec_GFp_simple_point_init(&ret->raw);
  692|  1.17k|  return ret;
  693|  1.17k|}
EC_POINT_free:
  705|  1.16k|void EC_POINT_free(EC_POINT *point) {
  706|  1.16k|  ec_point_free(point, 1 /* free group */);
  707|  1.16k|}
EC_POINT_is_at_infinity:
  747|    456|int EC_POINT_is_at_infinity(const EC_GROUP *group, const EC_POINT *point) {
  748|    456|  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
  ------------------
  |  Branch (748:7): [True: 0, False: 456]
  ------------------
  749|      0|    OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  750|      0|    return 0;
  751|      0|  }
  752|    456|  return ec_GFp_simple_is_at_infinity(group, &point->raw);
  753|    456|}
EC_POINT_is_on_curve:
  756|    456|                         BN_CTX *ctx) {
  757|    456|  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
  ------------------
  |  Branch (757:7): [True: 0, False: 456]
  ------------------
  758|      0|    OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  759|      0|    return 0;
  760|      0|  }
  761|    456|  return ec_GFp_simple_is_on_curve(group, &point->raw);
  762|    456|}
ec_affine_to_jacobian:
  805|    485|                           const EC_AFFINE *p) {
  806|    485|  out->X = p->X;
  807|    485|  out->Y = p->Y;
  808|    485|  out->Z = group->one;
  809|    485|}
ec_point_set_affine_coordinates:
  826|    487|                                    const EC_FELEM *x, const EC_FELEM *y) {
  827|    487|  void (*const felem_mul)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a,
  828|    487|                          const EC_FELEM *b) = group->meth->felem_mul;
  829|    487|  void (*const felem_sqr)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a) =
  830|    487|      group->meth->felem_sqr;
  831|       |
  832|       |  // Check if the point is on the curve.
  833|    487|  EC_FELEM lhs, rhs;
  834|    487|  felem_sqr(group, &lhs, y);                   // lhs = y^2
  835|    487|  felem_sqr(group, &rhs, x);                   // rhs = x^2
  836|    487|  ec_felem_add(group, &rhs, &rhs, &group->a);  // rhs = x^2 + a
  837|    487|  felem_mul(group, &rhs, &rhs, x);             // rhs = x^3 + ax
  838|    487|  ec_felem_add(group, &rhs, &rhs, &group->b);  // rhs = x^3 + ax + b
  839|    487|  if (!ec_felem_equal(group, &lhs, &rhs)) {
  ------------------
  |  Branch (839:7): [True: 2, False: 485]
  ------------------
  840|      2|    OPENSSL_PUT_ERROR(EC, EC_R_POINT_IS_NOT_ON_CURVE);
  ------------------
  |  |  441|      2|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  841|       |    // In the event of an error, defend against the caller not checking the
  842|       |    // return value by setting a known safe value. Note this may not be possible
  843|       |    // if the caller is in the process of constructing an arbitrary group and
  844|       |    // the generator is missing.
  845|      2|    if (group->generator != NULL) {
  ------------------
  |  Branch (845:9): [True: 2, False: 0]
  ------------------
  846|      2|      assert(ec_felem_equal(group, &group->one, &group->generator->raw.Z));
  847|      2|      out->X = group->generator->raw.X;
  848|      2|      out->Y = group->generator->raw.Y;
  849|      2|    }
  850|      2|    return 0;
  851|      2|  }
  852|       |
  853|    485|  out->X = *x;
  854|    485|  out->Y = *y;
  855|    485|  return 1;
  856|    487|}
EC_POINT_set_affine_coordinates_GFp:
  860|    481|                                        BN_CTX *ctx) {
  861|    481|  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
  ------------------
  |  Branch (861:7): [True: 0, False: 481]
  ------------------
  862|      0|    OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  863|      0|    return 0;
  864|      0|  }
  865|       |
  866|    481|  if (x == NULL || y == NULL) {
  ------------------
  |  Branch (866:7): [True: 0, False: 481]
  |  Branch (866:20): [True: 0, False: 481]
  ------------------
  867|      0|    OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  868|      0|    return 0;
  869|      0|  }
  870|       |
  871|    481|  EC_FELEM x_felem, y_felem;
  872|    481|  EC_AFFINE affine;
  873|    481|  if (!ec_bignum_to_felem(group, &x_felem, x) ||
  ------------------
  |  Branch (873:7): [True: 0, False: 481]
  ------------------
  874|    481|      !ec_bignum_to_felem(group, &y_felem, y) ||
  ------------------
  |  Branch (874:7): [True: 0, False: 481]
  ------------------
  875|    481|      !ec_point_set_affine_coordinates(group, &affine, &x_felem, &y_felem)) {
  ------------------
  |  Branch (875:7): [True: 0, False: 481]
  ------------------
  876|       |    // In the event of an error, defend against the caller not checking the
  877|       |    // return value by setting a known safe value.
  878|      0|    ec_set_to_safe_point(group, &point->raw);
  879|      0|    return 0;
  880|      0|  }
  881|       |
  882|    481|  ec_affine_to_jacobian(group, &point->raw, &affine);
  883|    481|  return 1;
  884|    481|}
ec_point_mul_scalar_base:
 1068|    702|                             const EC_SCALAR *scalar) {
 1069|    702|  if (scalar == NULL) {
  ------------------
  |  Branch (1069:7): [True: 0, False: 702]
  ------------------
 1070|      0|    OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
 1071|      0|    return 0;
 1072|      0|  }
 1073|       |
 1074|    702|  group->meth->mul_base(group, r, scalar);
 1075|       |
 1076|       |  // Check the result is on the curve to defend against fault attacks or bugs.
 1077|       |  // This has negligible cost compared to the multiplication. This can only
 1078|       |  // happen on bug or CPU fault, so it okay to leak this. The alternative would
 1079|       |  // be to proceed with bad data.
 1080|    702|  if (!constant_time_declassify_int(ec_GFp_simple_is_on_curve(group, r))) {
  ------------------
  |  Branch (1080:7): [True: 0, False: 702]
  ------------------
 1081|      0|    OPENSSL_PUT_ERROR(EC, ERR_R_INTERNAL_ERROR);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
 1082|      0|    return 0;
 1083|      0|  }
 1084|       |
 1085|    702|  return 1;
 1086|    702|}
ec_point_select:
 1143|   898k|                      const EC_JACOBIAN *a, const EC_JACOBIAN *b) {
 1144|   898k|  ec_felem_select(group, &out->X, mask, &a->X, &b->X);
 1145|   898k|  ec_felem_select(group, &out->Y, mask, &a->Y, &b->Y);
 1146|   898k|  ec_felem_select(group, &out->Z, mask, &a->Z, &b->Z);
 1147|   898k|}
ec_set_to_safe_point:
 1224|     30|void ec_set_to_safe_point(const EC_GROUP *group, EC_JACOBIAN *out) {
 1225|     30|  if (group->generator != NULL) {
  ------------------
  |  Branch (1225:7): [True: 30, False: 0]
  ------------------
 1226|     30|    ec_GFp_simple_point_copy(out, &group->generator->raw);
 1227|     30|  } else {
 1228|       |    // The generator can be missing if the caller is in the process of
 1229|       |    // constructing an arbitrary group. In this case, we give up and use the
 1230|       |    // point at infinity.
 1231|      0|    ec_GFp_simple_point_set_to_infinity(group, out);
 1232|      0|  }
 1233|     30|}
bcm.c:OPENSSL_built_in_curves_do_init:
  218|      1|DEFINE_METHOD_FUNCTION(struct built_in_curves, OPENSSL_built_in_curves) {
  219|       |  // 1.3.132.0.35
  220|      1|  static const uint8_t kOIDP521[] = {0x2b, 0x81, 0x04, 0x00, 0x23};
  221|      1|  out->curves[0].nid = NID_secp521r1;
  ------------------
  |  | 3172|      1|#define NID_secp521r1 716
  ------------------
  222|      1|  out->curves[0].oid = kOIDP521;
  223|      1|  out->curves[0].oid_len = sizeof(kOIDP521);
  224|      1|  out->curves[0].comment = "NIST P-521";
  225|      1|  out->curves[0].param_len = 66;
  226|      1|  out->curves[0].params = kP521Params;
  227|      1|  out->curves[0].method = EC_GFp_mont_method();
  228|       |
  229|       |  // 1.3.132.0.34
  230|      1|  static const uint8_t kOIDP384[] = {0x2b, 0x81, 0x04, 0x00, 0x22};
  231|      1|  out->curves[1].nid = NID_secp384r1;
  ------------------
  |  | 3168|      1|#define NID_secp384r1 715
  ------------------
  232|      1|  out->curves[1].oid = kOIDP384;
  233|      1|  out->curves[1].oid_len = sizeof(kOIDP384);
  234|      1|  out->curves[1].comment = "NIST P-384";
  235|      1|  out->curves[1].param_len = 48;
  236|      1|  out->curves[1].params = kP384Params;
  237|      1|  out->curves[1].method = EC_GFp_mont_method();
  238|       |
  239|       |  // 1.2.840.10045.3.1.7
  240|      1|  static const uint8_t kOIDP256[] = {0x2a, 0x86, 0x48, 0xce,
  241|      1|                                     0x3d, 0x03, 0x01, 0x07};
  242|      1|  out->curves[2].nid = NID_X9_62_prime256v1;
  ------------------
  |  | 1914|      1|#define NID_X9_62_prime256v1 415
  ------------------
  243|      1|  out->curves[2].oid = kOIDP256;
  244|      1|  out->curves[2].oid_len = sizeof(kOIDP256);
  245|      1|  out->curves[2].comment = "NIST P-256";
  246|      1|  out->curves[2].param_len = 32;
  247|      1|  out->curves[2].params = kP256Params;
  248|      1|  out->curves[2].method =
  249|      1|#if !defined(OPENSSL_NO_ASM) && \
  250|      1|    (defined(OPENSSL_X86_64) || defined(OPENSSL_AARCH64)) &&   \
  251|      1|    !defined(OPENSSL_SMALL)
  252|      1|      EC_GFp_nistz256_method();
  253|       |#else
  254|       |      EC_GFp_nistp256_method();
  255|       |#endif
  256|       |
  257|       |  // 1.3.132.0.33
  258|      1|  static const uint8_t kOIDP224[] = {0x2b, 0x81, 0x04, 0x00, 0x21};
  259|      1|  out->curves[3].nid = NID_secp224r1;
  ------------------
  |  | 3160|      1|#define NID_secp224r1 713
  ------------------
  260|      1|  out->curves[3].oid = kOIDP224;
  261|      1|  out->curves[3].oid_len = sizeof(kOIDP224);
  262|      1|  out->curves[3].comment = "NIST P-224";
  263|      1|  out->curves[3].param_len = 28;
  264|      1|  out->curves[3].params = kP224Params;
  265|      1|  out->curves[3].method =
  266|      1|#if defined(BORINGSSL_HAS_UINT128) && !defined(OPENSSL_SMALL)
  267|      1|      EC_GFp_nistp224_method();
  268|       |#else
  269|       |      EC_GFp_mont_method();
  270|       |#endif
  271|      1|}
bcm.c:ec_group_set_generator:
  305|      4|                                  const BIGNUM *order) {
  306|      4|  assert(group->generator == NULL);
  307|       |
  308|      4|  if (!BN_copy(&group->order, order)) {
  ------------------
  |  Branch (308:7): [True: 0, False: 4]
  ------------------
  309|      0|    return 0;
  310|      0|  }
  311|       |  // Store the order in minimal form, so it can be used with |BN_ULONG| arrays.
  312|      4|  bn_set_minimal_width(&group->order);
  313|       |
  314|      4|  BN_MONT_CTX_free(group->order_mont);
  315|      4|  group->order_mont = BN_MONT_CTX_new_for_modulus(&group->order, NULL);
  316|      4|  if (group->order_mont == NULL) {
  ------------------
  |  Branch (316:7): [True: 0, False: 4]
  ------------------
  317|      0|    return 0;
  318|      0|  }
  319|       |
  320|      4|  group->field_greater_than_order = BN_cmp(&group->field, order) > 0;
  321|      4|  if (group->field_greater_than_order) {
  ------------------
  |  Branch (321:7): [True: 4, False: 0]
  ------------------
  322|      4|    BIGNUM tmp;
  323|      4|    BN_init(&tmp);
  324|      4|    int ok =
  325|      4|        BN_sub(&tmp, &group->field, order) &&
  ------------------
  |  Branch (325:9): [True: 4, False: 0]
  ------------------
  326|      4|        bn_copy_words(group->field_minus_order.words, group->field.width, &tmp);
  ------------------
  |  Branch (326:9): [True: 4, False: 0]
  ------------------
  327|      4|    BN_free(&tmp);
  328|      4|    if (!ok) {
  ------------------
  |  Branch (328:9): [True: 0, False: 4]
  ------------------
  329|      0|      return 0;
  330|      0|    }
  331|      4|  }
  332|       |
  333|      4|  group->generator = EC_POINT_new(group);
  334|      4|  if (group->generator == NULL) {
  ------------------
  |  Branch (334:7): [True: 0, False: 4]
  ------------------
  335|      0|    return 0;
  336|      0|  }
  337|      4|  ec_affine_to_jacobian(group, &group->generator->raw, generator);
  338|      4|  assert(ec_felem_equal(group, &group->one, &group->generator->raw.Z));
  339|       |
  340|       |  // Avoid a reference cycle. |group->generator| does not maintain an owning
  341|       |  // pointer to |group|.
  342|      4|  int is_zero = CRYPTO_refcount_dec_and_test_zero(&group->references);
  343|       |
  344|      4|  assert(!is_zero);
  345|      4|  (void)is_zero;
  346|      4|  return 1;
  347|      4|}
bcm.c:ec_group_new_from_data:
  442|      4|static EC_GROUP *ec_group_new_from_data(const struct built_in_curve *curve) {
  443|      4|  EC_GROUP *group = NULL;
  444|      4|  BIGNUM *p = NULL, *a = NULL, *b = NULL, *order = NULL;
  445|      4|  int ok = 0;
  446|       |
  447|      4|  BN_CTX *ctx = BN_CTX_new();
  448|      4|  if (ctx == NULL) {
  ------------------
  |  Branch (448:7): [True: 0, False: 4]
  ------------------
  449|      0|    goto err;
  450|      0|  }
  451|       |
  452|      4|  const unsigned param_len = curve->param_len;
  453|      4|  const uint8_t *params = curve->params;
  454|       |
  455|      4|  if (!(p = BN_bin2bn(params + 0 * param_len, param_len, NULL)) ||
  ------------------
  |  Branch (455:7): [True: 0, False: 4]
  ------------------
  456|      4|      !(a = BN_bin2bn(params + 1 * param_len, param_len, NULL)) ||
  ------------------
  |  Branch (456:7): [True: 0, False: 4]
  ------------------
  457|      4|      !(b = BN_bin2bn(params + 2 * param_len, param_len, NULL)) ||
  ------------------
  |  Branch (457:7): [True: 0, False: 4]
  ------------------
  458|      4|      !(order = BN_bin2bn(params + 5 * param_len, param_len, NULL))) {
  ------------------
  |  Branch (458:7): [True: 0, False: 4]
  ------------------
  459|      0|    OPENSSL_PUT_ERROR(EC, ERR_R_BN_LIB);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  460|      0|    goto err;
  461|      0|  }
  462|       |
  463|      4|  group = ec_group_new(curve->method);
  464|      4|  if (group == NULL ||
  ------------------
  |  Branch (464:7): [True: 0, False: 4]
  ------------------
  465|      4|      !group->meth->group_set_curve(group, p, a, b, ctx)) {
  ------------------
  |  Branch (465:7): [True: 0, False: 4]
  ------------------
  466|      0|    OPENSSL_PUT_ERROR(EC, ERR_R_EC_LIB);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  467|      0|    goto err;
  468|      0|  }
  469|       |
  470|      4|  EC_AFFINE G;
  471|      4|  EC_FELEM x, y;
  472|      4|  if (!ec_felem_from_bytes(group, &x, params + 3 * param_len, param_len) ||
  ------------------
  |  Branch (472:7): [True: 0, False: 4]
  ------------------
  473|      4|      !ec_felem_from_bytes(group, &y, params + 4 * param_len, param_len) ||
  ------------------
  |  Branch (473:7): [True: 0, False: 4]
  ------------------
  474|      4|      !ec_point_set_affine_coordinates(group, &G, &x, &y)) {
  ------------------
  |  Branch (474:7): [True: 0, False: 4]
  ------------------
  475|      0|    goto err;
  476|      0|  }
  477|       |
  478|      4|  if (!ec_group_set_generator(group, &G, order)) {
  ------------------
  |  Branch (478:7): [True: 0, False: 4]
  ------------------
  479|      0|    goto err;
  480|      0|  }
  481|       |
  482|      4|  ok = 1;
  483|       |
  484|      4|err:
  485|      4|  if (!ok) {
  ------------------
  |  Branch (485:7): [True: 0, False: 4]
  ------------------
  486|      0|    EC_GROUP_free(group);
  487|      0|    group = NULL;
  488|      0|  }
  489|      4|  BN_CTX_free(ctx);
  490|      4|  BN_free(p);
  491|      4|  BN_free(a);
  492|      4|  BN_free(b);
  493|      4|  BN_free(order);
  494|      4|  return group;
  495|      4|}
bcm.c:ec_point_free:
  695|  1.16k|static void ec_point_free(EC_POINT *point, int free_group) {
  696|  1.16k|  if (!point) {
  ------------------
  |  Branch (696:7): [True: 0, False: 1.16k]
  ------------------
  697|      0|    return;
  698|      0|  }
  699|  1.16k|  if (free_group) {
  ------------------
  |  Branch (699:7): [True: 1.16k, False: 0]
  ------------------
  700|  1.16k|    EC_GROUP_free(point->group);
  701|  1.16k|  }
  702|  1.16k|  OPENSSL_free(point);
  703|  1.16k|}

EC_KEY_new:
  106|  1.16k|EC_KEY *EC_KEY_new(void) { return EC_KEY_new_method(NULL); }
EC_KEY_new_method:
  108|  1.16k|EC_KEY *EC_KEY_new_method(const ENGINE *engine) {
  109|  1.16k|  EC_KEY *ret = OPENSSL_malloc(sizeof(EC_KEY));
  110|  1.16k|  if (ret == NULL) {
  ------------------
  |  Branch (110:7): [True: 0, False: 1.16k]
  ------------------
  111|      0|    return NULL;
  112|      0|  }
  113|       |
  114|  1.16k|  OPENSSL_memset(ret, 0, sizeof(EC_KEY));
  115|       |
  116|  1.16k|  if (engine) {
  ------------------
  |  Branch (116:7): [True: 0, False: 1.16k]
  ------------------
  117|      0|    ret->ecdsa_meth = ENGINE_get_ECDSA_method(engine);
  118|      0|  }
  119|  1.16k|  if (ret->ecdsa_meth) {
  ------------------
  |  Branch (119:7): [True: 0, False: 1.16k]
  ------------------
  120|      0|    METHOD_ref(ret->ecdsa_meth);
  121|      0|  }
  122|       |
  123|  1.16k|  ret->conv_form = POINT_CONVERSION_UNCOMPRESSED;
  124|  1.16k|  ret->references = 1;
  125|       |
  126|  1.16k|  CRYPTO_new_ex_data(&ret->ex_data);
  127|       |
  128|  1.16k|  if (ret->ecdsa_meth && ret->ecdsa_meth->init && !ret->ecdsa_meth->init(ret)) {
  ------------------
  |  Branch (128:7): [True: 0, False: 1.16k]
  |  Branch (128:26): [True: 0, False: 0]
  |  Branch (128:51): [True: 0, False: 0]
  ------------------
  129|      0|    CRYPTO_free_ex_data(g_ec_ex_data_class_bss_get(), ret, &ret->ex_data);
  130|      0|    if (ret->ecdsa_meth) {
  ------------------
  |  Branch (130:9): [True: 0, False: 0]
  ------------------
  131|      0|      METHOD_unref(ret->ecdsa_meth);
  132|      0|    }
  133|      0|    OPENSSL_free(ret);
  134|      0|    return NULL;
  135|      0|  }
  136|       |
  137|  1.16k|  return ret;
  138|  1.16k|}
EC_KEY_free:
  153|  4.99k|void EC_KEY_free(EC_KEY *r) {
  154|  4.99k|  if (r == NULL) {
  ------------------
  |  Branch (154:7): [True: 3.82k, False: 1.16k]
  ------------------
  155|  3.82k|    return;
  156|  3.82k|  }
  157|       |
  158|  1.16k|  if (!CRYPTO_refcount_dec_and_test_zero(&r->references)) {
  ------------------
  |  Branch (158:7): [True: 0, False: 1.16k]
  ------------------
  159|      0|    return;
  160|      0|  }
  161|       |
  162|  1.16k|  if (r->ecdsa_meth) {
  ------------------
  |  Branch (162:7): [True: 0, False: 1.16k]
  ------------------
  163|      0|    if (r->ecdsa_meth->finish) {
  ------------------
  |  Branch (163:9): [True: 0, False: 0]
  ------------------
  164|      0|      r->ecdsa_meth->finish(r);
  165|      0|    }
  166|      0|    METHOD_unref(r->ecdsa_meth);
  167|      0|  }
  168|       |
  169|  1.16k|  EC_GROUP_free(r->group);
  170|  1.16k|  EC_POINT_free(r->pub_key);
  171|  1.16k|  ec_wrapped_scalar_free(r->priv_key);
  172|       |
  173|  1.16k|  CRYPTO_free_ex_data(g_ec_ex_data_class_bss_get(), r, &r->ex_data);
  174|       |
  175|  1.16k|  OPENSSL_free(r);
  176|  1.16k|}
EC_KEY_get0_group:
  213|     27|const EC_GROUP *EC_KEY_get0_group(const EC_KEY *key) { return key->group; }
EC_KEY_set_group:
  215|  1.16k|int EC_KEY_set_group(EC_KEY *key, const EC_GROUP *group) {
  216|       |  // If |key| already has a group, it is an error to switch to another one.
  217|  1.16k|  if (key->group != NULL) {
  ------------------
  |  Branch (217:7): [True: 0, False: 1.16k]
  ------------------
  218|      0|    if (EC_GROUP_cmp(key->group, group, NULL) != 0) {
  ------------------
  |  Branch (218:9): [True: 0, False: 0]
  ------------------
  219|      0|      OPENSSL_PUT_ERROR(EC, EC_R_GROUP_MISMATCH);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  220|      0|      return 0;
  221|      0|    }
  222|      0|    return 1;
  223|      0|  }
  224|       |
  225|  1.16k|  assert(key->priv_key == NULL);
  226|  1.16k|  assert(key->pub_key == NULL);
  227|       |
  228|  1.16k|  EC_GROUP_free(key->group);
  229|  1.16k|  key->group = EC_GROUP_dup(group);
  230|  1.16k|  return key->group != NULL;
  231|  1.16k|}
EC_KEY_get0_private_key:
  233|     27|const BIGNUM *EC_KEY_get0_private_key(const EC_KEY *key) {
  234|     27|  return key->priv_key != NULL ? &key->priv_key->bignum : NULL;
  ------------------
  |  Branch (234:10): [True: 27, False: 0]
  ------------------
  235|     27|}
EC_KEY_set_private_key:
  237|  1.16k|int EC_KEY_set_private_key(EC_KEY *key, const BIGNUM *priv_key) {
  238|  1.16k|  if (key->group == NULL) {
  ------------------
  |  Branch (238:7): [True: 0, False: 1.16k]
  ------------------
  239|      0|    OPENSSL_PUT_ERROR(EC, EC_R_MISSING_PARAMETERS);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  240|      0|    return 0;
  241|      0|  }
  242|       |
  243|  1.16k|  EC_WRAPPED_SCALAR *scalar = ec_wrapped_scalar_new(key->group);
  244|  1.16k|  if (scalar == NULL) {
  ------------------
  |  Branch (244:7): [True: 0, False: 1.16k]
  ------------------
  245|      0|    return 0;
  246|      0|  }
  247|  1.16k|  if (!ec_bignum_to_scalar(key->group, &scalar->scalar, priv_key) ||
  ------------------
  |  Branch (247:7): [True: 143, False: 1.02k]
  ------------------
  248|  1.16k|      ec_scalar_is_zero(key->group, &scalar->scalar)) {
  ------------------
  |  Branch (248:7): [True: 2, False: 1.02k]
  ------------------
  249|    145|    OPENSSL_PUT_ERROR(EC, EC_R_INVALID_PRIVATE_KEY);
  ------------------
  |  |  441|    145|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  250|    145|    ec_wrapped_scalar_free(scalar);
  251|    145|    return 0;
  252|    145|  }
  253|  1.02k|  ec_wrapped_scalar_free(key->priv_key);
  254|  1.02k|  key->priv_key = scalar;
  255|  1.02k|  return 1;
  256|  1.16k|}
EC_KEY_get_enc_flags:
  278|     27|unsigned int EC_KEY_get_enc_flags(const EC_KEY *key) { return key->enc_flag; }
EC_KEY_check_key:
  292|    456|int EC_KEY_check_key(const EC_KEY *eckey) {
  293|    456|  if (!eckey || !eckey->group || !eckey->pub_key) {
  ------------------
  |  Branch (293:7): [True: 0, False: 456]
  |  Branch (293:17): [True: 0, False: 456]
  |  Branch (293:34): [True: 0, False: 456]
  ------------------
  294|      0|    OPENSSL_PUT_ERROR(EC, ERR_R_PASSED_NULL_PARAMETER);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  295|      0|    return 0;
  296|      0|  }
  297|       |
  298|    456|  if (EC_POINT_is_at_infinity(eckey->group, eckey->pub_key)) {
  ------------------
  |  Branch (298:7): [True: 0, False: 456]
  ------------------
  299|      0|    OPENSSL_PUT_ERROR(EC, EC_R_POINT_AT_INFINITY);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  300|      0|    return 0;
  301|      0|  }
  302|       |
  303|       |  // Test whether the public key is on the elliptic curve.
  304|    456|  if (!EC_POINT_is_on_curve(eckey->group, eckey->pub_key, NULL)) {
  ------------------
  |  Branch (304:7): [True: 0, False: 456]
  ------------------
  305|      0|    OPENSSL_PUT_ERROR(EC, EC_R_POINT_IS_NOT_ON_CURVE);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  306|      0|    return 0;
  307|      0|  }
  308|       |
  309|       |  // Check the public and private keys match.
  310|       |  //
  311|       |  // NOTE: this is a FIPS pair-wise consistency check for the ECDH case. See SP
  312|       |  // 800-56Ar3, page 36.
  313|    456|  if (eckey->priv_key != NULL) {
  ------------------
  |  Branch (313:7): [True: 456, False: 0]
  ------------------
  314|    456|    EC_JACOBIAN point;
  315|    456|    if (!ec_point_mul_scalar_base(eckey->group, &point,
  ------------------
  |  Branch (315:9): [True: 0, False: 456]
  ------------------
  316|    456|                                  &eckey->priv_key->scalar)) {
  317|      0|      OPENSSL_PUT_ERROR(EC, ERR_R_EC_LIB);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  318|      0|      return 0;
  319|      0|    }
  320|    456|    if (!ec_GFp_simple_points_equal(eckey->group, &point,
  ------------------
  |  Branch (320:9): [True: 307, False: 149]
  ------------------
  321|    456|                                    &eckey->pub_key->raw)) {
  322|    307|      OPENSSL_PUT_ERROR(EC, EC_R_INVALID_PRIVATE_KEY);
  ------------------
  |  |  441|    307|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  323|    307|      return 0;
  324|    307|    }
  325|    456|  }
  326|       |
  327|    149|  return 1;
  328|    456|}
bcm.c:ec_wrapped_scalar_free:
  102|  2.33k|static void ec_wrapped_scalar_free(EC_WRAPPED_SCALAR *scalar) {
  103|  2.33k|  OPENSSL_free(scalar);
  104|  2.33k|}
bcm.c:ec_wrapped_scalar_new:
   88|  1.16k|static EC_WRAPPED_SCALAR *ec_wrapped_scalar_new(const EC_GROUP *group) {
   89|  1.16k|  EC_WRAPPED_SCALAR *wrapped = OPENSSL_malloc(sizeof(EC_WRAPPED_SCALAR));
   90|  1.16k|  if (wrapped == NULL) {
  ------------------
  |  Branch (90:7): [True: 0, False: 1.16k]
  ------------------
   91|      0|    return NULL;
   92|      0|  }
   93|       |
   94|  1.16k|  OPENSSL_memset(wrapped, 0, sizeof(EC_WRAPPED_SCALAR));
   95|  1.16k|  wrapped->bignum.d = wrapped->scalar.words;
   96|  1.16k|  wrapped->bignum.width = group->order.width;
   97|  1.16k|  wrapped->bignum.dmax = group->order.width;
   98|  1.16k|  wrapped->bignum.flags = BN_FLG_STATIC_DATA;
  ------------------
  |  | 1027|  1.16k|#define BN_FLG_STATIC_DATA 0x02
  ------------------
   99|  1.16k|  return wrapped;
  100|  1.16k|}

ec_GFp_mont_group_init:
   79|      3|int ec_GFp_mont_group_init(EC_GROUP *group) {
   80|      3|  int ok;
   81|       |
   82|      3|  ok = ec_GFp_simple_group_init(group);
   83|      3|  group->mont = NULL;
   84|      3|  return ok;
   85|      3|}
ec_GFp_mont_group_set_curve:
   94|      3|                                const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx) {
   95|      3|  BN_MONT_CTX_free(group->mont);
   96|      3|  group->mont = BN_MONT_CTX_new_for_modulus(p, ctx);
   97|      3|  if (group->mont == NULL) {
  ------------------
  |  Branch (97:7): [True: 0, False: 3]
  ------------------
   98|      0|    OPENSSL_PUT_ERROR(EC, ERR_R_BN_LIB);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   99|      0|    return 0;
  100|      0|  }
  101|       |
  102|      3|  if (!ec_GFp_simple_group_set_curve(group, p, a, b, ctx)) {
  ------------------
  |  Branch (102:7): [True: 0, False: 3]
  ------------------
  103|      0|    BN_MONT_CTX_free(group->mont);
  104|      0|    group->mont = NULL;
  105|      0|    return 0;
  106|      0|  }
  107|       |
  108|      3|  return 1;
  109|      3|}
ec_GFp_mont_felem_mul:
  131|   785k|                           const EC_FELEM *a, const EC_FELEM *b) {
  132|   785k|  bn_mod_mul_montgomery_small(r->words, a->words, b->words, group->field.width,
  133|   785k|                              group->mont);
  134|   785k|}
ec_GFp_mont_felem_sqr:
  137|   880k|                           const EC_FELEM *a) {
  138|   880k|  bn_mod_mul_montgomery_small(r->words, a->words, a->words, group->field.width,
  139|   880k|                              group->mont);
  140|   880k|}
ec_GFp_mont_felem_to_bytes:
  143|    822|                                size_t *out_len, const EC_FELEM *in) {
  144|    822|  EC_FELEM tmp;
  145|    822|  ec_GFp_mont_felem_from_montgomery(group, &tmp, in);
  146|    822|  ec_GFp_simple_felem_to_bytes(group, out, out_len, &tmp);
  147|    822|}
ec_GFp_mont_felem_from_bytes:
  150|    554|                                 const uint8_t *in, size_t len) {
  151|    554|  if (!ec_GFp_simple_felem_from_bytes(group, out, in, len)) {
  ------------------
  |  Branch (151:7): [True: 2, False: 552]
  ------------------
  152|      2|    return 0;
  153|      2|  }
  154|       |
  155|    552|  ec_GFp_mont_felem_to_montgomery(group, out, out);
  156|    552|  return 1;
  157|    554|}
ec_GFp_mont_add:
  251|  31.9k|                     const EC_JACOBIAN *a, const EC_JACOBIAN *b) {
  252|  31.9k|  if (a == b) {
  ------------------
  |  Branch (252:7): [True: 0, False: 31.9k]
  ------------------
  253|      0|    ec_GFp_mont_dbl(group, out, a);
  254|      0|    return;
  255|      0|  }
  256|       |
  257|       |  // The method is taken from:
  258|       |  //   http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#addition-add-2007-bl
  259|       |  //
  260|       |  // Coq transcription and correctness proof:
  261|       |  // <https://github.com/davidben/fiat-crypto/blob/c7b95f62b2a54b559522573310e9b487327d219a/src/Curves/Weierstrass/Jacobian.v#L467>
  262|       |  // <https://github.com/davidben/fiat-crypto/blob/c7b95f62b2a54b559522573310e9b487327d219a/src/Curves/Weierstrass/Jacobian.v#L544>
  263|  31.9k|  EC_FELEM x_out, y_out, z_out;
  264|  31.9k|  BN_ULONG z1nz = ec_felem_non_zero_mask(group, &a->Z);
  265|  31.9k|  BN_ULONG z2nz = ec_felem_non_zero_mask(group, &b->Z);
  266|       |
  267|       |  // z1z1 = z1z1 = z1**2
  268|  31.9k|  EC_FELEM z1z1;
  269|  31.9k|  ec_GFp_mont_felem_sqr(group, &z1z1, &a->Z);
  270|       |
  271|       |  // z2z2 = z2**2
  272|  31.9k|  EC_FELEM z2z2;
  273|  31.9k|  ec_GFp_mont_felem_sqr(group, &z2z2, &b->Z);
  274|       |
  275|       |  // u1 = x1*z2z2
  276|  31.9k|  EC_FELEM u1;
  277|  31.9k|  ec_GFp_mont_felem_mul(group, &u1, &a->X, &z2z2);
  278|       |
  279|       |  // two_z1z2 = (z1 + z2)**2 - (z1z1 + z2z2) = 2z1z2
  280|  31.9k|  EC_FELEM two_z1z2;
  281|  31.9k|  ec_felem_add(group, &two_z1z2, &a->Z, &b->Z);
  282|  31.9k|  ec_GFp_mont_felem_sqr(group, &two_z1z2, &two_z1z2);
  283|  31.9k|  ec_felem_sub(group, &two_z1z2, &two_z1z2, &z1z1);
  284|  31.9k|  ec_felem_sub(group, &two_z1z2, &two_z1z2, &z2z2);
  285|       |
  286|       |  // s1 = y1 * z2**3
  287|  31.9k|  EC_FELEM s1;
  288|  31.9k|  ec_GFp_mont_felem_mul(group, &s1, &b->Z, &z2z2);
  289|  31.9k|  ec_GFp_mont_felem_mul(group, &s1, &s1, &a->Y);
  290|       |
  291|       |  // u2 = x2*z1z1
  292|  31.9k|  EC_FELEM u2;
  293|  31.9k|  ec_GFp_mont_felem_mul(group, &u2, &b->X, &z1z1);
  294|       |
  295|       |  // h = u2 - u1
  296|  31.9k|  EC_FELEM h;
  297|  31.9k|  ec_felem_sub(group, &h, &u2, &u1);
  298|       |
  299|  31.9k|  BN_ULONG xneq = ec_felem_non_zero_mask(group, &h);
  300|       |
  301|       |  // z_out = two_z1z2 * h
  302|  31.9k|  ec_GFp_mont_felem_mul(group, &z_out, &h, &two_z1z2);
  303|       |
  304|       |  // z1z1z1 = z1 * z1z1
  305|  31.9k|  EC_FELEM z1z1z1;
  306|  31.9k|  ec_GFp_mont_felem_mul(group, &z1z1z1, &a->Z, &z1z1);
  307|       |
  308|       |  // s2 = y2 * z1**3
  309|  31.9k|  EC_FELEM s2;
  310|  31.9k|  ec_GFp_mont_felem_mul(group, &s2, &b->Y, &z1z1z1);
  311|       |
  312|       |  // r = (s2 - s1)*2
  313|  31.9k|  EC_FELEM r;
  314|  31.9k|  ec_felem_sub(group, &r, &s2, &s1);
  315|  31.9k|  ec_felem_add(group, &r, &r, &r);
  316|       |
  317|  31.9k|  BN_ULONG yneq = ec_felem_non_zero_mask(group, &r);
  318|       |
  319|       |  // This case will never occur in the constant-time |ec_GFp_mont_mul|.
  320|  31.9k|  BN_ULONG is_nontrivial_double = ~xneq & ~yneq & z1nz & z2nz;
  321|  31.9k|  if (constant_time_declassify_w(is_nontrivial_double)) {
  ------------------
  |  Branch (321:7): [True: 0, False: 31.9k]
  ------------------
  322|      0|    ec_GFp_mont_dbl(group, out, a);
  323|      0|    return;
  324|      0|  }
  325|       |
  326|       |  // I = (2h)**2
  327|  31.9k|  EC_FELEM i;
  328|  31.9k|  ec_felem_add(group, &i, &h, &h);
  329|  31.9k|  ec_GFp_mont_felem_sqr(group, &i, &i);
  330|       |
  331|       |  // J = h * I
  332|  31.9k|  EC_FELEM j;
  333|  31.9k|  ec_GFp_mont_felem_mul(group, &j, &h, &i);
  334|       |
  335|       |  // V = U1 * I
  336|  31.9k|  EC_FELEM v;
  337|  31.9k|  ec_GFp_mont_felem_mul(group, &v, &u1, &i);
  338|       |
  339|       |  // x_out = r**2 - J - 2V
  340|  31.9k|  ec_GFp_mont_felem_sqr(group, &x_out, &r);
  341|  31.9k|  ec_felem_sub(group, &x_out, &x_out, &j);
  342|  31.9k|  ec_felem_sub(group, &x_out, &x_out, &v);
  343|  31.9k|  ec_felem_sub(group, &x_out, &x_out, &v);
  344|       |
  345|       |  // y_out = r(V-x_out) - 2 * s1 * J
  346|  31.9k|  ec_felem_sub(group, &y_out, &v, &x_out);
  347|  31.9k|  ec_GFp_mont_felem_mul(group, &y_out, &y_out, &r);
  348|  31.9k|  EC_FELEM s1j;
  349|  31.9k|  ec_GFp_mont_felem_mul(group, &s1j, &s1, &j);
  350|  31.9k|  ec_felem_sub(group, &y_out, &y_out, &s1j);
  351|  31.9k|  ec_felem_sub(group, &y_out, &y_out, &s1j);
  352|       |
  353|  31.9k|  ec_felem_select(group, &x_out, z1nz, &x_out, &b->X);
  354|  31.9k|  ec_felem_select(group, &out->X, z2nz, &x_out, &a->X);
  355|  31.9k|  ec_felem_select(group, &y_out, z1nz, &y_out, &b->Y);
  356|  31.9k|  ec_felem_select(group, &out->Y, z2nz, &y_out, &a->Y);
  357|  31.9k|  ec_felem_select(group, &z_out, z1nz, &z_out, &b->Z);
  358|  31.9k|  ec_felem_select(group, &out->Z, z2nz, &z_out, &a->Z);
  359|  31.9k|}
ec_GFp_mont_dbl:
  362|   143k|                     const EC_JACOBIAN *a) {
  363|   143k|  if (group->a_is_minus3) {
  ------------------
  |  Branch (363:7): [True: 143k, False: 0]
  ------------------
  364|       |    // The method is taken from:
  365|       |    //   http://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b
  366|       |    //
  367|       |    // Coq transcription and correctness proof:
  368|       |    // <https://github.com/mit-plv/fiat-crypto/blob/79f8b5f39ed609339f0233098dee1a3c4e6b3080/src/Curves/Weierstrass/Jacobian.v#L93>
  369|       |    // <https://github.com/mit-plv/fiat-crypto/blob/79f8b5f39ed609339f0233098dee1a3c4e6b3080/src/Curves/Weierstrass/Jacobian.v#L201>
  370|   143k|    EC_FELEM delta, gamma, beta, ftmp, ftmp2, tmptmp, alpha, fourbeta;
  371|       |    // delta = z^2
  372|   143k|    ec_GFp_mont_felem_sqr(group, &delta, &a->Z);
  373|       |    // gamma = y^2
  374|   143k|    ec_GFp_mont_felem_sqr(group, &gamma, &a->Y);
  375|       |    // beta = x*gamma
  376|   143k|    ec_GFp_mont_felem_mul(group, &beta, &a->X, &gamma);
  377|       |
  378|       |    // alpha = 3*(x-delta)*(x+delta)
  379|   143k|    ec_felem_sub(group, &ftmp, &a->X, &delta);
  380|   143k|    ec_felem_add(group, &ftmp2, &a->X, &delta);
  381|       |
  382|   143k|    ec_felem_add(group, &tmptmp, &ftmp2, &ftmp2);
  383|   143k|    ec_felem_add(group, &ftmp2, &ftmp2, &tmptmp);
  384|   143k|    ec_GFp_mont_felem_mul(group, &alpha, &ftmp, &ftmp2);
  385|       |
  386|       |    // x' = alpha^2 - 8*beta
  387|   143k|    ec_GFp_mont_felem_sqr(group, &r->X, &alpha);
  388|   143k|    ec_felem_add(group, &fourbeta, &beta, &beta);
  389|   143k|    ec_felem_add(group, &fourbeta, &fourbeta, &fourbeta);
  390|   143k|    ec_felem_add(group, &tmptmp, &fourbeta, &fourbeta);
  391|   143k|    ec_felem_sub(group, &r->X, &r->X, &tmptmp);
  392|       |
  393|       |    // z' = (y + z)^2 - gamma - delta
  394|   143k|    ec_felem_add(group, &delta, &gamma, &delta);
  395|   143k|    ec_felem_add(group, &ftmp, &a->Y, &a->Z);
  396|   143k|    ec_GFp_mont_felem_sqr(group, &r->Z, &ftmp);
  397|   143k|    ec_felem_sub(group, &r->Z, &r->Z, &delta);
  398|       |
  399|       |    // y' = alpha*(4*beta - x') - 8*gamma^2
  400|   143k|    ec_felem_sub(group, &r->Y, &fourbeta, &r->X);
  401|   143k|    ec_felem_add(group, &gamma, &gamma, &gamma);
  402|   143k|    ec_GFp_mont_felem_sqr(group, &gamma, &gamma);
  403|   143k|    ec_GFp_mont_felem_mul(group, &r->Y, &alpha, &r->Y);
  404|   143k|    ec_felem_add(group, &gamma, &gamma, &gamma);
  405|   143k|    ec_felem_sub(group, &r->Y, &r->Y, &gamma);
  406|   143k|  } else {
  407|       |    // The method is taken from:
  408|       |    //   http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#doubling-dbl-2007-bl
  409|       |    //
  410|       |    // Coq transcription and correctness proof:
  411|       |    // <https://github.com/davidben/fiat-crypto/blob/c7b95f62b2a54b559522573310e9b487327d219a/src/Curves/Weierstrass/Jacobian.v#L102>
  412|       |    // <https://github.com/davidben/fiat-crypto/blob/c7b95f62b2a54b559522573310e9b487327d219a/src/Curves/Weierstrass/Jacobian.v#L534>
  413|      0|    EC_FELEM xx, yy, yyyy, zz;
  414|      0|    ec_GFp_mont_felem_sqr(group, &xx, &a->X);
  415|      0|    ec_GFp_mont_felem_sqr(group, &yy, &a->Y);
  416|      0|    ec_GFp_mont_felem_sqr(group, &yyyy, &yy);
  417|      0|    ec_GFp_mont_felem_sqr(group, &zz, &a->Z);
  418|       |
  419|       |    // s = 2*((x_in + yy)^2 - xx - yyyy)
  420|      0|    EC_FELEM s;
  421|      0|    ec_felem_add(group, &s, &a->X, &yy);
  422|      0|    ec_GFp_mont_felem_sqr(group, &s, &s);
  423|      0|    ec_felem_sub(group, &s, &s, &xx);
  424|      0|    ec_felem_sub(group, &s, &s, &yyyy);
  425|      0|    ec_felem_add(group, &s, &s, &s);
  426|       |
  427|       |    // m = 3*xx + a*zz^2
  428|      0|    EC_FELEM m;
  429|      0|    ec_GFp_mont_felem_sqr(group, &m, &zz);
  430|      0|    ec_GFp_mont_felem_mul(group, &m, &group->a, &m);
  431|      0|    ec_felem_add(group, &m, &m, &xx);
  432|      0|    ec_felem_add(group, &m, &m, &xx);
  433|      0|    ec_felem_add(group, &m, &m, &xx);
  434|       |
  435|       |    // x_out = m^2 - 2*s
  436|      0|    ec_GFp_mont_felem_sqr(group, &r->X, &m);
  437|      0|    ec_felem_sub(group, &r->X, &r->X, &s);
  438|      0|    ec_felem_sub(group, &r->X, &r->X, &s);
  439|       |
  440|       |    // z_out = (y_in + z_in)^2 - yy - zz
  441|      0|    ec_felem_add(group, &r->Z, &a->Y, &a->Z);
  442|      0|    ec_GFp_mont_felem_sqr(group, &r->Z, &r->Z);
  443|      0|    ec_felem_sub(group, &r->Z, &r->Z, &yy);
  444|      0|    ec_felem_sub(group, &r->Z, &r->Z, &zz);
  445|       |
  446|       |    // y_out = m*(s-x_out) - 8*yyyy
  447|      0|    ec_felem_add(group, &yyyy, &yyyy, &yyyy);
  448|      0|    ec_felem_add(group, &yyyy, &yyyy, &yyyy);
  449|      0|    ec_felem_add(group, &yyyy, &yyyy, &yyyy);
  450|      0|    ec_felem_sub(group, &r->Y, &s, &r->X);
  451|      0|    ec_GFp_mont_felem_mul(group, &r->Y, &r->Y, &m);
  452|      0|    ec_felem_sub(group, &r->Y, &r->Y, &yyyy);
  453|      0|  }
  454|   143k|}
bcm.c:ec_GFp_mont_felem_from_montgomery:
  119|    822|                                              const EC_FELEM *in) {
  120|    822|  bn_from_montgomery_small(out->words, group->field.width, in->words,
  121|    822|                           group->field.width, group->mont);
  122|    822|}
bcm.c:ec_GFp_mont_felem_to_montgomery:
  112|    552|                                            EC_FELEM *out, const EC_FELEM *in) {
  113|    552|  bn_to_montgomery_small(out->words, in->words, group->field.width,
  114|    552|                         group->mont);
  115|    552|}
bcm.c:EC_GFp_mont_method_do_init:
  501|      1|DEFINE_METHOD_FUNCTION(EC_METHOD, EC_GFp_mont_method) {
  502|      1|  out->group_init = ec_GFp_mont_group_init;
  503|      1|  out->group_finish = ec_GFp_mont_group_finish;
  504|      1|  out->group_set_curve = ec_GFp_mont_group_set_curve;
  505|      1|  out->point_get_affine_coordinates = ec_GFp_mont_point_get_affine_coordinates;
  506|      1|  out->jacobian_to_affine_batch = ec_GFp_mont_jacobian_to_affine_batch;
  507|      1|  out->add = ec_GFp_mont_add;
  508|      1|  out->dbl = ec_GFp_mont_dbl;
  509|      1|  out->mul = ec_GFp_mont_mul;
  510|      1|  out->mul_base = ec_GFp_mont_mul_base;
  511|      1|  out->mul_batch = ec_GFp_mont_mul_batch;
  512|      1|  out->mul_public_batch = ec_GFp_mont_mul_public_batch;
  513|      1|  out->init_precomp = ec_GFp_mont_init_precomp;
  514|      1|  out->mul_precomp = ec_GFp_mont_mul_precomp;
  515|      1|  out->felem_mul = ec_GFp_mont_felem_mul;
  516|      1|  out->felem_sqr = ec_GFp_mont_felem_sqr;
  517|      1|  out->felem_to_bytes = ec_GFp_mont_felem_to_bytes;
  518|      1|  out->felem_from_bytes = ec_GFp_mont_felem_from_bytes;
  519|      1|  out->felem_reduce = ec_GFp_mont_felem_reduce;
  520|      1|  out->felem_exp = ec_GFp_mont_felem_exp;
  521|      1|  out->scalar_inv0_montgomery = ec_simple_scalar_inv0_montgomery;
  522|      1|  out->scalar_to_montgomery_inv_vartime =
  523|      1|      ec_simple_scalar_to_montgomery_inv_vartime;
  524|      1|  out->cmp_x_coordinate = ec_GFp_mont_cmp_x_coordinate;
  525|      1|}

ec_bignum_to_felem:
   26|    974|int ec_bignum_to_felem(const EC_GROUP *group, EC_FELEM *out, const BIGNUM *in) {
   27|    974|  uint8_t bytes[EC_MAX_BYTES];
   28|    974|  size_t len = BN_num_bytes(&group->field);
   29|    974|  assert(sizeof(bytes) >= len);
   30|    974|  if (BN_is_negative(in) ||
  ------------------
  |  Branch (30:7): [True: 0, False: 974]
  ------------------
   31|    974|      BN_cmp(in, &group->field) >= 0 ||
  ------------------
  |  Branch (31:7): [True: 0, False: 974]
  ------------------
   32|    974|      !BN_bn2bin_padded(bytes, len, in)) {
  ------------------
  |  Branch (32:7): [True: 0, False: 974]
  ------------------
   33|      0|    OPENSSL_PUT_ERROR(EC, EC_R_COORDINATES_OUT_OF_RANGE);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   34|      0|    return 0;
   35|      0|  }
   36|       |
   37|    974|  return ec_felem_from_bytes(group, out, bytes, len);
   38|    974|}
ec_felem_to_bignum:
   40|  1.36k|int ec_felem_to_bignum(const EC_GROUP *group, BIGNUM *out, const EC_FELEM *in) {
   41|  1.36k|  uint8_t bytes[EC_MAX_BYTES];
   42|  1.36k|  size_t len;
   43|  1.36k|  ec_felem_to_bytes(group, bytes, &len, in);
   44|  1.36k|  return BN_bin2bn(bytes, len, out) != NULL;
   45|  1.36k|}
ec_felem_to_bytes:
   48|  1.36k|                       const EC_FELEM *in) {
   49|  1.36k|  group->meth->felem_to_bytes(group, out, out_len, in);
   50|  1.36k|}
ec_felem_from_bytes:
   53|    992|                        size_t len) {
   54|    992|  return group->meth->felem_from_bytes(group, out, in, len);
   55|    992|}
ec_felem_add:
   70|  1.53M|                  const EC_FELEM *b) {
   71|  1.53M|  EC_FELEM tmp;
   72|  1.53M|  bn_mod_add_words(out->words, a->words, b->words, group->field.d, tmp.words,
   73|  1.53M|                   group->field.width);
   74|  1.53M|}
ec_felem_sub:
   77|  1.03M|                  const EC_FELEM *b) {
   78|  1.03M|  EC_FELEM tmp;
   79|  1.03M|  bn_mod_sub_words(out->words, a->words, b->words, group->field.d, tmp.words,
   80|  1.03M|                   group->field.width);
   81|  1.03M|}
ec_felem_non_zero_mask:
   83|   132k|BN_ULONG ec_felem_non_zero_mask(const EC_GROUP *group, const EC_FELEM *a) {
   84|   132k|  BN_ULONG mask = 0;
   85|  1.26M|  for (int i = 0; i < group->field.width; i++) {
  ------------------
  |  Branch (85:19): [True: 1.13M, False: 132k]
  ------------------
   86|  1.13M|    mask |= a->words[i];
   87|  1.13M|  }
   88|   132k|  return ~constant_time_is_zero_w(mask);
   89|   132k|}
ec_felem_select:
   92|  2.88M|                     const EC_FELEM *a, const EC_FELEM *b) {
   93|  2.88M|  bn_select_words(out->words, mask, a->words, b->words, group->field.width);
   94|  2.88M|}
ec_felem_equal:
   97|    493|                   const EC_FELEM *b) {
   98|    493|  return CRYPTO_memcmp(a->words, b->words,
   99|    493|                       group->field.width * sizeof(BN_ULONG)) == 0;
  100|    493|}

ec_point_from_uncompressed:
  119|     30|                               const uint8_t *in, size_t len) {
  120|     30|  const size_t field_len = BN_num_bytes(&group->field);
  121|     30|  if (len != 1 + 2 * field_len || in[0] != POINT_CONVERSION_UNCOMPRESSED) {
  ------------------
  |  Branch (121:7): [True: 24, False: 6]
  |  Branch (121:35): [True: 0, False: 6]
  ------------------
  122|     24|    OPENSSL_PUT_ERROR(EC, EC_R_INVALID_ENCODING);
  ------------------
  |  |  441|     24|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  123|     24|    return 0;
  124|     24|  }
  125|       |
  126|      6|  EC_FELEM x, y;
  127|      6|  if (!ec_felem_from_bytes(group, &x, in + 1, field_len) ||
  ------------------
  |  Branch (127:7): [True: 2, False: 4]
  ------------------
  128|      6|      !ec_felem_from_bytes(group, &y, in + 1 + field_len, field_len) ||
  ------------------
  |  Branch (128:7): [True: 2, False: 2]
  ------------------
  129|      6|      !ec_point_set_affine_coordinates(group, out, &x, &y)) {
  ------------------
  |  Branch (129:7): [True: 2, False: 0]
  ------------------
  130|      6|    return 0;
  131|      6|  }
  132|       |
  133|      0|  return 1;
  134|      6|}
EC_POINT_oct2point:
  203|    754|                       const uint8_t *buf, size_t len, BN_CTX *ctx) {
  204|    754|  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
  ------------------
  |  Branch (204:7): [True: 0, False: 754]
  ------------------
  205|      0|    OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  206|      0|    return 0;
  207|      0|  }
  208|    754|  return ec_GFp_simple_oct2point(group, point, buf, len, ctx);
  209|    754|}
EC_POINT_set_compressed_coordinates_GFp:
  257|    681|                                            int y_bit, BN_CTX *ctx) {
  258|    681|  if (EC_GROUP_cmp(group, point->group, NULL) != 0) {
  ------------------
  |  Branch (258:7): [True: 0, False: 681]
  ------------------
  259|      0|    OPENSSL_PUT_ERROR(EC, EC_R_INCOMPATIBLE_OBJECTS);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  260|      0|    return 0;
  261|      0|  }
  262|       |
  263|    681|  if (BN_is_negative(x) || BN_cmp(x, &group->field) >= 0) {
  ------------------
  |  Branch (263:7): [True: 0, False: 681]
  |  Branch (263:28): [True: 0, False: 681]
  ------------------
  264|      0|    OPENSSL_PUT_ERROR(EC, EC_R_INVALID_COMPRESSED_POINT);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  265|      0|    return 0;
  266|      0|  }
  267|       |
  268|    681|  BN_CTX *new_ctx = NULL;
  269|    681|  int ret = 0;
  270|       |
  271|    681|  ERR_clear_error();
  272|       |
  273|    681|  if (ctx == NULL) {
  ------------------
  |  Branch (273:7): [True: 0, False: 681]
  ------------------
  274|      0|    ctx = new_ctx = BN_CTX_new();
  275|      0|    if (ctx == NULL) {
  ------------------
  |  Branch (275:9): [True: 0, False: 0]
  ------------------
  276|      0|      return 0;
  277|      0|    }
  278|      0|  }
  279|       |
  280|    681|  y_bit = (y_bit != 0);
  281|       |
  282|    681|  BN_CTX_start(ctx);
  283|    681|  BIGNUM *tmp1 = BN_CTX_get(ctx);
  284|    681|  BIGNUM *tmp2 = BN_CTX_get(ctx);
  285|    681|  BIGNUM *a = BN_CTX_get(ctx);
  286|    681|  BIGNUM *b = BN_CTX_get(ctx);
  287|    681|  BIGNUM *y = BN_CTX_get(ctx);
  288|    681|  if (y == NULL ||
  ------------------
  |  Branch (288:7): [True: 0, False: 681]
  ------------------
  289|    681|      !EC_GROUP_get_curve_GFp(group, NULL, a, b, ctx)) {
  ------------------
  |  Branch (289:7): [True: 0, False: 681]
  ------------------
  290|      0|    goto err;
  291|      0|  }
  292|       |
  293|       |  // Recover y.  We have a Weierstrass equation
  294|       |  //     y^2 = x^3 + a*x + b,
  295|       |  // so  y  is one of the square roots of  x^3 + a*x + b.
  296|       |
  297|       |  // tmp1 := x^3
  298|    681|  if (!BN_mod_sqr(tmp2, x, &group->field, ctx) ||
  ------------------
  |  Branch (298:7): [True: 0, False: 681]
  ------------------
  299|    681|      !BN_mod_mul(tmp1, tmp2, x, &group->field, ctx)) {
  ------------------
  |  Branch (299:7): [True: 0, False: 681]
  ------------------
  300|      0|    goto err;
  301|      0|  }
  302|       |
  303|       |  // tmp1 := tmp1 + a*x
  304|    681|  if (group->a_is_minus3) {
  ------------------
  |  Branch (304:7): [True: 681, False: 0]
  ------------------
  305|    681|    if (!bn_mod_lshift1_consttime(tmp2, x, &group->field, ctx) ||
  ------------------
  |  Branch (305:9): [True: 0, False: 681]
  ------------------
  306|    681|        !bn_mod_add_consttime(tmp2, tmp2, x, &group->field, ctx) ||
  ------------------
  |  Branch (306:9): [True: 0, False: 681]
  ------------------
  307|    681|        !bn_mod_sub_consttime(tmp1, tmp1, tmp2, &group->field, ctx)) {
  ------------------
  |  Branch (307:9): [True: 0, False: 681]
  ------------------
  308|      0|      goto err;
  309|      0|    }
  310|    681|  } else {
  311|      0|    if (!BN_mod_mul(tmp2, a, x, &group->field, ctx) ||
  ------------------
  |  Branch (311:9): [True: 0, False: 0]
  ------------------
  312|      0|        !bn_mod_add_consttime(tmp1, tmp1, tmp2, &group->field, ctx)) {
  ------------------
  |  Branch (312:9): [True: 0, False: 0]
  ------------------
  313|      0|      goto err;
  314|      0|    }
  315|      0|  }
  316|       |
  317|       |  // tmp1 := tmp1 + b
  318|    681|  if (!bn_mod_add_consttime(tmp1, tmp1, b, &group->field, ctx)) {
  ------------------
  |  Branch (318:7): [True: 0, False: 681]
  ------------------
  319|      0|    goto err;
  320|      0|  }
  321|       |
  322|    681|  if (!BN_mod_sqrt(y, tmp1, &group->field, ctx)) {
  ------------------
  |  Branch (322:7): [True: 200, False: 481]
  ------------------
  323|    200|    uint32_t err = ERR_peek_last_error();
  324|    200|    if (ERR_GET_LIB(err) == ERR_LIB_BN &&
  ------------------
  |  Branch (324:9): [True: 200, False: 0]
  ------------------
  325|    200|        ERR_GET_REASON(err) == BN_R_NOT_A_SQUARE) {
  ------------------
  |  | 1076|    200|#define BN_R_NOT_A_SQUARE 110
  ------------------
  |  Branch (325:9): [True: 200, False: 0]
  ------------------
  326|    200|      ERR_clear_error();
  327|    200|      OPENSSL_PUT_ERROR(EC, EC_R_INVALID_COMPRESSED_POINT);
  ------------------
  |  |  441|    200|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  328|    200|    } else {
  329|      0|      OPENSSL_PUT_ERROR(EC, ERR_R_BN_LIB);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  330|      0|    }
  331|    200|    goto err;
  332|    200|  }
  333|       |
  334|    481|  if (y_bit != BN_is_odd(y)) {
  ------------------
  |  Branch (334:7): [True: 299, False: 182]
  ------------------
  335|    299|    if (BN_is_zero(y)) {
  ------------------
  |  Branch (335:9): [True: 0, False: 299]
  ------------------
  336|      0|      OPENSSL_PUT_ERROR(EC, EC_R_INVALID_COMPRESSION_BIT);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  337|      0|      goto err;
  338|      0|    }
  339|    299|    if (!BN_usub(y, &group->field, y)) {
  ------------------
  |  Branch (339:9): [True: 0, False: 299]
  ------------------
  340|      0|      goto err;
  341|      0|    }
  342|    299|  }
  343|    481|  if (y_bit != BN_is_odd(y)) {
  ------------------
  |  Branch (343:7): [True: 0, False: 481]
  ------------------
  344|      0|    OPENSSL_PUT_ERROR(EC, ERR_R_INTERNAL_ERROR);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  345|      0|    goto err;
  346|      0|  }
  347|       |
  348|    481|  if (!EC_POINT_set_affine_coordinates_GFp(group, point, x, y, ctx)) {
  ------------------
  |  Branch (348:7): [True: 0, False: 481]
  ------------------
  349|      0|    goto err;
  350|      0|  }
  351|       |
  352|    481|  ret = 1;
  353|       |
  354|    681|err:
  355|    681|  BN_CTX_end(ctx);
  356|    681|  BN_CTX_free(new_ctx);
  357|    681|  return ret;
  358|    481|}
bcm.c:ec_GFp_simple_oct2point:
  138|    754|                                   BN_CTX *ctx) {
  139|    754|  if (len == 0) {
  ------------------
  |  Branch (139:7): [True: 0, False: 754]
  ------------------
  140|      0|    OPENSSL_PUT_ERROR(EC, EC_R_BUFFER_TOO_SMALL);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  141|      0|    return 0;
  142|      0|  }
  143|       |
  144|    754|  point_conversion_form_t form = buf[0];
  145|    754|  if (form == POINT_CONVERSION_UNCOMPRESSED) {
  ------------------
  |  Branch (145:7): [True: 30, False: 724]
  ------------------
  146|     30|    EC_AFFINE affine;
  147|     30|    if (!ec_point_from_uncompressed(group, &affine, buf, len)) {
  ------------------
  |  Branch (147:9): [True: 30, False: 0]
  ------------------
  148|       |      // In the event of an error, defend against the caller not checking the
  149|       |      // return value by setting a known safe value.
  150|     30|      ec_set_to_safe_point(group, &point->raw);
  151|     30|      return 0;
  152|     30|    }
  153|      0|    ec_affine_to_jacobian(group, &point->raw, &affine);
  154|      0|    return 1;
  155|     30|  }
  156|       |
  157|    724|  const int y_bit = form & 1;
  158|    724|  const size_t field_len = BN_num_bytes(&group->field);
  159|    724|  form = form & ~1u;
  160|    724|  if (form != POINT_CONVERSION_COMPRESSED ||
  ------------------
  |  Branch (160:7): [True: 20, False: 704]
  ------------------
  161|    724|      len != 1 /* type byte */ + field_len) {
  ------------------
  |  Branch (161:7): [True: 22, False: 682]
  ------------------
  162|     42|    OPENSSL_PUT_ERROR(EC, EC_R_INVALID_ENCODING);
  ------------------
  |  |  441|     42|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  163|     42|    return 0;
  164|     42|  }
  165|       |
  166|       |  // TODO(davidben): Integrate compressed coordinates with the lower-level EC
  167|       |  // abstractions. This requires a way to compute square roots, which is tricky
  168|       |  // for primes which are not 3 (mod 4), namely P-224 and custom curves. P-224's
  169|       |  // prime is particularly inconvenient for compressed coordinates. See
  170|       |  // https://cr.yp.to/papers/sqroot.pdf
  171|    682|  BN_CTX *new_ctx = NULL;
  172|    682|  if (ctx == NULL) {
  ------------------
  |  Branch (172:7): [True: 682, False: 0]
  ------------------
  173|    682|    ctx = new_ctx = BN_CTX_new();
  174|    682|    if (ctx == NULL) {
  ------------------
  |  Branch (174:9): [True: 0, False: 682]
  ------------------
  175|      0|      return 0;
  176|      0|    }
  177|    682|  }
  178|       |
  179|    682|  int ret = 0;
  180|    682|  BN_CTX_start(ctx);
  181|    682|  BIGNUM *x = BN_CTX_get(ctx);
  182|    682|  if (x == NULL || !BN_bin2bn(buf + 1, field_len, x)) {
  ------------------
  |  Branch (182:7): [True: 0, False: 682]
  |  Branch (182:20): [True: 0, False: 682]
  ------------------
  183|      0|    goto err;
  184|      0|  }
  185|    682|  if (BN_ucmp(x, &group->field) >= 0) {
  ------------------
  |  Branch (185:7): [True: 1, False: 681]
  ------------------
  186|      1|    OPENSSL_PUT_ERROR(EC, EC_R_INVALID_ENCODING);
  ------------------
  |  |  441|      1|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  187|      1|    goto err;
  188|      1|  }
  189|       |
  190|    681|  if (!EC_POINT_set_compressed_coordinates_GFp(group, point, x, y_bit, ctx)) {
  ------------------
  |  Branch (190:7): [True: 200, False: 481]
  ------------------
  191|    200|    goto err;
  192|    200|  }
  193|       |
  194|    481|  ret = 1;
  195|       |
  196|    682|err:
  197|    682|  BN_CTX_end(ctx);
  198|    682|  BN_CTX_free(new_ctx);
  199|    682|  return ret;
  200|    481|}

bcm.c:EC_GFp_nistp224_method_do_init:
 1144|      1|DEFINE_METHOD_FUNCTION(EC_METHOD, EC_GFp_nistp224_method) {
 1145|      1|  out->group_init = ec_GFp_simple_group_init;
 1146|      1|  out->group_finish = ec_GFp_simple_group_finish;
 1147|      1|  out->group_set_curve = ec_GFp_simple_group_set_curve;
 1148|      1|  out->point_get_affine_coordinates =
 1149|      1|      ec_GFp_nistp224_point_get_affine_coordinates;
 1150|      1|  out->add = ec_GFp_nistp224_add;
 1151|      1|  out->dbl = ec_GFp_nistp224_dbl;
 1152|      1|  out->mul = ec_GFp_nistp224_point_mul;
 1153|      1|  out->mul_base = ec_GFp_nistp224_point_mul_base;
 1154|      1|  out->mul_public = ec_GFp_nistp224_point_mul_public;
 1155|      1|  out->felem_mul = ec_GFp_nistp224_felem_mul;
 1156|      1|  out->felem_sqr = ec_GFp_nistp224_felem_sqr;
 1157|      1|  out->felem_to_bytes = ec_GFp_simple_felem_to_bytes;
 1158|      1|  out->felem_from_bytes = ec_GFp_simple_felem_from_bytes;
 1159|      1|  out->scalar_inv0_montgomery = ec_simple_scalar_inv0_montgomery;
 1160|      1|  out->scalar_to_montgomery_inv_vartime =
 1161|      1|      ec_simple_scalar_to_montgomery_inv_vartime;
 1162|      1|  out->cmp_x_coordinate = ec_GFp_simple_cmp_x_coordinate;
 1163|      1|}
bcm.c:p224_generic_to_felem:
  181|  5.81k|static void p224_generic_to_felem(p224_felem out, const EC_FELEM *in) {
  182|       |  // |p224_felem|'s minimal representation uses four 56-bit words. |EC_FELEM|
  183|       |  // uses four 64-bit words. (The top-most word only has 32 bits.)
  184|  5.81k|  out[0] = in->words[0] & 0x00ffffffffffffff;
  185|  5.81k|  out[1] = ((in->words[0] >> 56) | (in->words[1] << 8)) & 0x00ffffffffffffff;
  186|  5.81k|  out[2] = ((in->words[1] >> 48) | (in->words[2] << 16)) & 0x00ffffffffffffff;
  187|  5.81k|  out[3] = ((in->words[2] >> 40) | (in->words[3] << 24)) & 0x00ffffffffffffff;
  188|  5.81k|}
bcm.c:p224_felem_square:
  364|  63.4k|static void p224_felem_square(p224_widefelem out, const p224_felem in) {
  365|  63.4k|  p224_limb tmp0, tmp1, tmp2;
  366|  63.4k|  tmp0 = 2 * in[0];
  367|  63.4k|  tmp1 = 2 * in[1];
  368|  63.4k|  tmp2 = 2 * in[2];
  369|  63.4k|  out[0] = ((p224_widelimb)in[0]) * in[0];
  370|  63.4k|  out[1] = ((p224_widelimb)in[0]) * tmp1;
  371|  63.4k|  out[2] = ((p224_widelimb)in[0]) * tmp2 + ((p224_widelimb)in[1]) * in[1];
  372|  63.4k|  out[3] = ((p224_widelimb)in[3]) * tmp0 + ((p224_widelimb)in[1]) * tmp2;
  373|  63.4k|  out[4] = ((p224_widelimb)in[3]) * tmp1 + ((p224_widelimb)in[2]) * in[2];
  374|  63.4k|  out[5] = ((p224_widelimb)in[3]) * tmp2;
  375|  63.4k|  out[6] = ((p224_widelimb)in[3]) * in[3];
  376|  63.4k|}
bcm.c:p224_felem_reduce:
  396|   155k|static void p224_felem_reduce(p224_felem out, const p224_widefelem in) {
  397|   155k|  static const p224_widelimb two127p15 =
  398|   155k|      (((p224_widelimb)1) << 127) + (((p224_widelimb)1) << 15);
  399|   155k|  static const p224_widelimb two127m71 =
  400|   155k|      (((p224_widelimb)1) << 127) - (((p224_widelimb)1) << 71);
  401|   155k|  static const p224_widelimb two127m71m55 = (((p224_widelimb)1) << 127) -
  402|   155k|                                            (((p224_widelimb)1) << 71) -
  403|   155k|                                            (((p224_widelimb)1) << 55);
  404|   155k|  p224_widelimb output[5];
  405|       |
  406|       |  // Add 0 mod 2^224-2^96+1 to ensure all differences are positive
  407|   155k|  output[0] = in[0] + two127p15;
  408|   155k|  output[1] = in[1] + two127m71m55;
  409|   155k|  output[2] = in[2] + two127m71;
  410|   155k|  output[3] = in[3];
  411|   155k|  output[4] = in[4];
  412|       |
  413|       |  // Eliminate in[4], in[5], in[6]
  414|   155k|  output[4] += in[6] >> 16;
  415|   155k|  output[3] += (in[6] & 0xffff) << 40;
  416|   155k|  output[2] -= in[6];
  417|       |
  418|   155k|  output[3] += in[5] >> 16;
  419|   155k|  output[2] += (in[5] & 0xffff) << 40;
  420|   155k|  output[1] -= in[5];
  421|       |
  422|   155k|  output[2] += output[4] >> 16;
  423|   155k|  output[1] += (output[4] & 0xffff) << 40;
  424|   155k|  output[0] -= output[4];
  425|       |
  426|       |  // Carry 2 -> 3 -> 4
  427|   155k|  output[3] += output[2] >> 56;
  428|   155k|  output[2] &= 0x00ffffffffffffff;
  429|       |
  430|   155k|  output[4] = output[3] >> 56;
  431|   155k|  output[3] &= 0x00ffffffffffffff;
  432|       |
  433|       |  // Now output[2] < 2^56, output[3] < 2^56, output[4] < 2^72
  434|       |
  435|       |  // Eliminate output[4]
  436|   155k|  output[2] += output[4] >> 16;
  437|       |  // output[2] < 2^56 + 2^56 = 2^57
  438|   155k|  output[1] += (output[4] & 0xffff) << 40;
  439|   155k|  output[0] -= output[4];
  440|       |
  441|       |  // Carry 0 -> 1 -> 2 -> 3
  442|   155k|  output[1] += output[0] >> 56;
  443|   155k|  out[0] = output[0] & 0x00ffffffffffffff;
  444|       |
  445|   155k|  output[2] += output[1] >> 56;
  446|       |  // output[2] < 2^57 + 2^72
  447|   155k|  out[1] = output[1] & 0x00ffffffffffffff;
  448|   155k|  output[3] += output[2] >> 56;
  449|       |  // output[3] <= 2^56 + 2^16
  450|   155k|  out[2] = output[2] & 0x00ffffffffffffff;
  451|       |
  452|       |  // out[0] < 2^56, out[1] < 2^56, out[2] < 2^56,
  453|       |  // out[3] <= 2^56 + 2^16 (due to final carry),
  454|       |  // so out < 2*p
  455|   155k|  out[3] = output[3];
  456|   155k|}
bcm.c:p224_felem_mul:
  380|   108k|                           const p224_felem in2) {
  381|   108k|  out[0] = ((p224_widelimb)in1[0]) * in2[0];
  382|   108k|  out[1] = ((p224_widelimb)in1[0]) * in2[1] + ((p224_widelimb)in1[1]) * in2[0];
  383|   108k|  out[2] = ((p224_widelimb)in1[0]) * in2[2] + ((p224_widelimb)in1[1]) * in2[1] +
  384|   108k|           ((p224_widelimb)in1[2]) * in2[0];
  385|   108k|  out[3] = ((p224_widelimb)in1[0]) * in2[3] + ((p224_widelimb)in1[1]) * in2[2] +
  386|   108k|           ((p224_widelimb)in1[2]) * in2[1] + ((p224_widelimb)in1[3]) * in2[0];
  387|   108k|  out[4] = ((p224_widelimb)in1[1]) * in2[3] + ((p224_widelimb)in1[2]) * in2[2] +
  388|   108k|           ((p224_widelimb)in1[3]) * in2[1];
  389|   108k|  out[5] = ((p224_widelimb)in1[2]) * in2[3] + ((p224_widelimb)in1[3]) * in2[2];
  390|   108k|  out[6] = ((p224_widelimb)in1[3]) * in2[3];
  391|   108k|}
bcm.c:p224_felem_to_generic:
  191|  4.51k|static void p224_felem_to_generic(EC_FELEM *out, const p224_felem in) {
  192|       |  // Reduce to unique minimal representation.
  193|  4.51k|  static const int64_t two56 = ((p224_limb)1) << 56;
  194|       |  // 0 <= in < 2*p, p = 2^224 - 2^96 + 1
  195|       |  // if in > p , reduce in = in - 2^224 + 2^96 - 1
  196|  4.51k|  int64_t tmp[4], a;
  197|  4.51k|  tmp[0] = in[0];
  198|  4.51k|  tmp[1] = in[1];
  199|  4.51k|  tmp[2] = in[2];
  200|  4.51k|  tmp[3] = in[3];
  201|       |  // Case 1: a = 1 iff in >= 2^224
  202|  4.51k|  a = (in[3] >> 56);
  203|  4.51k|  tmp[0] -= a;
  204|  4.51k|  tmp[1] += a << 40;
  205|  4.51k|  tmp[3] &= 0x00ffffffffffffff;
  206|       |  // Case 2: a = 0 iff p <= in < 2^224, i.e., the high 128 bits are all 1 and
  207|       |  // the lower part is non-zero
  208|  4.51k|  a = ((in[3] & in[2] & (in[1] | 0x000000ffffffffff)) + 1) |
  209|  4.51k|      (((int64_t)(in[0] + (in[1] & 0x000000ffffffffff)) - 1) >> 63);
  210|  4.51k|  a &= 0x00ffffffffffffff;
  211|       |  // turn a into an all-one mask (if a = 0) or an all-zero mask
  212|  4.51k|  a = (a - 1) >> 63;
  213|       |  // subtract 2^224 - 2^96 + 1 if a is all-one
  214|  4.51k|  tmp[3] &= a ^ 0xffffffffffffffff;
  215|  4.51k|  tmp[2] &= a ^ 0xffffffffffffffff;
  216|  4.51k|  tmp[1] &= (a ^ 0xffffffffffffffff) | 0x000000ffffffffff;
  217|  4.51k|  tmp[0] -= 1 & a;
  218|       |
  219|       |  // eliminate negative coefficients: if tmp[0] is negative, tmp[1] must
  220|       |  // be non-zero, so we only need one step
  221|  4.51k|  a = tmp[0] >> 63;
  222|  4.51k|  tmp[0] += two56 & a;
  223|  4.51k|  tmp[1] -= 1 & a;
  224|       |
  225|       |  // carry 1 -> 2 -> 3
  226|  4.51k|  tmp[2] += tmp[1] >> 56;
  227|  4.51k|  tmp[1] &= 0x00ffffffffffffff;
  228|       |
  229|  4.51k|  tmp[3] += tmp[2] >> 56;
  230|  4.51k|  tmp[2] &= 0x00ffffffffffffff;
  231|       |
  232|       |  // Now 0 <= tmp < p
  233|  4.51k|  p224_felem tmp2;
  234|  4.51k|  tmp2[0] = tmp[0];
  235|  4.51k|  tmp2[1] = tmp[1];
  236|  4.51k|  tmp2[2] = tmp[2];
  237|  4.51k|  tmp2[3] = tmp[3];
  238|       |
  239|       |  // |p224_felem|'s minimal representation uses four 56-bit words. |EC_FELEM|
  240|       |  // uses four 64-bit words. (The top-most word only has 32 bits.)
  241|  4.51k|  out->words[0] = tmp2[0] | (tmp2[1] << 56);
  242|  4.51k|  out->words[1] = (tmp2[1] >> 8) | (tmp2[2] << 48);
  243|  4.51k|  out->words[2] = (tmp2[2] >> 16) | (tmp2[3] << 40);
  244|  4.51k|  out->words[3] = tmp2[3] >> 24;
  245|  4.51k|}
bcm.c:p224_point_add:
  680|  11.2k|                           const p224_felem z2) {
  681|  11.2k|  p224_felem ftmp, ftmp2, ftmp3, ftmp4, ftmp5, x_out, y_out, z_out;
  682|  11.2k|  p224_widefelem tmp, tmp2;
  683|  11.2k|  p224_limb z1_is_zero, z2_is_zero, x_equal, y_equal;
  684|       |
  685|  11.2k|  if (!mixed) {
  ------------------
  |  Branch (685:7): [True: 0, False: 11.2k]
  ------------------
  686|       |    // ftmp2 = z2^2
  687|      0|    p224_felem_square(tmp, z2);
  688|      0|    p224_felem_reduce(ftmp2, tmp);
  689|       |
  690|       |    // ftmp4 = z2^3
  691|      0|    p224_felem_mul(tmp, ftmp2, z2);
  692|      0|    p224_felem_reduce(ftmp4, tmp);
  693|       |
  694|       |    // ftmp4 = z2^3*y1
  695|      0|    p224_felem_mul(tmp2, ftmp4, y1);
  696|      0|    p224_felem_reduce(ftmp4, tmp2);
  697|       |
  698|       |    // ftmp2 = z2^2*x1
  699|      0|    p224_felem_mul(tmp2, ftmp2, x1);
  700|      0|    p224_felem_reduce(ftmp2, tmp2);
  701|  11.2k|  } else {
  702|       |    // We'll assume z2 = 1 (special case z2 = 0 is handled later)
  703|       |
  704|       |    // ftmp4 = z2^3*y1
  705|  11.2k|    p224_felem_assign(ftmp4, y1);
  706|       |
  707|       |    // ftmp2 = z2^2*x1
  708|  11.2k|    p224_felem_assign(ftmp2, x1);
  709|  11.2k|  }
  710|       |
  711|       |  // ftmp = z1^2
  712|  11.2k|  p224_felem_square(tmp, z1);
  713|  11.2k|  p224_felem_reduce(ftmp, tmp);
  714|       |
  715|       |  // ftmp3 = z1^3
  716|  11.2k|  p224_felem_mul(tmp, ftmp, z1);
  717|  11.2k|  p224_felem_reduce(ftmp3, tmp);
  718|       |
  719|       |  // tmp = z1^3*y2
  720|  11.2k|  p224_felem_mul(tmp, ftmp3, y2);
  721|       |  // tmp[i] < 4 * 2^57 * 2^57 = 2^116
  722|       |
  723|       |  // ftmp3 = z1^3*y2 - z2^3*y1
  724|  11.2k|  p224_felem_diff_128_64(tmp, ftmp4);
  725|       |  // tmp[i] < 2^116 + 2^64 + 8 < 2^117
  726|  11.2k|  p224_felem_reduce(ftmp3, tmp);
  727|       |
  728|       |  // tmp = z1^2*x2
  729|  11.2k|  p224_felem_mul(tmp, ftmp, x2);
  730|       |  // tmp[i] < 4 * 2^57 * 2^57 = 2^116
  731|       |
  732|       |  // ftmp = z1^2*x2 - z2^2*x1
  733|  11.2k|  p224_felem_diff_128_64(tmp, ftmp2);
  734|       |  // tmp[i] < 2^116 + 2^64 + 8 < 2^117
  735|  11.2k|  p224_felem_reduce(ftmp, tmp);
  736|       |
  737|       |  // The formulae are incorrect if the points are equal, so we check for this
  738|       |  // and do doubling if this happens.
  739|  11.2k|  x_equal = p224_felem_is_zero(ftmp);
  740|  11.2k|  y_equal = p224_felem_is_zero(ftmp3);
  741|  11.2k|  z1_is_zero = p224_felem_is_zero(z1);
  742|  11.2k|  z2_is_zero = p224_felem_is_zero(z2);
  743|       |  // In affine coordinates, (X_1, Y_1) == (X_2, Y_2)
  744|  11.2k|  p224_limb is_nontrivial_double =
  745|  11.2k|      x_equal & y_equal & (1 - z1_is_zero) & (1 - z2_is_zero);
  746|  11.2k|  if (constant_time_declassify_w(is_nontrivial_double)) {
  ------------------
  |  Branch (746:7): [True: 0, False: 11.2k]
  ------------------
  747|      0|    p224_point_double(x3, y3, z3, x1, y1, z1);
  748|      0|    return;
  749|      0|  }
  750|       |
  751|       |  // ftmp5 = z1*z2
  752|  11.2k|  if (!mixed) {
  ------------------
  |  Branch (752:7): [True: 0, False: 11.2k]
  ------------------
  753|      0|    p224_felem_mul(tmp, z1, z2);
  754|      0|    p224_felem_reduce(ftmp5, tmp);
  755|  11.2k|  } else {
  756|       |    // special case z2 = 0 is handled later
  757|  11.2k|    p224_felem_assign(ftmp5, z1);
  758|  11.2k|  }
  759|       |
  760|       |  // z_out = (z1^2*x2 - z2^2*x1)*(z1*z2)
  761|  11.2k|  p224_felem_mul(tmp, ftmp, ftmp5);
  762|  11.2k|  p224_felem_reduce(z_out, tmp);
  763|       |
  764|       |  // ftmp = (z1^2*x2 - z2^2*x1)^2
  765|  11.2k|  p224_felem_assign(ftmp5, ftmp);
  766|  11.2k|  p224_felem_square(tmp, ftmp);
  767|  11.2k|  p224_felem_reduce(ftmp, tmp);
  768|       |
  769|       |  // ftmp5 = (z1^2*x2 - z2^2*x1)^3
  770|  11.2k|  p224_felem_mul(tmp, ftmp, ftmp5);
  771|  11.2k|  p224_felem_reduce(ftmp5, tmp);
  772|       |
  773|       |  // ftmp2 = z2^2*x1*(z1^2*x2 - z2^2*x1)^2
  774|  11.2k|  p224_felem_mul(tmp, ftmp2, ftmp);
  775|  11.2k|  p224_felem_reduce(ftmp2, tmp);
  776|       |
  777|       |  // tmp = z2^3*y1*(z1^2*x2 - z2^2*x1)^3
  778|  11.2k|  p224_felem_mul(tmp, ftmp4, ftmp5);
  779|       |  // tmp[i] < 4 * 2^57 * 2^57 = 2^116
  780|       |
  781|       |  // tmp2 = (z1^3*y2 - z2^3*y1)^2
  782|  11.2k|  p224_felem_square(tmp2, ftmp3);
  783|       |  // tmp2[i] < 4 * 2^57 * 2^57 < 2^116
  784|       |
  785|       |  // tmp2 = (z1^3*y2 - z2^3*y1)^2 - (z1^2*x2 - z2^2*x1)^3
  786|  11.2k|  p224_felem_diff_128_64(tmp2, ftmp5);
  787|       |  // tmp2[i] < 2^116 + 2^64 + 8 < 2^117
  788|       |
  789|       |  // ftmp5 = 2*z2^2*x1*(z1^2*x2 - z2^2*x1)^2
  790|  11.2k|  p224_felem_assign(ftmp5, ftmp2);
  791|  11.2k|  p224_felem_scalar(ftmp5, 2);
  792|       |  // ftmp5[i] < 2 * 2^57 = 2^58
  793|       |
  794|       |  /* x_out = (z1^3*y2 - z2^3*y1)^2 - (z1^2*x2 - z2^2*x1)^3 -
  795|       |     2*z2^2*x1*(z1^2*x2 - z2^2*x1)^2 */
  796|  11.2k|  p224_felem_diff_128_64(tmp2, ftmp5);
  797|       |  // tmp2[i] < 2^117 + 2^64 + 8 < 2^118
  798|  11.2k|  p224_felem_reduce(x_out, tmp2);
  799|       |
  800|       |  // ftmp2 = z2^2*x1*(z1^2*x2 - z2^2*x1)^2 - x_out
  801|  11.2k|  p224_felem_diff(ftmp2, x_out);
  802|       |  // ftmp2[i] < 2^57 + 2^58 + 2 < 2^59
  803|       |
  804|       |  // tmp2 = (z1^3*y2 - z2^3*y1)*(z2^2*x1*(z1^2*x2 - z2^2*x1)^2 - x_out)
  805|  11.2k|  p224_felem_mul(tmp2, ftmp3, ftmp2);
  806|       |  // tmp2[i] < 4 * 2^57 * 2^59 = 2^118
  807|       |
  808|       |  /* y_out = (z1^3*y2 - z2^3*y1)*(z2^2*x1*(z1^2*x2 - z2^2*x1)^2 - x_out) -
  809|       |     z2^3*y1*(z1^2*x2 - z2^2*x1)^3 */
  810|  11.2k|  p224_widefelem_diff(tmp2, tmp);
  811|       |  // tmp2[i] < 2^118 + 2^120 < 2^121
  812|  11.2k|  p224_felem_reduce(y_out, tmp2);
  813|       |
  814|       |  // the result (x_out, y_out, z_out) is incorrect if one of the inputs is
  815|       |  // the point at infinity, so we need to check for this separately
  816|       |
  817|       |  // if point 1 is at infinity, copy point 2 to output, and vice versa
  818|  11.2k|  p224_copy_conditional(x_out, x2, z1_is_zero);
  819|  11.2k|  p224_copy_conditional(x_out, x1, z2_is_zero);
  820|  11.2k|  p224_copy_conditional(y_out, y2, z1_is_zero);
  821|  11.2k|  p224_copy_conditional(y_out, y1, z2_is_zero);
  822|  11.2k|  p224_copy_conditional(z_out, z2, z1_is_zero);
  823|  11.2k|  p224_copy_conditional(z_out, z1, z2_is_zero);
  824|  11.2k|  p224_felem_assign(x3, x_out);
  825|  11.2k|  p224_felem_assign(y3, y_out);
  826|  11.2k|  p224_felem_assign(z3, z_out);
  827|  11.2k|}
bcm.c:p224_felem_assign:
  253|   112k|static void p224_felem_assign(p224_felem out, const p224_felem in) {
  254|   112k|  out[0] = in[0];
  255|   112k|  out[1] = in[1];
  256|   112k|  out[2] = in[2];
  257|   112k|  out[3] = in[3];
  258|   112k|}
bcm.c:p224_felem_diff_128_64:
  320|  56.1k|static void p224_felem_diff_128_64(p224_widefelem out, const p224_felem in) {
  321|  56.1k|  static const p224_widelimb two64p8 =
  322|  56.1k|      (((p224_widelimb)1) << 64) + (((p224_widelimb)1) << 8);
  323|  56.1k|  static const p224_widelimb two64m8 =
  324|  56.1k|      (((p224_widelimb)1) << 64) - (((p224_widelimb)1) << 8);
  325|  56.1k|  static const p224_widelimb two64m48m8 = (((p224_widelimb)1) << 64) -
  326|  56.1k|                                          (((p224_widelimb)1) << 48) -
  327|  56.1k|                                          (((p224_widelimb)1) << 8);
  328|       |
  329|       |  // Add 0 mod 2^224-2^96+1 to ensure out > in
  330|  56.1k|  out[0] += two64p8;
  331|  56.1k|  out[1] += two64m48m8;
  332|  56.1k|  out[2] += two64m8;
  333|  56.1k|  out[3] += two64m8;
  334|       |
  335|  56.1k|  out[0] -= in[0];
  336|  56.1k|  out[1] -= in[1];
  337|  56.1k|  out[2] -= in[2];
  338|  56.1k|  out[3] -= in[3];
  339|  56.1k|}
bcm.c:p224_felem_is_zero:
  470|  45.1k|static p224_limb p224_felem_is_zero(const p224_felem in) {
  471|  45.1k|  p224_limb zero = in[0] | in[1] | in[2] | in[3];
  472|  45.1k|  zero = (((int64_t)(zero)-1) >> 63) & 1;
  473|       |
  474|  45.1k|  p224_limb two224m96p1 = (in[0] ^ 1) | (in[1] ^ 0x00ffff0000000000) |
  475|  45.1k|                     (in[2] ^ 0x00ffffffffffffff) |
  476|  45.1k|                     (in[3] ^ 0x00ffffffffffffff);
  477|  45.1k|  two224m96p1 = (((int64_t)(two224m96p1)-1) >> 63) & 1;
  478|  45.1k|  p224_limb two225m97p2 = (in[0] ^ 2) | (in[1] ^ 0x00fffe0000000000) |
  479|  45.1k|                     (in[2] ^ 0x00ffffffffffffff) |
  480|  45.1k|                     (in[3] ^ 0x01ffffffffffffff);
  481|  45.1k|  two225m97p2 = (((int64_t)(two225m97p2)-1) >> 63) & 1;
  482|  45.1k|  return (zero | two224m96p1 | two225m97p2);
  483|  45.1k|}
bcm.c:p224_point_double:
  593|  5.53k|                              const p224_felem y_in, const p224_felem z_in) {
  594|  5.53k|  p224_widefelem tmp, tmp2;
  595|  5.53k|  p224_felem delta, gamma, beta, alpha, ftmp, ftmp2;
  596|       |
  597|  5.53k|  p224_felem_assign(ftmp, x_in);
  598|  5.53k|  p224_felem_assign(ftmp2, x_in);
  599|       |
  600|       |  // delta = z^2
  601|  5.53k|  p224_felem_square(tmp, z_in);
  602|  5.53k|  p224_felem_reduce(delta, tmp);
  603|       |
  604|       |  // gamma = y^2
  605|  5.53k|  p224_felem_square(tmp, y_in);
  606|  5.53k|  p224_felem_reduce(gamma, tmp);
  607|       |
  608|       |  // beta = x*gamma
  609|  5.53k|  p224_felem_mul(tmp, x_in, gamma);
  610|  5.53k|  p224_felem_reduce(beta, tmp);
  611|       |
  612|       |  // alpha = 3*(x-delta)*(x+delta)
  613|  5.53k|  p224_felem_diff(ftmp, delta);
  614|       |  // ftmp[i] < 2^57 + 2^58 + 2 < 2^59
  615|  5.53k|  p224_felem_sum(ftmp2, delta);
  616|       |  // ftmp2[i] < 2^57 + 2^57 = 2^58
  617|  5.53k|  p224_felem_scalar(ftmp2, 3);
  618|       |  // ftmp2[i] < 3 * 2^58 < 2^60
  619|  5.53k|  p224_felem_mul(tmp, ftmp, ftmp2);
  620|       |  // tmp[i] < 2^60 * 2^59 * 4 = 2^121
  621|  5.53k|  p224_felem_reduce(alpha, tmp);
  622|       |
  623|       |  // x' = alpha^2 - 8*beta
  624|  5.53k|  p224_felem_square(tmp, alpha);
  625|       |  // tmp[i] < 4 * 2^57 * 2^57 = 2^116
  626|  5.53k|  p224_felem_assign(ftmp, beta);
  627|  5.53k|  p224_felem_scalar(ftmp, 8);
  628|       |  // ftmp[i] < 8 * 2^57 = 2^60
  629|  5.53k|  p224_felem_diff_128_64(tmp, ftmp);
  630|       |  // tmp[i] < 2^116 + 2^64 + 8 < 2^117
  631|  5.53k|  p224_felem_reduce(x_out, tmp);
  632|       |
  633|       |  // z' = (y + z)^2 - gamma - delta
  634|  5.53k|  p224_felem_sum(delta, gamma);
  635|       |  // delta[i] < 2^57 + 2^57 = 2^58
  636|  5.53k|  p224_felem_assign(ftmp, y_in);
  637|  5.53k|  p224_felem_sum(ftmp, z_in);
  638|       |  // ftmp[i] < 2^57 + 2^57 = 2^58
  639|  5.53k|  p224_felem_square(tmp, ftmp);
  640|       |  // tmp[i] < 4 * 2^58 * 2^58 = 2^118
  641|  5.53k|  p224_felem_diff_128_64(tmp, delta);
  642|       |  // tmp[i] < 2^118 + 2^64 + 8 < 2^119
  643|  5.53k|  p224_felem_reduce(z_out, tmp);
  644|       |
  645|       |  // y' = alpha*(4*beta - x') - 8*gamma^2
  646|  5.53k|  p224_felem_scalar(beta, 4);
  647|       |  // beta[i] < 4 * 2^57 = 2^59
  648|  5.53k|  p224_felem_diff(beta, x_out);
  649|       |  // beta[i] < 2^59 + 2^58 + 2 < 2^60
  650|  5.53k|  p224_felem_mul(tmp, alpha, beta);
  651|       |  // tmp[i] < 4 * 2^57 * 2^60 = 2^119
  652|  5.53k|  p224_felem_square(tmp2, gamma);
  653|       |  // tmp2[i] < 4 * 2^57 * 2^57 = 2^116
  654|  5.53k|  p224_widefelem_scalar(tmp2, 8);
  655|       |  // tmp2[i] < 8 * 2^116 = 2^119
  656|  5.53k|  p224_widefelem_diff(tmp, tmp2);
  657|       |  // tmp[i] < 2^119 + 2^120 < 2^121
  658|  5.53k|  p224_felem_reduce(y_out, tmp);
  659|  5.53k|}
bcm.c:p224_felem_sum:
  261|  16.6k|static void p224_felem_sum(p224_felem out, const p224_felem in) {
  262|  16.6k|  out[0] += in[0];
  263|  16.6k|  out[1] += in[1];
  264|  16.6k|  out[2] += in[2];
  265|  16.6k|  out[3] += in[3];
  266|  16.6k|}
bcm.c:p224_widefelem_scalar:
  353|  5.53k|                                  const p224_widelimb scalar) {
  354|  5.53k|  out[0] *= scalar;
  355|  5.53k|  out[1] *= scalar;
  356|  5.53k|  out[2] *= scalar;
  357|  5.53k|  out[3] *= scalar;
  358|  5.53k|  out[4] *= scalar;
  359|  5.53k|  out[5] *= scalar;
  360|  5.53k|  out[6] *= scalar;
  361|  5.53k|}
bcm.c:p224_felem_scalar:
  343|  27.8k|static void p224_felem_scalar(p224_felem out, const p224_limb scalar) {
  344|  27.8k|  out[0] *= scalar;
  345|  27.8k|  out[1] *= scalar;
  346|  27.8k|  out[2] *= scalar;
  347|  27.8k|  out[3] *= scalar;
  348|  27.8k|}
bcm.c:p224_felem_diff:
  270|  22.3k|static void p224_felem_diff(p224_felem out, const p224_felem in) {
  271|  22.3k|  static const p224_limb two58p2 =
  272|  22.3k|      (((p224_limb)1) << 58) + (((p224_limb)1) << 2);
  273|  22.3k|  static const p224_limb two58m2 =
  274|  22.3k|      (((p224_limb)1) << 58) - (((p224_limb)1) << 2);
  275|  22.3k|  static const p224_limb two58m42m2 =
  276|  22.3k|      (((p224_limb)1) << 58) - (((p224_limb)1) << 42) - (((p224_limb)1) << 2);
  277|       |
  278|       |  // Add 0 mod 2^224-2^96+1 to ensure out > in
  279|  22.3k|  out[0] += two58p2;
  280|  22.3k|  out[1] += two58m42m2;
  281|  22.3k|  out[2] += two58m2;
  282|  22.3k|  out[3] += two58m2;
  283|       |
  284|  22.3k|  out[0] -= in[0];
  285|  22.3k|  out[1] -= in[1];
  286|  22.3k|  out[2] -= in[2];
  287|  22.3k|  out[3] -= in[3];
  288|  22.3k|}
bcm.c:p224_widefelem_diff:
  292|  16.8k|static void p224_widefelem_diff(p224_widefelem out, const p224_widefelem in) {
  293|  16.8k|  static const p224_widelimb two120 = ((p224_widelimb)1) << 120;
  294|  16.8k|  static const p224_widelimb two120m64 =
  295|  16.8k|      (((p224_widelimb)1) << 120) - (((p224_widelimb)1) << 64);
  296|  16.8k|  static const p224_widelimb two120m104m64 = (((p224_widelimb)1) << 120) -
  297|  16.8k|                                             (((p224_widelimb)1) << 104) -
  298|  16.8k|                                             (((p224_widelimb)1) << 64);
  299|       |
  300|       |  // Add 0 mod 2^224-2^96+1 to ensure out > in
  301|  16.8k|  out[0] += two120;
  302|  16.8k|  out[1] += two120m64;
  303|  16.8k|  out[2] += two120m64;
  304|  16.8k|  out[3] += two120;
  305|  16.8k|  out[4] += two120m104m64;
  306|  16.8k|  out[5] += two120m64;
  307|  16.8k|  out[6] += two120m64;
  308|       |
  309|  16.8k|  out[0] -= in[0];
  310|  16.8k|  out[1] -= in[1];
  311|  16.8k|  out[2] -= in[2];
  312|  16.8k|  out[3] -= in[3];
  313|  16.8k|  out[4] -= in[4];
  314|  16.8k|  out[5] -= in[5];
  315|  16.8k|  out[6] -= in[6];
  316|  16.8k|}
bcm.c:p224_copy_conditional:
  569|  67.6k|                                  p224_limb icopy) {
  570|       |  // icopy is a (64-bit) 0 or 1, so copy is either all-zero or all-one
  571|  67.6k|  const p224_limb copy = -icopy;
  572|   338k|  for (size_t i = 0; i < 4; ++i) {
  ------------------
  |  Branch (572:22): [True: 270k, False: 67.6k]
  ------------------
  573|   270k|    const p224_limb tmp = copy & (in[i] ^ out[i]);
  574|   270k|    out[i] ^= tmp;
  575|   270k|  }
  576|  67.6k|}
bcm.c:p224_get_bit:
  852|  45.9k|static crypto_word_t p224_get_bit(const EC_SCALAR *in, size_t i) {
  853|  45.9k|  if (i >= 224) {
  ------------------
  |  Branch (853:7): [True: 0, False: 45.9k]
  ------------------
  854|      0|    return 0;
  855|      0|  }
  856|  45.9k|  static_assert(sizeof(in->words[0]) == 8, "BN_ULONG is not 64-bit");
  857|  45.9k|  return (in->words[i >> 6] >> (i & 63)) & 1;
  858|  45.9k|}
bcm.c:p224_select_point:
  833|  11.4k|                              p224_felem out[3]) {
  834|  11.4k|  p224_limb *outlimbs = &out[0][0];
  835|  11.4k|  OPENSSL_memset(outlimbs, 0, 3 * sizeof(p224_felem));
  836|       |
  837|   195k|  for (size_t i = 0; i < size; i++) {
  ------------------
  |  Branch (837:22): [True: 183k, False: 11.4k]
  ------------------
  838|   183k|    const p224_limb *inlimbs = &pre_comp[i][0][0];
  839|   183k|    uint64_t mask = i ^ idx;
  840|   183k|    mask |= mask >> 4;
  841|   183k|    mask |= mask >> 2;
  842|   183k|    mask |= mask >> 1;
  843|   183k|    mask &= 1;
  844|   183k|    mask--;
  845|  2.38M|    for (size_t j = 0; j < 4 * 3; j++) {
  ------------------
  |  Branch (845:24): [True: 2.20M, False: 183k]
  ------------------
  846|  2.20M|      outlimbs[j] |= inlimbs[j] & mask;
  847|  2.20M|    }
  848|   183k|  }
  849|  11.4k|}
bcm.c:ec_GFp_nistp224_point_mul_base:
  997|    205|                                           const EC_SCALAR *scalar) {
  998|       |  // Set nq to the point at infinity.
  999|    205|  p224_felem nq[3], tmp[3];
 1000|    205|  OPENSSL_memset(nq, 0, 3 * sizeof(p224_felem));
 1001|       |
 1002|    205|  int skip = 1;  // Save two point operations in the first round.
 1003|  5.94k|  for (size_t i = 27; i < 28; i--) {
  ------------------
  |  Branch (1003:23): [True: 5.74k, False: 205]
  ------------------
 1004|       |    // double
 1005|  5.74k|    if (!skip) {
  ------------------
  |  Branch (1005:9): [True: 5.53k, False: 205]
  ------------------
 1006|  5.53k|      p224_point_double(nq[0], nq[1], nq[2], nq[0], nq[1], nq[2]);
 1007|  5.53k|    }
 1008|       |
 1009|       |    // First, look 28 bits upwards.
 1010|  5.74k|    crypto_word_t bits = p224_get_bit(scalar, i + 196) << 3;
 1011|  5.74k|    bits |= p224_get_bit(scalar, i + 140) << 2;
 1012|  5.74k|    bits |= p224_get_bit(scalar, i + 84) << 1;
 1013|  5.74k|    bits |= p224_get_bit(scalar, i + 28);
 1014|       |    // Select the point to add, in constant time.
 1015|  5.74k|    p224_select_point(bits, 16, g_p224_pre_comp[1], tmp);
 1016|       |
 1017|  5.74k|    if (!skip) {
  ------------------
  |  Branch (1017:9): [True: 5.53k, False: 205]
  ------------------
 1018|  5.53k|      p224_point_add(nq[0], nq[1], nq[2], nq[0], nq[1], nq[2], 1 /* mixed */,
 1019|  5.53k|                     tmp[0], tmp[1], tmp[2]);
 1020|  5.53k|    } else {
 1021|    205|      OPENSSL_memcpy(nq, tmp, 3 * sizeof(p224_felem));
 1022|    205|      skip = 0;
 1023|    205|    }
 1024|       |
 1025|       |    // Second, look at the current position/
 1026|  5.74k|    bits = p224_get_bit(scalar, i + 168) << 3;
 1027|  5.74k|    bits |= p224_get_bit(scalar, i + 112) << 2;
 1028|  5.74k|    bits |= p224_get_bit(scalar, i + 56) << 1;
 1029|  5.74k|    bits |= p224_get_bit(scalar, i);
 1030|       |    // Select the point to add, in constant time.
 1031|  5.74k|    p224_select_point(bits, 16, g_p224_pre_comp[0], tmp);
 1032|  5.74k|    p224_point_add(nq[0], nq[1], nq[2], nq[0], nq[1], nq[2], 1 /* mixed */,
 1033|  5.74k|                   tmp[0], tmp[1], tmp[2]);
 1034|  5.74k|  }
 1035|       |
 1036|       |  // Reduce the output to its unique minimal representation.
 1037|    205|  p224_felem_to_generic(&r->X, nq[0]);
 1038|    205|  p224_felem_to_generic(&r->Y, nq[1]);
 1039|    205|  p224_felem_to_generic(&r->Z, nq[2]);
 1040|    205|}
bcm.c:ec_GFp_nistp224_felem_mul:
 1124|  1.92k|                                      const EC_FELEM *a, const EC_FELEM *b) {
 1125|  1.92k|  p224_felem felem1, felem2;
 1126|  1.92k|  p224_widefelem wide;
 1127|  1.92k|  p224_generic_to_felem(felem1, a);
 1128|  1.92k|  p224_generic_to_felem(felem2, b);
 1129|  1.92k|  p224_felem_mul(wide, felem1, felem2);
 1130|  1.92k|  p224_felem_reduce(felem1, wide);
 1131|  1.92k|  p224_felem_to_generic(r, felem1);
 1132|  1.92k|}
bcm.c:ec_GFp_nistp224_felem_sqr:
 1135|  1.97k|                                      const EC_FELEM *a) {
 1136|  1.97k|  p224_felem felem;
 1137|  1.97k|  p224_generic_to_felem(felem, a);
 1138|  1.97k|  p224_widefelem wide;
 1139|  1.97k|  p224_felem_square(wide, felem);
 1140|  1.97k|  p224_felem_reduce(felem, wide);
 1141|  1.97k|  p224_felem_to_generic(r, felem);
 1142|  1.97k|}

bcm.c:EC_GFp_nistz256_method_do_init:
  615|      1|DEFINE_METHOD_FUNCTION(EC_METHOD, EC_GFp_nistz256_method) {
  616|      1|  out->group_init = ec_GFp_mont_group_init;
  617|      1|  out->group_finish = ec_GFp_mont_group_finish;
  618|      1|  out->group_set_curve = ec_GFp_mont_group_set_curve;
  619|      1|  out->point_get_affine_coordinates = ecp_nistz256_get_affine;
  620|      1|  out->add = ecp_nistz256_add;
  621|      1|  out->dbl = ecp_nistz256_dbl;
  622|      1|  out->mul = ecp_nistz256_point_mul;
  623|      1|  out->mul_base = ecp_nistz256_point_mul_base;
  624|      1|  out->mul_public = ecp_nistz256_points_mul_public;
  625|      1|  out->felem_mul = ec_GFp_mont_felem_mul;
  626|      1|  out->felem_sqr = ec_GFp_mont_felem_sqr;
  627|      1|  out->felem_to_bytes = ec_GFp_mont_felem_to_bytes;
  628|      1|  out->felem_from_bytes = ec_GFp_mont_felem_from_bytes;
  629|      1|  out->felem_reduce = ec_GFp_mont_felem_reduce;
  630|       |  // TODO(davidben): This should use the specialized field arithmetic
  631|       |  // implementation, rather than the generic one.
  632|      1|  out->felem_exp = ec_GFp_mont_felem_exp;
  633|      1|  out->scalar_inv0_montgomery = ecp_nistz256_inv0_mod_ord;
  634|      1|  out->scalar_to_montgomery_inv_vartime =
  635|      1|      ecp_nistz256_scalar_to_montgomery_inv_vartime;
  636|      1|  out->cmp_x_coordinate = ecp_nistz256_cmp_x_coordinate;
  637|      1|}
bcm.c:copy_conditional:
   80|  8.36k|                             const BN_ULONG src[P256_LIMBS], BN_ULONG move) {
   81|  8.36k|  BN_ULONG mask1 = ((BN_ULONG)0) - move;
   82|  8.36k|  BN_ULONG mask2 = ~mask1;
   83|       |
   84|  8.36k|  dst[0] = (src[0] & mask1) ^ (dst[0] & mask2);
   85|  8.36k|  dst[1] = (src[1] & mask1) ^ (dst[1] & mask2);
   86|  8.36k|  dst[2] = (src[2] & mask1) ^ (dst[2] & mask2);
   87|  8.36k|  dst[3] = (src[3] & mask1) ^ (dst[3] & mask2);
   88|  8.36k|  if (P256_LIMBS == 8) {
  ------------------
  |  |   45|  8.36k|#define P256_LIMBS (256 / BN_BITS2)
  |  |  ------------------
  |  |  |  |  151|  8.36k|#define BN_BITS2 64
  |  |  ------------------
  ------------------
  |  Branch (88:7): [Folded - Ignored]
  ------------------
   89|      0|    dst[4] = (src[4] & mask1) ^ (dst[4] & mask2);
   90|      0|    dst[5] = (src[5] & mask1) ^ (dst[5] & mask2);
   91|      0|    dst[6] = (src[6] & mask1) ^ (dst[6] & mask2);
   92|      0|    dst[7] = (src[7] & mask1) ^ (dst[7] & mask2);
   93|      0|  }
   94|  8.36k|}
bcm.c:ecp_nistz256_point_mul_base:
  315|    220|                                        const EC_SCALAR *scalar) {
  316|    220|  uint8_t p_str[33];
  317|    220|  OPENSSL_memcpy(p_str, scalar->words, 32);
  318|    220|  p_str[32] = 0;
  319|       |
  320|       |  // First window
  321|    220|  size_t index = 0;
  322|    220|  crypto_word_t wvalue = calc_first_wvalue(&index, p_str);
  323|       |
  324|    220|  alignas(32) P256_POINT_AFFINE t;
  325|    220|  alignas(32) P256_POINT p;
  326|    220|  ecp_nistz256_select_w7(&t, ecp_nistz256_precomputed[0], wvalue >> 1);
  327|    220|  ecp_nistz256_neg(p.Z, t.Y);
  328|    220|  copy_conditional(t.Y, p.Z, wvalue & 1);
  329|       |
  330|       |  // Convert |t| from affine to Jacobian coordinates. We set Z to zero if |t|
  331|       |  // is infinity and |ONE| otherwise. |t| was computed from the table, so it
  332|       |  // is infinity iff |wvalue >> 1| is zero.
  333|    220|  OPENSSL_memcpy(p.X, t.X, sizeof(p.X));
  334|    220|  OPENSSL_memcpy(p.Y, t.Y, sizeof(p.Y));
  335|    220|  OPENSSL_memset(p.Z, 0, sizeof(p.Z));
  336|    220|  copy_conditional(p.Z, ONE, is_not_zero(wvalue >> 1));
  337|       |
  338|  8.14k|  for (int i = 1; i < 37; i++) {
  ------------------
  |  Branch (338:19): [True: 7.92k, False: 220]
  ------------------
  339|  7.92k|    wvalue = calc_wvalue(&index, p_str);
  340|       |
  341|  7.92k|    ecp_nistz256_select_w7(&t, ecp_nistz256_precomputed[i], wvalue >> 1);
  342|       |
  343|  7.92k|    alignas(32) BN_ULONG neg_Y[P256_LIMBS];
  344|  7.92k|    ecp_nistz256_neg(neg_Y, t.Y);
  345|  7.92k|    copy_conditional(t.Y, neg_Y, wvalue & 1);
  346|       |
  347|       |    // Note |ecp_nistz256_point_add_affine| does not work if |p| and |t| are the
  348|       |    // same non-infinity point.
  349|  7.92k|    ecp_nistz256_point_add_affine(&p, &p, &t);
  350|  7.92k|  }
  351|       |
  352|    220|  assert(group->field.width == P256_LIMBS);
  353|    220|  OPENSSL_memcpy(r->X.words, p.X, P256_LIMBS * sizeof(BN_ULONG));
  ------------------
  |  |   45|    220|#define P256_LIMBS (256 / BN_BITS2)
  |  |  ------------------
  |  |  |  |  151|    220|#define BN_BITS2 64
  |  |  ------------------
  ------------------
  354|    220|  OPENSSL_memcpy(r->Y.words, p.Y, P256_LIMBS * sizeof(BN_ULONG));
  ------------------
  |  |   45|    220|#define P256_LIMBS (256 / BN_BITS2)
  |  |  ------------------
  |  |  |  |  151|    220|#define BN_BITS2 64
  |  |  ------------------
  ------------------
  355|    220|  OPENSSL_memcpy(r->Z.words, p.Z, P256_LIMBS * sizeof(BN_ULONG));
  ------------------
  |  |   45|    220|#define P256_LIMBS (256 / BN_BITS2)
  |  |  ------------------
  |  |  |  |  151|    220|#define BN_BITS2 64
  |  |  ------------------
  ------------------
  356|    220|}
bcm.c:calc_first_wvalue:
  280|    220|static crypto_word_t calc_first_wvalue(size_t *index, const uint8_t p_str[33]) {
  281|    220|  static const size_t kWindowSize = 7;
  282|    220|  static const crypto_word_t kMask = (1 << (7 /* kWindowSize */ + 1)) - 1;
  283|    220|  *index = kWindowSize;
  284|       |
  285|    220|  crypto_word_t wvalue = (p_str[0] << 1) & kMask;
  286|    220|  return booth_recode_w7(wvalue);
  287|    220|}
bcm.c:booth_recode_w7:
   63|  8.14k|static crypto_word_t booth_recode_w7(crypto_word_t in) {
   64|  8.14k|  crypto_word_t s, d;
   65|       |
   66|  8.14k|  s = ~((in >> 7) - 1);
   67|  8.14k|  d = (1 << 8) - in - 1;
   68|  8.14k|  d = (d & s) | (in & ~s);
   69|  8.14k|  d = (d >> 1) + (d & 1);
   70|       |
   71|  8.14k|  return (d << 1) + (s & 1);
   72|  8.14k|}
bcm.c:is_not_zero:
  113|    220|static BN_ULONG is_not_zero(BN_ULONG in) {
  114|    220|  in |= (0 - in);
  115|    220|  in >>= BN_BITS2 - 1;
  ------------------
  |  |  151|    220|#define BN_BITS2 64
  ------------------
  116|    220|  return in;
  117|    220|}
bcm.c:calc_wvalue:
  289|  7.92k|static crypto_word_t calc_wvalue(size_t *index, const uint8_t p_str[33]) {
  290|  7.92k|  static const size_t kWindowSize = 7;
  291|  7.92k|  static const crypto_word_t kMask = (1 << (7 /* kWindowSize */ + 1)) - 1;
  292|       |
  293|  7.92k|  const size_t off = (*index - 1) / 8;
  294|  7.92k|  crypto_word_t wvalue =
  295|  7.92k|      (crypto_word_t)p_str[off] | (crypto_word_t)p_str[off + 1] << 8;
  296|  7.92k|  wvalue = (wvalue >> ((*index - 1) % 8)) & kMask;
  297|  7.92k|  *index += kWindowSize;
  298|       |
  299|  7.92k|  return booth_recode_w7(wvalue);
  300|  7.92k|}

ec_bignum_to_scalar:
   25|  1.16k|                        const BIGNUM *in) {
   26|  1.16k|  if (!bn_copy_words(out->words, group->order.width, in) ||
  ------------------
  |  Branch (26:7): [True: 141, False: 1.02k]
  ------------------
   27|  1.16k|      !bn_less_than_words(out->words, group->order.d, group->order.width)) {
  ------------------
  |  Branch (27:7): [True: 2, False: 1.02k]
  ------------------
   28|    143|    OPENSSL_PUT_ERROR(EC, EC_R_INVALID_SCALAR);
  ------------------
  |  |  441|    143|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   29|    143|    return 0;
   30|    143|  }
   31|  1.02k|  return 1;
   32|  1.16k|}
ec_scalar_is_zero:
   40|  1.02k|int ec_scalar_is_zero(const EC_GROUP *group, const EC_SCALAR *a) {
   41|  1.02k|  BN_ULONG mask = 0;
   42|  6.27k|  for (int i = 0; i < group->order.width; i++) {
  ------------------
  |  Branch (42:19): [True: 5.25k, False: 1.02k]
  ------------------
   43|  5.25k|    mask |= a->words[i];
   44|  5.25k|  }
   45|  1.02k|  return mask == 0;
   46|  1.02k|}

ec_GFp_simple_group_init:
   91|      4|int ec_GFp_simple_group_init(EC_GROUP *group) {
   92|      4|  BN_init(&group->field);
   93|      4|  group->a_is_minus3 = 0;
   94|      4|  return 1;
   95|      4|}
ec_GFp_simple_group_set_curve:
  103|      4|                                  BN_CTX *ctx) {
  104|       |  // p must be a prime > 3
  105|      4|  if (BN_num_bits(p) <= 2 || !BN_is_odd(p)) {
  ------------------
  |  Branch (105:7): [True: 0, False: 4]
  |  Branch (105:30): [True: 0, False: 4]
  ------------------
  106|      0|    OPENSSL_PUT_ERROR(EC, EC_R_INVALID_FIELD);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  107|      0|    return 0;
  108|      0|  }
  109|       |
  110|      4|  int ret = 0;
  111|      4|  BN_CTX_start(ctx);
  112|      4|  BIGNUM *tmp = BN_CTX_get(ctx);
  113|      4|  if (tmp == NULL) {
  ------------------
  |  Branch (113:7): [True: 0, False: 4]
  ------------------
  114|      0|    goto err;
  115|      0|  }
  116|       |
  117|       |  // group->field
  118|      4|  if (!BN_copy(&group->field, p)) {
  ------------------
  |  Branch (118:7): [True: 0, False: 4]
  ------------------
  119|      0|    goto err;
  120|      0|  }
  121|      4|  BN_set_negative(&group->field, 0);
  122|       |  // Store the field in minimal form, so it can be used with |BN_ULONG| arrays.
  123|      4|  bn_set_minimal_width(&group->field);
  124|       |
  125|      4|  if (!ec_bignum_to_felem(group, &group->a, a) ||
  ------------------
  |  Branch (125:7): [True: 0, False: 4]
  ------------------
  126|      4|      !ec_bignum_to_felem(group, &group->b, b) ||
  ------------------
  |  Branch (126:7): [True: 0, False: 4]
  ------------------
  127|      4|      !ec_bignum_to_felem(group, &group->one, BN_value_one())) {
  ------------------
  |  Branch (127:7): [True: 0, False: 4]
  ------------------
  128|      0|    goto err;
  129|      0|  }
  130|       |
  131|       |  // group->a_is_minus3
  132|      4|  if (!BN_copy(tmp, a) ||
  ------------------
  |  Branch (132:7): [True: 0, False: 4]
  ------------------
  133|      4|      !BN_add_word(tmp, 3)) {
  ------------------
  |  Branch (133:7): [True: 0, False: 4]
  ------------------
  134|      0|    goto err;
  135|      0|  }
  136|      4|  group->a_is_minus3 = (0 == BN_cmp(tmp, &group->field));
  137|       |
  138|      4|  ret = 1;
  139|       |
  140|      4|err:
  141|      4|  BN_CTX_end(ctx);
  142|      4|  return ret;
  143|      4|}
ec_GFp_simple_group_get_curve:
  146|    681|                                  BIGNUM *b) {
  147|    681|  if ((p != NULL && !BN_copy(p, &group->field)) ||
  ------------------
  |  Branch (147:8): [True: 0, False: 681]
  |  Branch (147:21): [True: 0, False: 0]
  ------------------
  148|    681|      (a != NULL && !ec_felem_to_bignum(group, a, &group->a)) ||
  ------------------
  |  Branch (148:8): [True: 681, False: 0]
  |  Branch (148:21): [True: 0, False: 681]
  ------------------
  149|    681|      (b != NULL && !ec_felem_to_bignum(group, b, &group->b))) {
  ------------------
  |  Branch (149:8): [True: 681, False: 0]
  |  Branch (149:21): [True: 0, False: 681]
  ------------------
  150|      0|    return 0;
  151|      0|  }
  152|    681|  return 1;
  153|    681|}
ec_GFp_simple_point_init:
  155|  1.44k|void ec_GFp_simple_point_init(EC_JACOBIAN *point) {
  156|  1.44k|  OPENSSL_memset(&point->X, 0, sizeof(EC_FELEM));
  157|  1.44k|  OPENSSL_memset(&point->Y, 0, sizeof(EC_FELEM));
  158|  1.44k|  OPENSSL_memset(&point->Z, 0, sizeof(EC_FELEM));
  159|  1.44k|}
ec_GFp_simple_point_copy:
  161|    584|void ec_GFp_simple_point_copy(EC_JACOBIAN *dest, const EC_JACOBIAN *src) {
  162|    584|  OPENSSL_memcpy(&dest->X, &src->X, sizeof(EC_FELEM));
  163|    584|  OPENSSL_memcpy(&dest->Y, &src->Y, sizeof(EC_FELEM));
  164|    584|  OPENSSL_memcpy(&dest->Z, &src->Z, sizeof(EC_FELEM));
  165|    584|}
ec_GFp_simple_point_set_to_infinity:
  168|    277|                                         EC_JACOBIAN *point) {
  169|       |  // Although it is strictly only necessary to zero Z, we zero the entire point
  170|       |  // in case |point| was stack-allocated and yet to be initialized.
  171|    277|  ec_GFp_simple_point_init(point);
  172|    277|}
ec_GFp_simple_is_at_infinity:
  179|    456|                                 const EC_JACOBIAN *point) {
  180|    456|  return ec_felem_non_zero_mask(group, &point->Z) == 0;
  181|    456|}
ec_GFp_simple_is_on_curve:
  184|  1.15k|                              const EC_JACOBIAN *point) {
  185|       |  // We have a curve defined by a Weierstrass equation
  186|       |  //      y^2 = x^3 + a*x + b.
  187|       |  // The point to consider is given in Jacobian projective coordinates
  188|       |  // where  (X, Y, Z)  represents  (x, y) = (X/Z^2, Y/Z^3).
  189|       |  // Substituting this and multiplying by  Z^6  transforms the above equation
  190|       |  // into
  191|       |  //      Y^2 = X^3 + a*X*Z^4 + b*Z^6.
  192|       |  // To test this, we add up the right-hand side in 'rh'.
  193|       |  //
  194|       |  // This function may be used when double-checking the secret result of a point
  195|       |  // multiplication, so we proceed in constant-time.
  196|       |
  197|  1.15k|  void (*const felem_mul)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a,
  198|  1.15k|                          const EC_FELEM *b) = group->meth->felem_mul;
  199|  1.15k|  void (*const felem_sqr)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a) =
  200|  1.15k|      group->meth->felem_sqr;
  201|       |
  202|       |  // rh := X^2
  203|  1.15k|  EC_FELEM rh;
  204|  1.15k|  felem_sqr(group, &rh, &point->X);
  205|       |
  206|  1.15k|  EC_FELEM tmp, Z4, Z6;
  207|  1.15k|  felem_sqr(group, &tmp, &point->Z);
  208|  1.15k|  felem_sqr(group, &Z4, &tmp);
  209|  1.15k|  felem_mul(group, &Z6, &Z4, &tmp);
  210|       |
  211|       |  // rh := rh + a*Z^4
  212|  1.15k|  if (group->a_is_minus3) {
  ------------------
  |  Branch (212:7): [True: 1.15k, False: 0]
  ------------------
  213|  1.15k|    ec_felem_add(group, &tmp, &Z4, &Z4);
  214|  1.15k|    ec_felem_add(group, &tmp, &tmp, &Z4);
  215|  1.15k|    ec_felem_sub(group, &rh, &rh, &tmp);
  216|  1.15k|  } else {
  217|      0|    felem_mul(group, &tmp, &Z4, &group->a);
  218|      0|    ec_felem_add(group, &rh, &rh, &tmp);
  219|      0|  }
  220|       |
  221|       |  // rh := (rh + a*Z^4)*X
  222|  1.15k|  felem_mul(group, &rh, &rh, &point->X);
  223|       |
  224|       |  // rh := rh + b*Z^6
  225|  1.15k|  felem_mul(group, &tmp, &group->b, &Z6);
  226|  1.15k|  ec_felem_add(group, &rh, &rh, &tmp);
  227|       |
  228|       |  // 'lh' := Y^2
  229|  1.15k|  felem_sqr(group, &tmp, &point->Y);
  230|       |
  231|  1.15k|  ec_felem_sub(group, &tmp, &tmp, &rh);
  232|  1.15k|  BN_ULONG not_equal = ec_felem_non_zero_mask(group, &tmp);
  233|       |
  234|       |  // If Z = 0, the point is infinity, which is always on the curve.
  235|  1.15k|  BN_ULONG not_infinity = ec_felem_non_zero_mask(group, &point->Z);
  236|       |
  237|  1.15k|  return 1 & ~(not_infinity & not_equal);
  238|  1.15k|}
ec_GFp_simple_points_equal:
  241|    456|                               const EC_JACOBIAN *b) {
  242|       |  // This function is implemented in constant-time for two reasons. First,
  243|       |  // although EC points are usually public, their Jacobian Z coordinates may be
  244|       |  // secret, or at least are not obviously public. Second, more complex
  245|       |  // protocols will sometimes manipulate secret points.
  246|       |  //
  247|       |  // This does mean that we pay a 6M+2S Jacobian comparison when comparing two
  248|       |  // publicly affine points costs no field operations at all. If needed, we can
  249|       |  // restore this optimization by keeping better track of affine vs. Jacobian
  250|       |  // forms. See https://crbug.com/boringssl/326.
  251|       |
  252|       |  // If neither |a| or |b| is infinity, we have to decide whether
  253|       |  //     (X_a/Z_a^2, Y_a/Z_a^3) = (X_b/Z_b^2, Y_b/Z_b^3),
  254|       |  // or equivalently, whether
  255|       |  //     (X_a*Z_b^2, Y_a*Z_b^3) = (X_b*Z_a^2, Y_b*Z_a^3).
  256|       |
  257|    456|  void (*const felem_mul)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a,
  258|    456|                          const EC_FELEM *b) = group->meth->felem_mul;
  259|    456|  void (*const felem_sqr)(const EC_GROUP *, EC_FELEM *r, const EC_FELEM *a) =
  260|    456|      group->meth->felem_sqr;
  261|       |
  262|    456|  EC_FELEM tmp1, tmp2, Za23, Zb23;
  263|    456|  felem_sqr(group, &Zb23, &b->Z);         // Zb23 = Z_b^2
  264|    456|  felem_mul(group, &tmp1, &a->X, &Zb23);  // tmp1 = X_a * Z_b^2
  265|    456|  felem_sqr(group, &Za23, &a->Z);         // Za23 = Z_a^2
  266|    456|  felem_mul(group, &tmp2, &b->X, &Za23);  // tmp2 = X_b * Z_a^2
  267|    456|  ec_felem_sub(group, &tmp1, &tmp1, &tmp2);
  268|    456|  const BN_ULONG x_not_equal = ec_felem_non_zero_mask(group, &tmp1);
  269|       |
  270|    456|  felem_mul(group, &Zb23, &Zb23, &b->Z);  // Zb23 = Z_b^3
  271|    456|  felem_mul(group, &tmp1, &a->Y, &Zb23);  // tmp1 = Y_a * Z_b^3
  272|    456|  felem_mul(group, &Za23, &Za23, &a->Z);  // Za23 = Z_a^3
  273|    456|  felem_mul(group, &tmp2, &b->Y, &Za23);  // tmp2 = Y_b * Z_a^3
  274|    456|  ec_felem_sub(group, &tmp1, &tmp1, &tmp2);
  275|    456|  const BN_ULONG y_not_equal = ec_felem_non_zero_mask(group, &tmp1);
  276|    456|  const BN_ULONG x_and_y_equal = ~(x_not_equal | y_not_equal);
  277|       |
  278|    456|  const BN_ULONG a_not_infinity = ec_felem_non_zero_mask(group, &a->Z);
  279|    456|  const BN_ULONG b_not_infinity = ec_felem_non_zero_mask(group, &b->Z);
  280|    456|  const BN_ULONG a_and_b_infinity = ~(a_not_infinity | b_not_infinity);
  281|       |
  282|    456|  const BN_ULONG equal =
  283|    456|      a_and_b_infinity | (a_not_infinity & b_not_infinity & x_and_y_equal);
  284|    456|  return equal & 1;
  285|    456|}
ec_GFp_simple_felem_to_bytes:
  331|  1.36k|                                  size_t *out_len, const EC_FELEM *in) {
  332|  1.36k|  size_t len = BN_num_bytes(&group->field);
  333|  1.36k|  bn_words_to_big_endian(out, len, in->words, group->field.width);
  334|  1.36k|  *out_len = len;
  335|  1.36k|}
ec_GFp_simple_felem_from_bytes:
  338|    992|                                   const uint8_t *in, size_t len) {
  339|    992|  if (len != BN_num_bytes(&group->field)) {
  ------------------
  |  Branch (339:7): [True: 0, False: 992]
  ------------------
  340|      0|    OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  341|      0|    return 0;
  342|      0|  }
  343|       |
  344|    992|  bn_big_endian_to_words(out->words, group->field.width, in, len);
  345|       |
  346|    992|  if (!bn_less_than_words(out->words, group->field.d, group->field.width)) {
  ------------------
  |  Branch (346:7): [True: 4, False: 988]
  ------------------
  347|      4|    OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
  ------------------
  |  |  441|      4|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  348|      4|    return 0;
  349|      4|  }
  350|       |
  351|    988|  return 1;
  352|    992|}

ec_GFp_mont_mul:
   25|    277|                     const EC_JACOBIAN *p, const EC_SCALAR *scalar) {
   26|       |  // This is a generic implementation for uncommon curves that not do not
   27|       |  // warrant a tuned one. It uses unsigned digits so that the doubling case in
   28|       |  // |ec_GFp_mont_add| is always unreachable, erring on safety and simplicity.
   29|       |
   30|       |  // Compute a table of the first 32 multiples of |p| (including infinity).
   31|    277|  EC_JACOBIAN precomp[32];
   32|    277|  ec_GFp_simple_point_set_to_infinity(group, &precomp[0]);
   33|    277|  ec_GFp_simple_point_copy(&precomp[1], p);
   34|  8.58k|  for (size_t j = 2; j < OPENSSL_ARRAY_SIZE(precomp); j++) {
  ------------------
  |  |  221|  8.58k|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0]))
  ------------------
  |  Branch (34:22): [True: 8.31k, False: 277]
  ------------------
   35|  8.31k|    if (j & 1) {
  ------------------
  |  Branch (35:9): [True: 4.15k, False: 4.15k]
  ------------------
   36|  4.15k|      ec_GFp_mont_add(group, &precomp[j], &precomp[1], &precomp[j - 1]);
   37|  4.15k|    } else {
   38|  4.15k|      ec_GFp_mont_dbl(group, &precomp[j], &precomp[j / 2]);
   39|  4.15k|    }
   40|  8.31k|  }
   41|       |
   42|       |  // Divide bits in |scalar| into windows.
   43|    277|  unsigned bits = BN_num_bits(&group->order);
   44|    277|  int r_is_at_infinity = 1;
   45|   139k|  for (unsigned i = bits - 1; i < bits; i--) {
  ------------------
  |  Branch (45:31): [True: 139k, False: 277]
  ------------------
   46|   139k|    if (!r_is_at_infinity) {
  ------------------
  |  Branch (46:9): [True: 139k, False: 385]
  ------------------
   47|   139k|      ec_GFp_mont_dbl(group, r, r);
   48|   139k|    }
   49|   139k|    if (i % 5 == 0) {
  ------------------
  |  Branch (49:9): [True: 28.0k, False: 111k]
  ------------------
   50|       |      // Compute the next window value.
   51|  28.0k|      const size_t width = group->order.width;
   52|  28.0k|      uint8_t window = bn_is_bit_set_words(scalar->words, width, i + 4) << 4;
   53|  28.0k|      window |= bn_is_bit_set_words(scalar->words, width, i + 3) << 3;
   54|  28.0k|      window |= bn_is_bit_set_words(scalar->words, width, i + 2) << 2;
   55|  28.0k|      window |= bn_is_bit_set_words(scalar->words, width, i + 1) << 1;
   56|  28.0k|      window |= bn_is_bit_set_words(scalar->words, width, i);
   57|       |
   58|       |      // Select the entry in constant-time.
   59|  28.0k|      EC_JACOBIAN tmp;
   60|  28.0k|      OPENSSL_memset(&tmp, 0, sizeof(EC_JACOBIAN));
   61|   926k|      for (size_t j = 0; j < OPENSSL_ARRAY_SIZE(precomp); j++) {
  ------------------
  |  |  221|   926k|#define OPENSSL_ARRAY_SIZE(array) (sizeof(array) / sizeof((array)[0]))
  ------------------
  |  Branch (61:26): [True: 898k, False: 28.0k]
  ------------------
   62|   898k|        BN_ULONG mask = constant_time_eq_w(j, window);
   63|   898k|        ec_point_select(group, &tmp, mask, &precomp[j], &tmp);
   64|   898k|      }
   65|       |
   66|  28.0k|      if (r_is_at_infinity) {
  ------------------
  |  Branch (66:11): [True: 277, False: 27.8k]
  ------------------
   67|    277|        ec_GFp_simple_point_copy(r, &tmp);
   68|    277|        r_is_at_infinity = 0;
   69|  27.8k|      } else {
   70|  27.8k|        ec_GFp_mont_add(group, r, r, &tmp);
   71|  27.8k|      }
   72|  28.0k|    }
   73|   139k|  }
   74|    277|  if (r_is_at_infinity) {
  ------------------
  |  Branch (74:7): [True: 0, False: 277]
  ------------------
   75|      0|    ec_GFp_simple_point_set_to_infinity(group, r);
   76|      0|  }
   77|    277|}
ec_GFp_mont_mul_base:
   80|    277|                          const EC_SCALAR *scalar) {
   81|    277|  ec_GFp_mont_mul(group, r, &group->generator->raw, scalar);
   82|    277|}

RSA_new:
  206|    603|RSA *RSA_new(void) { return RSA_new_method(NULL); }
RSA_new_method:
  208|    603|RSA *RSA_new_method(const ENGINE *engine) {
  209|    603|  RSA *rsa = OPENSSL_malloc(sizeof(RSA));
  210|    603|  if (rsa == NULL) {
  ------------------
  |  Branch (210:7): [True: 0, False: 603]
  ------------------
  211|      0|    return NULL;
  212|      0|  }
  213|       |
  214|    603|  OPENSSL_memset(rsa, 0, sizeof(RSA));
  215|       |
  216|    603|  if (engine) {
  ------------------
  |  Branch (216:7): [True: 0, False: 603]
  ------------------
  217|      0|    rsa->meth = ENGINE_get_RSA_method(engine);
  218|      0|  }
  219|       |
  220|    603|  if (rsa->meth == NULL) {
  ------------------
  |  Branch (220:7): [True: 603, False: 0]
  ------------------
  221|    603|    rsa->meth = (RSA_METHOD *) RSA_default_method();
  222|    603|  }
  223|    603|  METHOD_ref(rsa->meth);
  224|       |
  225|    603|  rsa->references = 1;
  226|    603|  rsa->flags = rsa->meth->flags;
  227|    603|  CRYPTO_MUTEX_init(&rsa->lock);
  228|    603|  CRYPTO_new_ex_data(&rsa->ex_data);
  229|       |
  230|    603|  if (rsa->meth->init && !rsa->meth->init(rsa)) {
  ------------------
  |  Branch (230:7): [True: 0, False: 603]
  |  Branch (230:26): [True: 0, False: 0]
  ------------------
  231|      0|    CRYPTO_free_ex_data(g_rsa_ex_data_class_bss_get(), rsa, &rsa->ex_data);
  232|      0|    CRYPTO_MUTEX_cleanup(&rsa->lock);
  233|      0|    METHOD_unref(rsa->meth);
  234|      0|    OPENSSL_free(rsa);
  235|      0|    return NULL;
  236|      0|  }
  237|       |
  238|    603|  return rsa;
  239|    603|}
RSA_free:
  252|  1.83k|void RSA_free(RSA *rsa) {
  253|  1.83k|  if (rsa == NULL) {
  ------------------
  |  Branch (253:7): [True: 1.22k, False: 603]
  ------------------
  254|  1.22k|    return;
  255|  1.22k|  }
  256|       |
  257|    603|  if (!CRYPTO_refcount_dec_and_test_zero(&rsa->references)) {
  ------------------
  |  Branch (257:7): [True: 0, False: 603]
  ------------------
  258|      0|    return;
  259|      0|  }
  260|       |
  261|    603|  if (rsa->meth->finish) {
  ------------------
  |  Branch (261:7): [True: 0, False: 603]
  ------------------
  262|      0|    rsa->meth->finish(rsa);
  263|      0|  }
  264|    603|  METHOD_unref(rsa->meth);
  265|       |
  266|    603|  CRYPTO_free_ex_data(g_rsa_ex_data_class_bss_get(), rsa, &rsa->ex_data);
  267|       |
  268|    603|  BN_free(rsa->n);
  269|    603|  BN_free(rsa->e);
  270|    603|  BN_free(rsa->d);
  271|    603|  BN_free(rsa->p);
  272|    603|  BN_free(rsa->q);
  273|    603|  BN_free(rsa->dmp1);
  274|    603|  BN_free(rsa->dmq1);
  275|    603|  BN_free(rsa->iqmp);
  276|    603|  rsa_invalidate_key(rsa);
  277|    603|  CRYPTO_MUTEX_cleanup(&rsa->lock);
  278|    603|  OPENSSL_free(rsa);
  279|    603|}
RSA_is_opaque:
  438|    458|int RSA_is_opaque(const RSA *rsa) {
  439|    458|  return rsa->meth && (rsa->meth->flags & RSA_FLAG_OPAQUE);
  ------------------
  |  |  661|    458|#define RSA_FLAG_OPAQUE 1
  ------------------
  |  Branch (439:10): [True: 458, False: 0]
  |  Branch (439:23): [True: 0, False: 458]
  ------------------
  440|    458|}
RSA_check_key:
  787|    458|int RSA_check_key(const RSA *key) {
  788|       |  // TODO(davidben): RSA key initialization is spread across
  789|       |  // |rsa_check_public_key|, |RSA_check_key|, |freeze_private_key|, and
  790|       |  // |BN_MONT_CTX_set_locked| as a result of API issues. See
  791|       |  // https://crbug.com/boringssl/316. As a result, we inconsistently check RSA
  792|       |  // invariants. We should fix this and integrate that logic.
  793|       |
  794|    458|  if (RSA_is_opaque(key)) {
  ------------------
  |  Branch (794:7): [True: 0, False: 458]
  ------------------
  795|       |    // Opaque keys can't be checked.
  796|      0|    return 1;
  797|      0|  }
  798|       |
  799|    458|  if (!rsa_check_public_key(key)) {
  ------------------
  |  Branch (799:7): [True: 352, False: 106]
  ------------------
  800|    352|    return 0;
  801|    352|  }
  802|       |
  803|    106|  if ((key->p != NULL) != (key->q != NULL)) {
  ------------------
  |  Branch (803:7): [True: 0, False: 106]
  ------------------
  804|      0|    OPENSSL_PUT_ERROR(RSA, RSA_R_ONLY_ONE_OF_P_Q_GIVEN);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  805|      0|    return 0;
  806|      0|  }
  807|       |
  808|       |  // |key->d| must be bounded by |key->n|. This ensures bounds on |RSA_bits|
  809|       |  // translate to bounds on the running time of private key operations.
  810|    106|  if (key->d != NULL &&
  ------------------
  |  Branch (810:7): [True: 106, False: 0]
  ------------------
  811|    106|      (BN_is_negative(key->d) || BN_cmp(key->d, key->n) >= 0)) {
  ------------------
  |  Branch (811:8): [True: 0, False: 106]
  |  Branch (811:34): [True: 2, False: 104]
  ------------------
  812|      2|    OPENSSL_PUT_ERROR(RSA, RSA_R_D_OUT_OF_RANGE);
  ------------------
  |  |  441|      2|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  813|      2|    return 0;
  814|      2|  }
  815|       |
  816|    104|  if (key->d == NULL || key->p == NULL) {
  ------------------
  |  Branch (816:7): [True: 0, False: 104]
  |  Branch (816:25): [True: 0, False: 104]
  ------------------
  817|       |    // For a public key, or without p and q, there's nothing that can be
  818|       |    // checked.
  819|      0|    return 1;
  820|      0|  }
  821|       |
  822|    104|  BN_CTX *ctx = BN_CTX_new();
  823|    104|  if (ctx == NULL) {
  ------------------
  |  Branch (823:7): [True: 0, False: 104]
  ------------------
  824|      0|    return 0;
  825|      0|  }
  826|       |
  827|    104|  BIGNUM tmp, de, pm1, qm1, dmp1, dmq1;
  828|    104|  int ok = 0;
  829|    104|  BN_init(&tmp);
  830|    104|  BN_init(&de);
  831|    104|  BN_init(&pm1);
  832|    104|  BN_init(&qm1);
  833|    104|  BN_init(&dmp1);
  834|    104|  BN_init(&dmq1);
  835|       |
  836|       |  // Check that p * q == n. Before we multiply, we check that p and q are in
  837|       |  // bounds, to avoid a DoS vector in |bn_mul_consttime| below. Note that
  838|       |  // n was bound by |rsa_check_public_key|. This also implicitly checks p and q
  839|       |  // are odd, which is a necessary condition for Montgomery reduction.
  840|    104|  if (BN_is_negative(key->p) || BN_cmp(key->p, key->n) >= 0 ||
  ------------------
  |  Branch (840:7): [True: 0, False: 104]
  |  Branch (840:33): [True: 2, False: 102]
  ------------------
  841|    104|      BN_is_negative(key->q) || BN_cmp(key->q, key->n) >= 0) {
  ------------------
  |  Branch (841:7): [True: 0, False: 102]
  |  Branch (841:33): [True: 2, False: 100]
  ------------------
  842|      4|    OPENSSL_PUT_ERROR(RSA, RSA_R_N_NOT_EQUAL_P_Q);
  ------------------
  |  |  441|      4|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  843|      4|    goto out;
  844|      4|  }
  845|    100|  if (!bn_mul_consttime(&tmp, key->p, key->q, ctx)) {
  ------------------
  |  Branch (845:7): [True: 0, False: 100]
  ------------------
  846|      0|    OPENSSL_PUT_ERROR(RSA, ERR_LIB_BN);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  847|      0|    goto out;
  848|      0|  }
  849|    100|  if (BN_cmp(&tmp, key->n) != 0) {
  ------------------
  |  Branch (849:7): [True: 100, False: 0]
  ------------------
  850|    100|    OPENSSL_PUT_ERROR(RSA, RSA_R_N_NOT_EQUAL_P_Q);
  ------------------
  |  |  441|    100|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  851|    100|    goto out;
  852|    100|  }
  853|       |
  854|       |  // d must be an inverse of e mod the Carmichael totient, lcm(p-1, q-1), but it
  855|       |  // may be unreduced because other implementations use the Euler totient. We
  856|       |  // simply check that d * e is one mod p-1 and mod q-1. Note d and e were bound
  857|       |  // by earlier checks in this function.
  858|      0|  if (!bn_usub_consttime(&pm1, key->p, BN_value_one()) ||
  ------------------
  |  Branch (858:7): [True: 0, False: 0]
  ------------------
  859|      0|      !bn_usub_consttime(&qm1, key->q, BN_value_one())) {
  ------------------
  |  Branch (859:7): [True: 0, False: 0]
  ------------------
  860|      0|    OPENSSL_PUT_ERROR(RSA, ERR_LIB_BN);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  861|      0|    goto out;
  862|      0|  }
  863|      0|  const unsigned pm1_bits = BN_num_bits(&pm1);
  864|      0|  const unsigned qm1_bits = BN_num_bits(&qm1);
  865|      0|  if (!bn_mul_consttime(&de, key->d, key->e, ctx) ||
  ------------------
  |  Branch (865:7): [True: 0, False: 0]
  ------------------
  866|      0|      !bn_div_consttime(NULL, &tmp, &de, &pm1, pm1_bits, ctx) ||
  ------------------
  |  Branch (866:7): [True: 0, False: 0]
  ------------------
  867|      0|      !bn_div_consttime(NULL, &de, &de, &qm1, qm1_bits, ctx)) {
  ------------------
  |  Branch (867:7): [True: 0, False: 0]
  ------------------
  868|      0|    OPENSSL_PUT_ERROR(RSA, ERR_LIB_BN);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  869|      0|    goto out;
  870|      0|  }
  871|       |
  872|      0|  if (!BN_is_one(&tmp) || !BN_is_one(&de)) {
  ------------------
  |  Branch (872:7): [True: 0, False: 0]
  |  Branch (872:27): [True: 0, False: 0]
  ------------------
  873|      0|    OPENSSL_PUT_ERROR(RSA, RSA_R_D_E_NOT_CONGRUENT_TO_1);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  874|      0|    goto out;
  875|      0|  }
  876|       |
  877|      0|  int has_crt_values = key->dmp1 != NULL;
  878|      0|  if (has_crt_values != (key->dmq1 != NULL) ||
  ------------------
  |  Branch (878:7): [True: 0, False: 0]
  ------------------
  879|      0|      has_crt_values != (key->iqmp != NULL)) {
  ------------------
  |  Branch (879:7): [True: 0, False: 0]
  ------------------
  880|      0|    OPENSSL_PUT_ERROR(RSA, RSA_R_INCONSISTENT_SET_OF_CRT_VALUES);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  881|      0|    goto out;
  882|      0|  }
  883|       |
  884|      0|  if (has_crt_values) {
  ------------------
  |  Branch (884:7): [True: 0, False: 0]
  ------------------
  885|      0|    int dmp1_ok, dmq1_ok, iqmp_ok;
  886|      0|    if (!check_mod_inverse(&dmp1_ok, key->e, key->dmp1, &pm1, pm1_bits, ctx) ||
  ------------------
  |  Branch (886:9): [True: 0, False: 0]
  ------------------
  887|      0|        !check_mod_inverse(&dmq1_ok, key->e, key->dmq1, &qm1, qm1_bits, ctx) ||
  ------------------
  |  Branch (887:9): [True: 0, False: 0]
  ------------------
  888|       |        // |p| is odd, so |pm1| and |p| have the same bit width. If they didn't,
  889|       |        // we only need a lower bound anyway.
  890|      0|        !check_mod_inverse(&iqmp_ok, key->q, key->iqmp, key->p, pm1_bits,
  ------------------
  |  Branch (890:9): [True: 0, False: 0]
  ------------------
  891|      0|                           ctx)) {
  892|      0|      OPENSSL_PUT_ERROR(RSA, ERR_LIB_BN);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  893|      0|      goto out;
  894|      0|    }
  895|       |
  896|      0|    if (!dmp1_ok || !dmq1_ok || !iqmp_ok) {
  ------------------
  |  Branch (896:9): [True: 0, False: 0]
  |  Branch (896:21): [True: 0, False: 0]
  |  Branch (896:33): [True: 0, False: 0]
  ------------------
  897|      0|      OPENSSL_PUT_ERROR(RSA, RSA_R_CRT_VALUES_INCORRECT);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  898|      0|      goto out;
  899|      0|    }
  900|      0|  }
  901|       |
  902|      0|  ok = 1;
  903|       |
  904|    104|out:
  905|    104|  BN_free(&tmp);
  906|    104|  BN_free(&de);
  907|    104|  BN_free(&pm1);
  908|    104|  BN_free(&qm1);
  909|    104|  BN_free(&dmp1);
  910|    104|  BN_free(&dmq1);
  911|    104|  BN_CTX_free(ctx);
  912|       |
  913|    104|  return ok;
  914|      0|}

rsa_check_public_key:
   76|    458|int rsa_check_public_key(const RSA *rsa) {
   77|    458|  if (rsa->n == NULL) {
  ------------------
  |  Branch (77:7): [True: 0, False: 458]
  ------------------
   78|      0|    OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   79|      0|    return 0;
   80|      0|  }
   81|       |
   82|       |  // TODO(davidben): 16384-bit RSA is huge. Can we bring this down to a limit of
   83|       |  // 8192-bit?
   84|    458|  unsigned n_bits = BN_num_bits(rsa->n);
   85|    458|  if (n_bits > 16 * 1024) {
  ------------------
  |  Branch (85:7): [True: 15, False: 443]
  ------------------
   86|     15|    OPENSSL_PUT_ERROR(RSA, RSA_R_MODULUS_TOO_LARGE);
  ------------------
  |  |  441|     15|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   87|     15|    return 0;
   88|     15|  }
   89|       |
   90|       |  // TODO(crbug.com/boringssl/607): Raise this limit. 512-bit RSA was factored
   91|       |  // in 1999.
   92|    443|  if (n_bits < 512) {
  ------------------
  |  Branch (92:7): [True: 152, False: 291]
  ------------------
   93|    152|    OPENSSL_PUT_ERROR(RSA, RSA_R_KEY_SIZE_TOO_SMALL);
  ------------------
  |  |  441|    152|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
   94|    152|    return 0;
   95|    152|  }
   96|       |
   97|       |  // RSA moduli must be positive and odd. In addition to being necessary for RSA
   98|       |  // in general, we cannot setup Montgomery reduction with even moduli.
   99|    291|  if (!BN_is_odd(rsa->n) || BN_is_negative(rsa->n)) {
  ------------------
  |  Branch (99:7): [True: 1, False: 290]
  |  Branch (99:29): [True: 0, False: 290]
  ------------------
  100|      1|    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_RSA_PARAMETERS);
  ------------------
  |  |  441|      1|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  101|      1|    return 0;
  102|      1|  }
  103|       |
  104|    290|  static const unsigned kMaxExponentBits = 33;
  105|    290|  if (rsa->e != NULL) {
  ------------------
  |  Branch (105:7): [True: 290, False: 0]
  ------------------
  106|       |    // Reject e = 1, negative e, and even e. e must be odd to be relatively
  107|       |    // prime with phi(n).
  108|    290|    unsigned e_bits = BN_num_bits(rsa->e);
  109|    290|    if (e_bits < 2 || BN_is_negative(rsa->e) || !BN_is_odd(rsa->e)) {
  ------------------
  |  Branch (109:9): [True: 2, False: 288]
  |  Branch (109:23): [True: 0, False: 288]
  |  Branch (109:49): [True: 78, False: 210]
  ------------------
  110|     80|      OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE);
  ------------------
  |  |  441|     80|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  111|     80|      return 0;
  112|     80|    }
  113|    210|    if (rsa->flags & RSA_FLAG_LARGE_PUBLIC_EXPONENT) {
  ------------------
  |  |  683|    210|#define RSA_FLAG_LARGE_PUBLIC_EXPONENT 0x80
  ------------------
  |  Branch (113:9): [True: 0, False: 210]
  ------------------
  114|       |      // The caller has requested disabling DoS protections. Still, e must be
  115|       |      // less than n.
  116|      0|      if (BN_ucmp(rsa->n, rsa->e) <= 0) {
  ------------------
  |  Branch (116:11): [True: 0, False: 0]
  ------------------
  117|      0|        OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  118|      0|        return 0;
  119|      0|      }
  120|    210|    } else {
  121|       |      // Mitigate DoS attacks by limiting the exponent size. 33 bits was chosen
  122|       |      // as the limit based on the recommendations in [1] and [2]. Windows
  123|       |      // CryptoAPI doesn't support values larger than 32 bits [3], so it is
  124|       |      // unlikely that exponents larger than 32 bits are being used for anything
  125|       |      // Windows commonly does.
  126|       |      //
  127|       |      // [1] https://www.imperialviolet.org/2012/03/16/rsae.html
  128|       |      // [2] https://www.imperialviolet.org/2012/03/17/rsados.html
  129|       |      // [3] https://msdn.microsoft.com/en-us/library/aa387685(VS.85).aspx
  130|    210|      if (e_bits > kMaxExponentBits) {
  ------------------
  |  Branch (130:11): [True: 104, False: 106]
  ------------------
  131|    104|        OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_E_VALUE);
  ------------------
  |  |  441|    104|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  132|    104|        return 0;
  133|    104|      }
  134|       |
  135|       |      // The upper bound on |e_bits| and lower bound on |n_bits| imply e is
  136|       |      // bounded by n.
  137|    106|      assert(BN_ucmp(rsa->n, rsa->e) > 0);
  138|    106|    }
  139|    210|  } else if (!(rsa->flags & RSA_FLAG_NO_PUBLIC_EXPONENT)) {
  ------------------
  |  |  677|      0|#define RSA_FLAG_NO_PUBLIC_EXPONENT 0x40
  ------------------
  |  Branch (139:14): [True: 0, False: 0]
  ------------------
  140|      0|    OPENSSL_PUT_ERROR(RSA, RSA_R_VALUE_MISSING);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  141|      0|    return 0;
  142|      0|  }
  143|       |
  144|    106|  return 1;
  145|    290|}
rsa_invalidate_key:
  289|    603|void rsa_invalidate_key(RSA *rsa) {
  290|    603|  rsa->private_key_frozen = 0;
  291|       |
  292|    603|  BN_MONT_CTX_free(rsa->mont_n);
  293|    603|  rsa->mont_n = NULL;
  294|    603|  BN_MONT_CTX_free(rsa->mont_p);
  295|    603|  rsa->mont_p = NULL;
  296|    603|  BN_MONT_CTX_free(rsa->mont_q);
  297|    603|  rsa->mont_q = NULL;
  298|       |
  299|    603|  BN_free(rsa->d_fixed);
  300|    603|  rsa->d_fixed = NULL;
  301|    603|  BN_free(rsa->dmp1_fixed);
  302|    603|  rsa->dmp1_fixed = NULL;
  303|    603|  BN_free(rsa->dmq1_fixed);
  304|    603|  rsa->dmq1_fixed = NULL;
  305|    603|  BN_free(rsa->inv_small_mod_large_mont);
  306|    603|  rsa->inv_small_mod_large_mont = NULL;
  307|       |
  308|    603|  for (size_t i = 0; i < rsa->num_blindings; i++) {
  ------------------
  |  Branch (308:22): [True: 0, False: 603]
  ------------------
  309|      0|    BN_BLINDING_free(rsa->blindings[i]);
  310|      0|  }
  311|    603|  OPENSSL_free(rsa->blindings);
  312|    603|  rsa->blindings = NULL;
  313|    603|  rsa->num_blindings = 0;
  314|    603|  OPENSSL_free(rsa->blindings_inuse);
  315|    603|  rsa->blindings_inuse = NULL;
  316|    603|  rsa->blinding_fork_generation = 0;
  317|    603|}
bcm.c:RSA_default_method_do_init:
 1349|      1|DEFINE_METHOD_FUNCTION(RSA_METHOD, RSA_default_method) {
 1350|       |  // All of the methods are NULL to make it easier for the compiler/linker to
 1351|       |  // drop unused functions. The wrapper functions will select the appropriate
 1352|       |  // |rsa_default_*| implementation.
 1353|      1|  OPENSSL_memset(out, 0, sizeof(RSA_METHOD));
 1354|      1|  out->common.is_static = 1;
 1355|      1|}

bcm.c:FIPS_service_indicator_update_state:
   56|     51|OPENSSL_INLINE void FIPS_service_indicator_update_state(void) {}

SHA512_Init:
   94|     51|int SHA512_Init(SHA512_CTX *sha) {
   95|     51|  sha->h[0] = UINT64_C(0x6a09e667f3bcc908);
   96|     51|  sha->h[1] = UINT64_C(0xbb67ae8584caa73b);
   97|     51|  sha->h[2] = UINT64_C(0x3c6ef372fe94f82b);
   98|     51|  sha->h[3] = UINT64_C(0xa54ff53a5f1d36f1);
   99|     51|  sha->h[4] = UINT64_C(0x510e527fade682d1);
  100|     51|  sha->h[5] = UINT64_C(0x9b05688c2b3e6c1f);
  101|     51|  sha->h[6] = UINT64_C(0x1f83d9abfb41bd6b);
  102|     51|  sha->h[7] = UINT64_C(0x5be0cd19137e2179);
  103|       |
  104|     51|  sha->Nl = 0;
  105|     51|  sha->Nh = 0;
  106|     51|  sha->num = 0;
  107|     51|  sha->md_len = SHA512_DIGEST_LENGTH;
  ------------------
  |  |  230|     51|#define SHA512_DIGEST_LENGTH 64
  ------------------
  108|     51|  return 1;
  109|     51|}
SHA512:
  139|     51|                uint8_t out[SHA512_DIGEST_LENGTH]) {
  140|     51|  SHA512_CTX ctx;
  141|     51|  SHA512_Init(&ctx);
  142|     51|  SHA512_Update(&ctx, data, len);
  143|     51|  SHA512_Final(out, &ctx);
  144|     51|  OPENSSL_cleanse(&ctx, sizeof(ctx));
  145|     51|  return out;
  146|     51|}
SHA512_Update:
  190|     51|int SHA512_Update(SHA512_CTX *c, const void *in_data, size_t len) {
  191|     51|  uint64_t l;
  192|     51|  uint8_t *p = c->p;
  193|     51|  const uint8_t *data = in_data;
  194|       |
  195|     51|  if (len == 0) {
  ------------------
  |  Branch (195:7): [True: 0, False: 51]
  ------------------
  196|      0|    return 1;
  197|      0|  }
  198|       |
  199|     51|  l = (c->Nl + (((uint64_t)len) << 3)) & UINT64_C(0xffffffffffffffff);
  200|     51|  if (l < c->Nl) {
  ------------------
  |  Branch (200:7): [True: 0, False: 51]
  ------------------
  201|      0|    c->Nh++;
  202|      0|  }
  203|     51|  if (sizeof(len) >= 8) {
  ------------------
  |  Branch (203:7): [Folded - Ignored]
  ------------------
  204|     51|    c->Nh += (((uint64_t)len) >> 61);
  205|     51|  }
  206|     51|  c->Nl = l;
  207|       |
  208|     51|  if (c->num != 0) {
  ------------------
  |  Branch (208:7): [True: 0, False: 51]
  ------------------
  209|      0|    size_t n = sizeof(c->p) - c->num;
  210|       |
  211|      0|    if (len < n) {
  ------------------
  |  Branch (211:9): [True: 0, False: 0]
  ------------------
  212|      0|      OPENSSL_memcpy(p + c->num, data, len);
  213|      0|      c->num += (unsigned int)len;
  214|      0|      return 1;
  215|      0|    } else {
  216|      0|      OPENSSL_memcpy(p + c->num, data, n), c->num = 0;
  217|      0|      len -= n;
  218|      0|      data += n;
  219|      0|      sha512_block_data_order(c->h, p, 1);
  220|      0|    }
  221|      0|  }
  222|       |
  223|     51|  if (len >= sizeof(c->p)) {
  ------------------
  |  Branch (223:7): [True: 0, False: 51]
  ------------------
  224|      0|    sha512_block_data_order(c->h, data, len / sizeof(c->p));
  225|      0|    data += len;
  226|      0|    len %= sizeof(c->p);
  227|      0|    data -= len;
  228|      0|  }
  229|       |
  230|     51|  if (len != 0) {
  ------------------
  |  Branch (230:7): [True: 51, False: 0]
  ------------------
  231|     51|    OPENSSL_memcpy(p, data, len);
  232|     51|    c->num = (int)len;
  233|     51|  }
  234|       |
  235|     51|  return 1;
  236|     51|}
SHA512_Final:
  238|     51|int SHA512_Final(uint8_t out[SHA512_DIGEST_LENGTH], SHA512_CTX *sha) {
  239|       |  // Ideally we would assert |sha->md_len| is |SHA512_DIGEST_LENGTH| to match
  240|       |  // the size hint, but calling code often pairs |SHA384_Init| with
  241|       |  // |SHA512_Final| and expects |sha->md_len| to carry the size over.
  242|       |  //
  243|       |  // TODO(davidben): Add an assert and fix code to match them up.
  244|     51|  return sha512_final_impl(out, sha->md_len, sha);
  245|     51|}
bcm.c:sha512_final_impl:
  247|     51|static int sha512_final_impl(uint8_t *out, size_t md_len, SHA512_CTX *sha) {
  248|     51|  uint8_t *p = sha->p;
  249|     51|  size_t n = sha->num;
  250|       |
  251|     51|  p[n] = 0x80;  // There always is a room for one
  252|     51|  n++;
  253|     51|  if (n > (sizeof(sha->p) - 16)) {
  ------------------
  |  Branch (253:7): [True: 0, False: 51]
  ------------------
  254|      0|    OPENSSL_memset(p + n, 0, sizeof(sha->p) - n);
  255|      0|    n = 0;
  256|      0|    sha512_block_data_order(sha->h, p, 1);
  257|      0|  }
  258|       |
  259|     51|  OPENSSL_memset(p + n, 0, sizeof(sha->p) - 16 - n);
  260|     51|  CRYPTO_store_u64_be(p + sizeof(sha->p) - 16, sha->Nh);
  261|     51|  CRYPTO_store_u64_be(p + sizeof(sha->p) - 8, sha->Nl);
  262|       |
  263|     51|  sha512_block_data_order(sha->h, p, 1);
  264|       |
  265|     51|  if (out == NULL) {
  ------------------
  |  Branch (265:7): [True: 0, False: 51]
  ------------------
  266|       |    // TODO(davidben): This NULL check is absent in other low-level hash 'final'
  267|       |    // functions and is one of the few places one can fail.
  268|      0|    return 0;
  269|      0|  }
  270|       |
  271|     51|  assert(md_len % 8 == 0);
  272|     51|  const size_t out_words = md_len / 8;
  273|    459|  for (size_t i = 0; i < out_words; i++) {
  ------------------
  |  Branch (273:22): [True: 408, False: 51]
  ------------------
  274|    408|    CRYPTO_store_u64_be(out, sha->h[i]);
  275|    408|    out += 8;
  276|    408|  }
  277|       |
  278|     51|  FIPS_service_indicator_update_state();
  279|     51|  return 1;
  280|     51|}

cbb.c:OPENSSL_memset:
 1055|  20.3k|static inline void *OPENSSL_memset(void *dst, int c, size_t n) {
 1056|  20.3k|  if (n == 0) {
  ------------------
  |  Branch (1056:7): [True: 0, False: 20.3k]
  ------------------
 1057|      0|    return dst;
 1058|      0|  }
 1059|       |
 1060|  20.3k|  return memset(dst, c, n);
 1061|  20.3k|}
cbb.c:OPENSSL_memmove:
 1047|  1.46k|static inline void *OPENSSL_memmove(void *dst, const void *src, size_t n) {
 1048|  1.46k|  if (n == 0) {
  ------------------
  |  Branch (1048:7): [True: 0, False: 1.46k]
  ------------------
 1049|      0|    return dst;
 1050|      0|  }
 1051|       |
 1052|  1.46k|  return memmove(dst, src, n);
 1053|  1.46k|}
cbb.c:OPENSSL_memcpy:
 1039|  1.14k|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) {
 1040|  1.14k|  if (n == 0) {
  ------------------
  |  Branch (1040:7): [True: 0, False: 1.14k]
  ------------------
 1041|      0|    return dst;
 1042|      0|  }
 1043|       |
 1044|  1.14k|  return memcpy(dst, src, n);
 1045|  1.14k|}
err.c:OPENSSL_memset:
 1055|  39.2k|static inline void *OPENSSL_memset(void *dst, int c, size_t n) {
 1056|  39.2k|  if (n == 0) {
  ------------------
  |  Branch (1056:7): [True: 0, False: 39.2k]
  ------------------
 1057|      0|    return dst;
 1058|      0|  }
 1059|       |
 1060|  39.2k|  return memset(dst, c, n);
 1061|  39.2k|}
evp.c:OPENSSL_memset:
 1055|  4.45k|static inline void *OPENSSL_memset(void *dst, int c, size_t n) {
 1056|  4.45k|  if (n == 0) {
  ------------------
  |  Branch (1056:7): [True: 0, False: 4.45k]
  ------------------
 1057|      0|    return dst;
 1058|      0|  }
 1059|       |
 1060|  4.45k|  return memset(dst, c, n);
 1061|  4.45k|}
evp_asn1.c:OPENSSL_memcmp:
 1031|  6.07k|static inline int OPENSSL_memcmp(const void *s1, const void *s2, size_t n) {
 1032|  6.07k|  if (n == 0) {
  ------------------
  |  Branch (1032:7): [True: 0, False: 6.07k]
  ------------------
 1033|      0|    return 0;
 1034|      0|  }
 1035|       |
 1036|  6.07k|  return memcmp(s1, s2, n);
 1037|  6.07k|}
p_x25519_asn1.c:OPENSSL_memcpy:
 1039|     85|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) {
 1040|     85|  if (n == 0) {
  ------------------
  |  Branch (1040:7): [True: 0, False: 85]
  ------------------
 1041|      0|    return dst;
 1042|      0|  }
 1043|       |
 1044|     85|  return memcpy(dst, src, n);
 1045|     85|}
mem.c:OPENSSL_memset:
 1055|   104k|static inline void *OPENSSL_memset(void *dst, int c, size_t n) {
 1056|   104k|  if (n == 0) {
  ------------------
  |  Branch (1056:7): [True: 0, False: 104k]
  ------------------
 1057|      0|    return dst;
 1058|      0|  }
 1059|       |
 1060|   104k|  return memset(dst, c, n);
 1061|   104k|}
refcount.c:CRYPTO_atomic_load_u32:
  626|  7.57k|OPENSSL_INLINE uint32_t CRYPTO_atomic_load_u32(CRYPTO_atomic_u32 *val) {
  627|  7.57k|  return atomic_load(val);
  628|  7.57k|}
refcount.c:CRYPTO_atomic_compare_exchange_weak_u32:
  631|  7.57k|    CRYPTO_atomic_u32 *val, uint32_t *expected, uint32_t desired) {
  632|  7.57k|  return atomic_compare_exchange_weak(val, expected, desired);
  633|  7.57k|}
thread_pthread.c:OPENSSL_memset:
 1055|      1|static inline void *OPENSSL_memset(void *dst, int c, size_t n) {
 1056|      1|  if (n == 0) {
  ------------------
  |  Branch (1056:7): [True: 0, False: 1]
  ------------------
 1057|      0|    return dst;
 1058|      0|  }
 1059|       |
 1060|      1|  return memset(dst, c, n);
 1061|      1|}
bcm.c:OPENSSL_memmove:
 1047|  3.98k|static inline void *OPENSSL_memmove(void *dst, const void *src, size_t n) {
 1048|  3.98k|  if (n == 0) {
  ------------------
  |  Branch (1048:7): [True: 0, False: 3.98k]
  ------------------
 1049|      0|    return dst;
 1050|      0|  }
 1051|       |
 1052|  3.98k|  return memmove(dst, src, n);
 1053|  3.98k|}
bcm.c:OPENSSL_memcpy:
 1039|  2.18M|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) {
 1040|  2.18M|  if (n == 0) {
  ------------------
  |  Branch (1040:7): [True: 38.8k, False: 2.14M]
  ------------------
 1041|  38.8k|    return dst;
 1042|  38.8k|  }
 1043|       |
 1044|  2.14M|  return memcpy(dst, src, n);
 1045|  2.18M|}
bcm.c:constant_time_eq_int:
  462|   143k|static inline crypto_word_t constant_time_eq_int(int a, int b) {
  463|   143k|  return constant_time_eq_w((crypto_word_t)(a), (crypto_word_t)(b));
  464|   143k|}
bcm.c:constant_time_is_zero_w:
  427|  1.51M|static inline crypto_word_t constant_time_is_zero_w(crypto_word_t a) {
  428|       |  // Here is an SMT-LIB verification of this formula:
  429|       |  //
  430|       |  // (define-fun is_zero ((a (_ BitVec 32))) (_ BitVec 32)
  431|       |  //   (bvand (bvnot a) (bvsub a #x00000001))
  432|       |  // )
  433|       |  //
  434|       |  // (declare-fun a () (_ BitVec 32))
  435|       |  //
  436|       |  // (assert (not (= (= #x00000001 (bvlshr (is_zero a) #x0000001f)) (= a #x00000000))))
  437|       |  // (check-sat)
  438|       |  // (get-model)
  439|  1.51M|  return constant_time_msb_w(~a & (a - 1));
  440|  1.51M|}
bcm.c:constant_time_msb_w:
  368|  1.84M|static inline crypto_word_t constant_time_msb_w(crypto_word_t a) {
  369|  1.84M|  return 0u - (a >> (sizeof(a) * 8 - 1));
  370|  1.84M|}
bcm.c:constant_time_eq_w:
  450|  1.37M|                                               crypto_word_t b) {
  451|  1.37M|  return constant_time_is_zero_w(a ^ b);
  452|  1.37M|}
bcm.c:constant_time_select_w:
  477|   112M|                                                   crypto_word_t b) {
  478|       |  // Clang recognizes this pattern as a select. While it usually transforms it
  479|       |  // to a cmov, it sometimes further transforms it into a branch, which we do
  480|       |  // not want.
  481|       |  //
  482|       |  // Hiding the value of the mask from the compiler evades this transformation.
  483|   112M|  mask = value_barrier_w(mask);
  484|   112M|  return (mask & a) | (~mask & b);
  485|   112M|}
bcm.c:value_barrier_w:
  340|   112M|static inline crypto_word_t value_barrier_w(crypto_word_t a) {
  341|   112M|#if defined(__GNUC__) || defined(__clang__)
  342|   112M|  __asm__("" : "+r"(a) : /* no inputs */);
  343|   112M|#endif
  344|   112M|  return a;
  345|   112M|}
bcm.c:OPENSSL_memset:
 1055|  1.77M|static inline void *OPENSSL_memset(void *dst, int c, size_t n) {
 1056|  1.77M|  if (n == 0) {
  ------------------
  |  Branch (1056:7): [True: 572k, False: 1.20M]
  ------------------
 1057|   572k|    return dst;
 1058|   572k|  }
 1059|       |
 1060|  1.20M|  return memset(dst, c, n);
 1061|  1.77M|}
bcm.c:CRYPTO_load_word_be:
 1122|  2.09M|static inline crypto_word_t CRYPTO_load_word_be(const void *in) {
 1123|  2.09M|  crypto_word_t v;
 1124|  2.09M|  OPENSSL_memcpy(&v, in, sizeof(v));
 1125|  2.09M|#if defined(OPENSSL_64_BIT)
 1126|  2.09M|  static_assert(sizeof(v) == 8, "crypto_word_t has unexpected size");
 1127|  2.09M|  return CRYPTO_bswap8(v);
 1128|       |#else
 1129|       |  static_assert(sizeof(v) == 4, "crypto_word_t has unexpected size");
 1130|       |  return CRYPTO_bswap4(v);
 1131|       |#endif
 1132|  2.09M|}
bcm.c:CRYPTO_bswap8:
  949|  2.09M|static inline uint64_t CRYPTO_bswap8(uint64_t x) {
  950|  2.09M|  return __builtin_bswap64(x);
  951|  2.09M|}
bcm.c:constant_time_select_int:
  503|   674k|static inline int constant_time_select_int(crypto_word_t mask, int a, int b) {
  504|   674k|  return (int)(constant_time_select_w(mask, (crypto_word_t)(a),
  505|   674k|                                      (crypto_word_t)(b)));
  506|   674k|}
bcm.c:constant_time_declassify_int:
  572|  1.65k|static inline int constant_time_declassify_int(int v) {
  573|  1.65k|  static_assert(sizeof(uint32_t) == sizeof(int),
  574|  1.65k|                "int is not the same size as uint32_t");
  575|       |  // See comment above.
  576|  1.65k|  CONSTTIME_DECLASSIFY(&v, sizeof(v));
  577|  1.65k|  return value_barrier_u32(v);
  578|  1.65k|}
bcm.c:value_barrier_u32:
  348|  1.65k|static inline uint32_t value_barrier_u32(uint32_t a) {
  349|  1.65k|#if defined(__GNUC__) || defined(__clang__)
  350|  1.65k|  __asm__("" : "+r"(a) : /* no inputs */);
  351|  1.65k|#endif
  352|  1.65k|  return a;
  353|  1.65k|}
bcm.c:align_pointer:
  282|     56|static inline void *align_pointer(void *ptr, size_t alignment) {
  283|       |  // |alignment| must be a power of two.
  284|     56|  assert(alignment != 0 && (alignment & (alignment - 1)) == 0);
  285|       |  // Instead of aligning |ptr| as a |uintptr_t| and casting back, compute the
  286|       |  // offset and advance in pointer space. C guarantees that casting from pointer
  287|       |  // to |uintptr_t| and back gives the same pointer, but general
  288|       |  // integer-to-pointer conversions are implementation-defined. GCC does define
  289|       |  // it in the useful way, but this makes fewer assumptions.
  290|     56|  uintptr_t offset = (0u - (uintptr_t)ptr) & (alignment - 1);
  291|     56|  ptr = (char *)ptr + offset;
  292|     56|  assert(((uintptr_t)ptr & (alignment - 1)) == 0);
  293|     56|  return ptr;
  294|     56|}
bcm.c:constant_time_lt_w:
  374|   334k|                                               crypto_word_t b) {
  375|       |  // Consider the two cases of the problem:
  376|       |  //   msb(a) == msb(b): a < b iff the MSB of a - b is set.
  377|       |  //   msb(a) != msb(b): a < b iff the MSB of b is set.
  378|       |  //
  379|       |  // If msb(a) == msb(b) then the following evaluates as:
  380|       |  //   msb(a^((a^b)|((a-b)^a))) ==
  381|       |  //   msb(a^((a-b) ^ a))       ==   (because msb(a^b) == 0)
  382|       |  //   msb(a^a^(a-b))           ==   (rearranging)
  383|       |  //   msb(a-b)                      (because ∀x. x^x == 0)
  384|       |  //
  385|       |  // Else, if msb(a) != msb(b) then the following evaluates as:
  386|       |  //   msb(a^((a^b)|((a-b)^a))) ==
  387|       |  //   msb(a^(𝟙 | ((a-b)^a)))   ==   (because msb(a^b) == 1 and 𝟙
  388|       |  //                                  represents a value s.t. msb(𝟙) = 1)
  389|       |  //   msb(a^𝟙)                 ==   (because ORing with 1 results in 1)
  390|       |  //   msb(b)
  391|       |  //
  392|       |  //
  393|       |  // Here is an SMT-LIB verification of this formula:
  394|       |  //
  395|       |  // (define-fun lt ((a (_ BitVec 32)) (b (_ BitVec 32))) (_ BitVec 32)
  396|       |  //   (bvxor a (bvor (bvxor a b) (bvxor (bvsub a b) a)))
  397|       |  // )
  398|       |  //
  399|       |  // (declare-fun a () (_ BitVec 32))
  400|       |  // (declare-fun b () (_ BitVec 32))
  401|       |  //
  402|       |  // (assert (not (= (= #x00000001 (bvlshr (lt a b) #x0000001f)) (bvult a b))))
  403|       |  // (check-sat)
  404|       |  // (get-model)
  405|   334k|  return constant_time_msb_w(a^((a^b)|((a-b)^a)));
  406|   334k|}
bcm.c:constant_time_declassify_w:
  556|  43.2k|static inline crypto_word_t constant_time_declassify_w(crypto_word_t v) {
  557|       |  // Return |v| through a value barrier to be safe. Valgrind-based constant-time
  558|       |  // validation is partly to check the compiler has not undone any constant-time
  559|       |  // work. Any place |BORINGSSL_CONSTANT_TIME_VALIDATION| influences
  560|       |  // optimizations, this validation is inaccurate.
  561|       |  //
  562|       |  // However, by sending pointers through valgrind, we likely inhibit escape
  563|       |  // analysis. On local variables, particularly booleans, we likely
  564|       |  // significantly impact optimizations.
  565|       |  //
  566|       |  // Thus, to be safe, stick a value barrier, in hopes of comparably inhibiting
  567|       |  // compiler analysis.
  568|  43.2k|  CONSTTIME_DECLASSIFY(&v, sizeof(v));
  569|  43.2k|  return value_barrier_w(v);
  570|  43.2k|}
bcm.c:CRYPTO_store_u64_be:
 1107|    510|static inline void CRYPTO_store_u64_be(void *out, uint64_t v) {
 1108|    510|  v = CRYPTO_bswap8(v);
 1109|    510|  OPENSSL_memcpy(out, &v, sizeof(v));
 1110|    510|}
curve25519.c:OPENSSL_memmove:
 1047|     51|static inline void *OPENSSL_memmove(void *dst, const void *src, size_t n) {
 1048|     51|  if (n == 0) {
  ------------------
  |  Branch (1048:7): [True: 0, False: 51]
  ------------------
 1049|      0|    return dst;
 1050|      0|  }
 1051|       |
 1052|     51|  return memmove(dst, src, n);
 1053|     51|}
curve25519.c:CRYPTO_is_BMI1_capable:
 1352|    136|OPENSSL_INLINE int CRYPTO_is_BMI1_capable(void) {
 1353|       |#if defined(__BMI1__)
 1354|       |  return 1;
 1355|       |#else
 1356|    136|  return (OPENSSL_ia32cap_get()[2] & (1 << 3)) != 0;
 1357|    136|#endif
 1358|    136|}
curve25519.c:OPENSSL_ia32cap_get:
 1270|    408|OPENSSL_INLINE const uint32_t *OPENSSL_ia32cap_get(void) {
 1271|    408|  return OPENSSL_ia32cap_P;
 1272|    408|}
curve25519.c:CRYPTO_is_BMI2_capable:
 1368|    136|OPENSSL_INLINE int CRYPTO_is_BMI2_capable(void) {
 1369|       |#if defined(__BMI2__)
 1370|       |  return 1;
 1371|       |#else
 1372|    136|  return (OPENSSL_ia32cap_get()[2] & (1 << 8)) != 0;
 1373|    136|#endif
 1374|    136|}
curve25519.c:CRYPTO_is_ADX_capable:
 1376|    136|OPENSSL_INLINE int CRYPTO_is_ADX_capable(void) {
 1377|       |#if defined(__ADX__)
 1378|       |  return 1;
 1379|       |#else
 1380|    136|  return (OPENSSL_ia32cap_get()[2] & (1 << 19)) != 0;
 1381|    136|#endif
 1382|    136|}
curve25519.c:OPENSSL_memcpy:
 1039|    187|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) {
 1040|    187|  if (n == 0) {
  ------------------
  |  Branch (1040:7): [True: 0, False: 187]
  ------------------
 1041|      0|    return dst;
 1042|      0|  }
 1043|       |
 1044|    187|  return memcpy(dst, src, n);
 1045|    187|}
curve25519_64_adx.c:OPENSSL_memcpy:
 1039|  8.84k|static inline void *OPENSSL_memcpy(void *dst, const void *src, size_t n) {
 1040|  8.84k|  if (n == 0) {
  ------------------
  |  Branch (1040:7): [True: 0, False: 8.84k]
  ------------------
 1041|      0|    return dst;
 1042|      0|  }
 1043|       |
 1044|  8.84k|  return memcpy(dst, src, n);
 1045|  8.84k|}
curve25519_64_adx.c:constant_time_msb_w:
  368|  95.7k|static inline crypto_word_t constant_time_msb_w(crypto_word_t a) {
  369|  95.7k|  return 0u - (a >> (sizeof(a) * 8 - 1));
  370|  95.7k|}
curve25519_64_adx.c:constant_time_is_zero_w:
  427|  87.0k|static inline crypto_word_t constant_time_is_zero_w(crypto_word_t a) {
  428|       |  // Here is an SMT-LIB verification of this formula:
  429|       |  //
  430|       |  // (define-fun is_zero ((a (_ BitVec 32))) (_ BitVec 32)
  431|       |  //   (bvand (bvnot a) (bvsub a #x00000001))
  432|       |  // )
  433|       |  //
  434|       |  // (declare-fun a () (_ BitVec 32))
  435|       |  //
  436|       |  // (assert (not (= (= #x00000001 (bvlshr (is_zero a) #x0000001f)) (= a #x00000000))))
  437|       |  // (check-sat)
  438|       |  // (get-model)
  439|  87.0k|  return constant_time_msb_w(~a & (a - 1));
  440|  87.0k|}
curve25519_64_adx.c:constant_time_conditional_memxor:
  527|  69.6k|                                                    const crypto_word_t mask) {
  528|  69.6k|  assert(!buffers_alias(dst, n, src, n));
  529|  69.6k|  uint8_t *out = (uint8_t *)dst;
  530|  69.6k|  const uint8_t *in = (const uint8_t *)src;
  531|  6.75M|  for (size_t i = 0; i < n; i++) {
  ------------------
  |  Branch (531:22): [True: 6.68M, False: 69.6k]
  ------------------
  532|  6.68M|    out[i] ^= value_barrier_w(mask) & in[i];
  533|  6.68M|  }
  534|  69.6k|}
curve25519_64_adx.c:buffers_alias:
  269|  95.7k|                                const void *b, size_t b_bytes) {
  270|       |  // Cast |a| and |b| to integers. In C, pointer comparisons between unrelated
  271|       |  // objects are undefined whereas pointer to integer conversions are merely
  272|       |  // implementation-defined. We assume the implementation defined it in a sane
  273|       |  // way.
  274|  95.7k|  uintptr_t a_u = (uintptr_t)a;
  275|  95.7k|  uintptr_t b_u = (uintptr_t)b;
  276|  95.7k|  return a_u + a_bytes > b_u && b_u + b_bytes > a_u;
  ------------------
  |  Branch (276:10): [True: 69.6k, False: 26.1k]
  |  Branch (276:33): [True: 0, False: 69.6k]
  ------------------
  277|  95.7k|}
curve25519_64_adx.c:value_barrier_w:
  340|  7.52M|static inline crypto_word_t value_barrier_w(crypto_word_t a) {
  341|  7.52M|#if defined(__GNUC__) || defined(__clang__)
  342|  7.52M|  __asm__("" : "+r"(a) : /* no inputs */);
  343|  7.52M|#endif
  344|  7.52M|  return a;
  345|  7.52M|}
curve25519_64_adx.c:constant_time_eq_w:
  450|  69.6k|                                               crypto_word_t b) {
  451|  69.6k|  return constant_time_is_zero_w(a ^ b);
  452|  69.6k|}
curve25519_64_adx.c:constant_time_conditional_memcpy:
  513|  26.1k|                                                    const crypto_word_t mask) {
  514|  26.1k|  assert(!buffers_alias(dst, n, src, n));
  515|  26.1k|  uint8_t *out = (uint8_t *)dst;
  516|  26.1k|  const uint8_t *in = (const uint8_t *)src;
  517|   861k|  for (size_t i = 0; i < n; i++) {
  ------------------
  |  Branch (517:22): [True: 835k, False: 26.1k]
  ------------------
  518|   835k|    out[i] = constant_time_select_8(mask, in[i], out[i]);
  519|   835k|  }
  520|  26.1k|}
curve25519_64_adx.c:constant_time_select_8:
  490|   835k|                                             uint8_t b) {
  491|       |  // |mask| is a word instead of |uint8_t| to avoid materializing 0x000..0MM
  492|       |  // Making both |mask| and its value barrier |uint8_t| would allow the compiler
  493|       |  // to materialize 0x????..?MM instead, but only clang is that clever.
  494|       |  // However, vectorization of bitwise operations seems to work better on
  495|       |  // |uint8_t| than a mix of |uint64_t| and |uint8_t|, so |m| is cast to
  496|       |  // |uint8_t| after the value barrier but before the bitwise operations.
  497|   835k|  uint8_t m = value_barrier_w(mask);
  498|   835k|  return (m & a) | (~m & b);
  499|   835k|}
dsa.c:OPENSSL_memset:
 1055|  1.34k|static inline void *OPENSSL_memset(void *dst, int c, size_t n) {
 1056|  1.34k|  if (n == 0) {
  ------------------
  |  Branch (1056:7): [True: 0, False: 1.34k]
  ------------------
 1057|      0|    return dst;
 1058|      0|  }
 1059|       |
 1060|  1.34k|  return memset(dst, c, n);
 1061|  1.34k|}
ec_asn1.c:OPENSSL_memcmp:
 1031|  3.40k|static inline int OPENSSL_memcmp(const void *s1, const void *s2, size_t n) {
 1032|  3.40k|  if (n == 0) {
  ------------------
  |  Branch (1032:7): [True: 0, False: 3.40k]
  ------------------
 1033|      0|    return 0;
 1034|      0|  }
 1035|       |
 1036|  3.40k|  return memcmp(s1, s2, n);
 1037|  3.40k|}
stack.c:OPENSSL_memset:
 1055|  3.05k|static inline void *OPENSSL_memset(void *dst, int c, size_t n) {
 1056|  3.05k|  if (n == 0) {
  ------------------
  |  Branch (1056:7): [True: 0, False: 3.05k]
  ------------------
 1057|      0|    return dst;
 1058|      0|  }
 1059|       |
 1060|  3.05k|  return memset(dst, c, n);
 1061|  3.05k|}

OPENSSL_malloc:
  228|   102k|void *OPENSSL_malloc(size_t size) {
  229|   102k|  if (should_fail_allocation()) {
  ------------------
  |  Branch (229:7): [True: 0, False: 102k]
  ------------------
  230|      0|    goto err;
  231|      0|  }
  232|       |
  233|   102k|  if (OPENSSL_memory_alloc != NULL) {
  ------------------
  |  Branch (233:7): [True: 0, False: 102k]
  ------------------
  234|      0|    assert(OPENSSL_memory_free != NULL);
  235|      0|    assert(OPENSSL_memory_get_size != NULL);
  236|      0|    void *ptr = OPENSSL_memory_alloc(size);
  237|      0|    if (ptr == NULL && size != 0) {
  ------------------
  |  Branch (237:9): [True: 0, False: 0]
  |  Branch (237:24): [True: 0, False: 0]
  ------------------
  238|      0|      goto err;
  239|      0|    }
  240|      0|    return ptr;
  241|      0|  }
  242|       |
  243|   102k|  if (size + OPENSSL_MALLOC_PREFIX < size) {
  ------------------
  |  |   83|   102k|#define OPENSSL_MALLOC_PREFIX 8
  ------------------
  |  Branch (243:7): [True: 0, False: 102k]
  ------------------
  244|       |    // |OPENSSL_malloc| is a central function in BoringSSL thus a reference to
  245|       |    // |kBoringSSLBinaryTag| is created here so that the tag isn't discarded by
  246|       |    // the linker. The following is sufficient to stop GCC, Clang, and MSVC
  247|       |    // optimising away the reference at the time of writing. Since this
  248|       |    // probably results in an actual memory reference, it is put in this very
  249|       |    // rare code path.
  250|      0|    uint8_t unused = *(volatile uint8_t *)kBoringSSLBinaryTag;
  251|      0|    (void) unused;
  252|      0|    goto err;
  253|      0|  }
  254|       |
  255|   102k|  void *ptr = malloc(size + OPENSSL_MALLOC_PREFIX);
  ------------------
  |  |   83|   102k|#define OPENSSL_MALLOC_PREFIX 8
  ------------------
  256|   102k|  if (ptr == NULL) {
  ------------------
  |  Branch (256:7): [True: 0, False: 102k]
  ------------------
  257|      0|    goto err;
  258|      0|  }
  259|       |
  260|   102k|  *(size_t *)ptr = size;
  261|       |
  262|   102k|  __asan_poison_memory_region(ptr, OPENSSL_MALLOC_PREFIX);
  ------------------
  |  |   83|   102k|#define OPENSSL_MALLOC_PREFIX 8
  ------------------
  263|   102k|  return ((uint8_t *)ptr) + OPENSSL_MALLOC_PREFIX;
  ------------------
  |  |   83|   102k|#define OPENSSL_MALLOC_PREFIX 8
  ------------------
  264|       |
  265|      0| err:
  266|       |  // This only works because ERR does not call OPENSSL_malloc.
  267|      0|  OPENSSL_PUT_ERROR(CRYPTO, ERR_R_MALLOC_FAILURE);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  268|      0|  return NULL;
  269|   102k|}
OPENSSL_free:
  271|   142k|void OPENSSL_free(void *orig_ptr) {
  272|   142k|  if (orig_ptr == NULL) {
  ------------------
  |  Branch (272:7): [True: 40.2k, False: 102k]
  ------------------
  273|  40.2k|    return;
  274|  40.2k|  }
  275|       |
  276|   102k|  if (OPENSSL_memory_free != NULL) {
  ------------------
  |  Branch (276:7): [True: 0, False: 102k]
  ------------------
  277|      0|    OPENSSL_memory_free(orig_ptr);
  278|      0|    return;
  279|      0|  }
  280|       |
  281|   102k|  void *ptr = ((uint8_t *)orig_ptr) - OPENSSL_MALLOC_PREFIX;
  ------------------
  |  |   83|   102k|#define OPENSSL_MALLOC_PREFIX 8
  ------------------
  282|   102k|  __asan_unpoison_memory_region(ptr, OPENSSL_MALLOC_PREFIX);
  ------------------
  |  |   83|   102k|#define OPENSSL_MALLOC_PREFIX 8
  ------------------
  283|       |
  284|   102k|  size_t size = *(size_t *)ptr;
  285|   102k|  OPENSSL_cleanse(ptr, size + OPENSSL_MALLOC_PREFIX);
  ------------------
  |  |   83|   102k|#define OPENSSL_MALLOC_PREFIX 8
  ------------------
  286|       |
  287|       |// ASan knows to intercept malloc and free, but not sdallocx.
  288|       |#if defined(OPENSSL_ASAN)
  289|       |  (void)sdallocx;
  290|       |  free(ptr);
  291|       |#else
  292|   102k|  if (sdallocx) {
  ------------------
  |  Branch (292:7): [True: 0, False: 102k]
  ------------------
  293|      0|    sdallocx(ptr, size + OPENSSL_MALLOC_PREFIX, 0 /* flags */);
  ------------------
  |  |   83|      0|#define OPENSSL_MALLOC_PREFIX 8
  ------------------
  294|   102k|  } else {
  295|   102k|    free(ptr);
  296|   102k|  }
  297|   102k|#endif
  298|   102k|}
OPENSSL_realloc:
  300|  11.4k|void *OPENSSL_realloc(void *orig_ptr, size_t new_size) {
  301|  11.4k|  if (orig_ptr == NULL) {
  ------------------
  |  Branch (301:7): [True: 1.60k, False: 9.85k]
  ------------------
  302|  1.60k|    return OPENSSL_malloc(new_size);
  303|  1.60k|  }
  304|       |
  305|  9.85k|  size_t old_size;
  306|  9.85k|  if (OPENSSL_memory_get_size != NULL) {
  ------------------
  |  Branch (306:7): [True: 0, False: 9.85k]
  ------------------
  307|      0|    old_size = OPENSSL_memory_get_size(orig_ptr);
  308|  9.85k|  } else {
  309|  9.85k|    void *ptr = ((uint8_t *)orig_ptr) - OPENSSL_MALLOC_PREFIX;
  ------------------
  |  |   83|  9.85k|#define OPENSSL_MALLOC_PREFIX 8
  ------------------
  310|  9.85k|    __asan_unpoison_memory_region(ptr, OPENSSL_MALLOC_PREFIX);
  ------------------
  |  |   83|  9.85k|#define OPENSSL_MALLOC_PREFIX 8
  ------------------
  311|  9.85k|    old_size = *(size_t *)ptr;
  312|  9.85k|    __asan_poison_memory_region(ptr, OPENSSL_MALLOC_PREFIX);
  ------------------
  |  |   83|  9.85k|#define OPENSSL_MALLOC_PREFIX 8
  ------------------
  313|  9.85k|  }
  314|       |
  315|  9.85k|  void *ret = OPENSSL_malloc(new_size);
  316|  9.85k|  if (ret == NULL) {
  ------------------
  |  Branch (316:7): [True: 0, False: 9.85k]
  ------------------
  317|      0|    return NULL;
  318|      0|  }
  319|       |
  320|  9.85k|  size_t to_copy = new_size;
  321|  9.85k|  if (old_size < to_copy) {
  ------------------
  |  Branch (321:7): [True: 9.85k, False: 0]
  ------------------
  322|  9.85k|    to_copy = old_size;
  323|  9.85k|  }
  324|       |
  325|  9.85k|  memcpy(ret, orig_ptr, to_copy);
  326|  9.85k|  OPENSSL_free(orig_ptr);
  327|       |
  328|  9.85k|  return ret;
  329|  9.85k|}
OPENSSL_cleanse:
  331|   104k|void OPENSSL_cleanse(void *ptr, size_t len) {
  332|       |#if defined(OPENSSL_WINDOWS)
  333|       |  SecureZeroMemory(ptr, len);
  334|       |#else
  335|   104k|  OPENSSL_memset(ptr, 0, len);
  336|       |
  337|   104k|#if !defined(OPENSSL_NO_ASM)
  338|       |  /* As best as we can tell, this is sufficient to break any optimisations that
  339|       |     might try to eliminate "superfluous" memsets. If there's an easy way to
  340|       |     detect memset_s, it would be better to use that. */
  341|   104k|  __asm__ __volatile__("" : : "r"(ptr) : "memory");
  342|   104k|#endif
  343|   104k|#endif  // !OPENSSL_NO_ASM
  344|   104k|}
CRYPTO_memcmp:
  360|    593|int CRYPTO_memcmp(const void *in_a, const void *in_b, size_t len) {
  361|    593|  const uint8_t *a = in_a;
  362|    593|  const uint8_t *b = in_b;
  363|    593|  uint8_t x = 0;
  364|       |
  365|  24.4k|  for (size_t i = 0; i < len; i++) {
  ------------------
  |  Branch (365:22): [True: 23.8k, False: 593]
  ------------------
  366|  23.8k|    x |= a[i] ^ b[i];
  367|  23.8k|  }
  368|       |
  369|    593|  return x;
  370|    593|}
mem.c:should_fail_allocation:
  225|   102k|static int should_fail_allocation(void) { return 0; }
mem.c:__asan_poison_memory_region:
   90|   112k|static void __asan_poison_memory_region(const void *addr, size_t size) {}
mem.c:__asan_unpoison_memory_region:
   91|   112k|static void __asan_unpoison_memory_region(const void *addr, size_t size) {}

CRYPTO_refcount_inc:
   31|      4|void CRYPTO_refcount_inc(CRYPTO_refcount_t *in_count) {
   32|      4|  CRYPTO_atomic_u32 *count = (CRYPTO_atomic_u32 *)in_count;
   33|      4|  uint32_t expected = CRYPTO_atomic_load_u32(count);
   34|       |
   35|      4|  while (expected != CRYPTO_REFCOUNT_MAX) {
  ------------------
  |  |  718|      4|#define CRYPTO_REFCOUNT_MAX 0xffffffff
  ------------------
  |  Branch (35:10): [True: 4, False: 0]
  ------------------
   36|      4|    uint32_t new_value = expected + 1;
   37|      4|    if (CRYPTO_atomic_compare_exchange_weak_u32(count, &expected, new_value)) {
  ------------------
  |  Branch (37:9): [True: 4, False: 0]
  ------------------
   38|      4|      break;
   39|      4|    }
   40|      4|  }
   41|      4|}
CRYPTO_refcount_dec_and_test_zero:
   43|  7.56k|int CRYPTO_refcount_dec_and_test_zero(CRYPTO_refcount_t *in_count) {
   44|  7.56k|  CRYPTO_atomic_u32 *count = (CRYPTO_atomic_u32 *)in_count;
   45|  7.56k|  uint32_t expected = CRYPTO_atomic_load_u32(count);
   46|       |
   47|  7.56k|  for (;;) {
   48|  7.56k|    if (expected == 0) {
  ------------------
  |  Branch (48:9): [True: 0, False: 7.56k]
  ------------------
   49|      0|      abort();
   50|  7.56k|    } else if (expected == CRYPTO_REFCOUNT_MAX) {
  ------------------
  |  |  718|  7.56k|#define CRYPTO_REFCOUNT_MAX 0xffffffff
  ------------------
  |  Branch (50:16): [True: 0, False: 7.56k]
  ------------------
   51|      0|      return 0;
   52|  7.56k|    } else {
   53|  7.56k|      const uint32_t new_value = expected - 1;
   54|  7.56k|      if (CRYPTO_atomic_compare_exchange_weak_u32(count, &expected,
  ------------------
  |  Branch (54:11): [True: 7.56k, False: 0]
  ------------------
   55|  7.56k|                                                  new_value)) {
   56|  7.56k|        return new_value == 0;
   57|  7.56k|      }
   58|  7.56k|    }
   59|  7.56k|  }
   60|  7.56k|}

RSA_parse_private_key:
  156|    603|RSA *RSA_parse_private_key(CBS *cbs) {
  157|    603|  RSA *ret = RSA_new();
  158|    603|  if (ret == NULL) {
  ------------------
  |  Branch (158:7): [True: 0, False: 603]
  ------------------
  159|      0|    return NULL;
  160|      0|  }
  161|       |
  162|    603|  CBS child;
  163|    603|  uint64_t version;
  164|    603|  if (!CBS_get_asn1(cbs, &child, CBS_ASN1_SEQUENCE) ||
  ------------------
  |  |  222|    603|#define CBS_ASN1_SEQUENCE (0x10u | CBS_ASN1_CONSTRUCTED)
  |  |  ------------------
  |  |  |  |  196|    603|#define CBS_ASN1_CONSTRUCTED (0x20u << CBS_ASN1_TAG_SHIFT)
  |  |  |  |  ------------------
  |  |  |  |  |  |  193|    603|#define CBS_ASN1_TAG_SHIFT 24
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (164:7): [True: 1, False: 602]
  ------------------
  165|    603|      !CBS_get_asn1_uint64(&child, &version)) {
  ------------------
  |  Branch (165:7): [True: 1, False: 601]
  ------------------
  166|      2|    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_ENCODING);
  ------------------
  |  |  441|      2|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  167|      2|    goto err;
  168|      2|  }
  169|       |
  170|    601|  if (version != kVersionTwoPrime) {
  ------------------
  |  Branch (170:7): [True: 107, False: 494]
  ------------------
  171|    107|    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_VERSION);
  ------------------
  |  |  441|    107|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  172|    107|    goto err;
  173|    107|  }
  174|       |
  175|    494|  if (!parse_integer(&child, &ret->n) ||
  ------------------
  |  Branch (175:7): [True: 1, False: 493]
  ------------------
  176|    494|      !parse_integer(&child, &ret->e) ||
  ------------------
  |  Branch (176:7): [True: 1, False: 492]
  ------------------
  177|    494|      !parse_integer(&child, &ret->d) ||
  ------------------
  |  Branch (177:7): [True: 1, False: 491]
  ------------------
  178|    494|      !parse_integer(&child, &ret->p) ||
  ------------------
  |  Branch (178:7): [True: 1, False: 490]
  ------------------
  179|    494|      !parse_integer(&child, &ret->q) ||
  ------------------
  |  Branch (179:7): [True: 5, False: 485]
  ------------------
  180|    494|      !parse_integer(&child, &ret->dmp1) ||
  ------------------
  |  Branch (180:7): [True: 1, False: 484]
  ------------------
  181|    494|      !parse_integer(&child, &ret->dmq1) ||
  ------------------
  |  Branch (181:7): [True: 2, False: 482]
  ------------------
  182|    494|      !parse_integer(&child, &ret->iqmp)) {
  ------------------
  |  Branch (182:7): [True: 2, False: 480]
  ------------------
  183|     14|    goto err;
  184|     14|  }
  185|       |
  186|    480|  if (CBS_len(&child) != 0) {
  ------------------
  |  Branch (186:7): [True: 22, False: 458]
  ------------------
  187|     22|    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_ENCODING);
  ------------------
  |  |  441|     22|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  188|     22|    goto err;
  189|     22|  }
  190|       |
  191|    458|  if (!RSA_check_key(ret)) {
  ------------------
  |  Branch (191:7): [True: 458, False: 0]
  ------------------
  192|    458|    OPENSSL_PUT_ERROR(RSA, RSA_R_BAD_RSA_PARAMETERS);
  ------------------
  |  |  441|    458|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  193|    458|    goto err;
  194|    458|  }
  195|       |
  196|      0|  return ret;
  197|       |
  198|    603|err:
  199|    603|  RSA_free(ret);
  200|    603|  return NULL;
  201|    458|}
rsa_asn1.c:parse_integer:
   72|  3.91k|static int parse_integer(CBS *cbs, BIGNUM **out) {
   73|  3.91k|  assert(*out == NULL);
   74|  3.91k|  *out = BN_new();
   75|  3.91k|  if (*out == NULL) {
  ------------------
  |  Branch (75:7): [True: 0, False: 3.91k]
  ------------------
   76|      0|    return 0;
   77|      0|  }
   78|  3.91k|  return BN_parse_asn1_unsigned(cbs, *out);
   79|  3.91k|}

sk_new:
   72|  1.52k|_STACK *sk_new(OPENSSL_sk_cmp_func comp) {
   73|  1.52k|  _STACK *ret = OPENSSL_malloc(sizeof(_STACK));
   74|  1.52k|  if (ret == NULL) {
  ------------------
  |  Branch (74:7): [True: 0, False: 1.52k]
  ------------------
   75|      0|    return NULL;
   76|      0|  }
   77|  1.52k|  OPENSSL_memset(ret, 0, sizeof(_STACK));
   78|       |
   79|  1.52k|  ret->data = OPENSSL_malloc(sizeof(void *) * kMinSize);
   80|  1.52k|  if (ret->data == NULL) {
  ------------------
  |  Branch (80:7): [True: 0, False: 1.52k]
  ------------------
   81|      0|    goto err;
   82|      0|  }
   83|       |
   84|  1.52k|  OPENSSL_memset(ret->data, 0, sizeof(void *) * kMinSize);
   85|       |
   86|  1.52k|  ret->comp = comp;
   87|  1.52k|  ret->num_alloc = kMinSize;
   88|       |
   89|  1.52k|  return ret;
   90|       |
   91|      0|err:
   92|      0|  OPENSSL_free(ret);
   93|      0|  return NULL;
   94|  1.52k|}
sk_new_null:
   96|  1.52k|_STACK *sk_new_null(void) { return sk_new(NULL); }
sk_num:
   98|  4.49M|size_t sk_num(const _STACK *sk) {
   99|  4.49M|  if (sk == NULL) {
  ------------------
  |  Branch (99:7): [True: 0, False: 4.49M]
  ------------------
  100|      0|    return 0;
  101|      0|  }
  102|  4.49M|  return sk->num;
  103|  4.49M|}
sk_value:
  114|  4.49M|void *sk_value(const _STACK *sk, size_t i) {
  115|  4.49M|  if (!sk || i >= sk->num) {
  ------------------
  |  Branch (115:7): [True: 0, False: 4.49M]
  |  Branch (115:14): [True: 0, False: 4.49M]
  ------------------
  116|      0|    return NULL;
  117|      0|  }
  118|  4.49M|  return sk->data[i];
  119|  4.49M|}
sk_free:
  128|  1.52k|void sk_free(_STACK *sk) {
  129|  1.52k|  if (sk == NULL) {
  ------------------
  |  Branch (129:7): [True: 0, False: 1.52k]
  ------------------
  130|      0|    return;
  131|      0|  }
  132|  1.52k|  OPENSSL_free(sk->data);
  133|  1.52k|  OPENSSL_free(sk);
  134|  1.52k|}
sk_pop_free_ex:
  137|  1.60k|                    OPENSSL_sk_free_func free_func) {
  138|  1.60k|  if (sk == NULL) {
  ------------------
  |  Branch (138:7): [True: 84, False: 1.52k]
  ------------------
  139|     84|    return;
  140|     84|  }
  141|       |
  142|  21.5k|  for (size_t i = 0; i < sk->num; i++) {
  ------------------
  |  Branch (142:22): [True: 20.0k, False: 1.52k]
  ------------------
  143|  20.0k|    if (sk->data[i] != NULL) {
  ------------------
  |  Branch (143:9): [True: 20.0k, False: 0]
  ------------------
  144|  20.0k|      call_free_func(free_func, sk->data[i]);
  145|  20.0k|    }
  146|  20.0k|  }
  147|  1.52k|  sk_free(sk);
  148|  1.52k|}
sk_insert:
  161|  20.0k|size_t sk_insert(_STACK *sk, void *p, size_t where) {
  162|  20.0k|  if (sk == NULL) {
  ------------------
  |  Branch (162:7): [True: 0, False: 20.0k]
  ------------------
  163|      0|    return 0;
  164|      0|  }
  165|       |
  166|  20.0k|  if (sk->num >= INT_MAX) {
  ------------------
  |  Branch (166:7): [True: 0, False: 20.0k]
  ------------------
  167|      0|    OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW);
  ------------------
  |  |  441|      0|  ERR_put_error(ERR_LIB_##library, 0, reason, __FILE__, __LINE__)
  ------------------
  168|      0|    return 0;
  169|      0|  }
  170|       |
  171|  20.0k|  if (sk->num_alloc <= sk->num + 1) {
  ------------------
  |  Branch (171:7): [True: 2.05k, False: 18.0k]
  ------------------
  172|       |    // Attempt to double the size of the array.
  173|  2.05k|    size_t new_alloc = sk->num_alloc << 1;
  174|  2.05k|    size_t alloc_size = new_alloc * sizeof(void *);
  175|  2.05k|    void **data;
  176|       |
  177|       |    // If the doubling overflowed, try to increment.
  178|  2.05k|    if (new_alloc < sk->num_alloc || alloc_size / sizeof(void *) != new_alloc) {
  ------------------
  |  Branch (178:9): [True: 0, False: 2.05k]
  |  Branch (178:38): [True: 0, False: 2.05k]
  ------------------
  179|      0|      new_alloc = sk->num_alloc + 1;
  180|      0|      alloc_size = new_alloc * sizeof(void *);
  181|      0|    }
  182|       |
  183|       |    // If the increment also overflowed, fail.
  184|  2.05k|    if (new_alloc < sk->num_alloc || alloc_size / sizeof(void *) != new_alloc) {
  ------------------
  |  Branch (184:9): [True: 0, False: 2.05k]
  |  Branch (184:38): [True: 0, False: 2.05k]
  ------------------
  185|      0|      return 0;
  186|      0|    }
  187|       |
  188|  2.05k|    data = OPENSSL_realloc(sk->data, alloc_size);
  189|  2.05k|    if (data == NULL) {
  ------------------
  |  Branch (189:9): [True: 0, False: 2.05k]
  ------------------
  190|      0|      return 0;
  191|      0|    }
  192|       |
  193|  2.05k|    sk->data = data;
  194|  2.05k|    sk->num_alloc = new_alloc;
  195|  2.05k|  }
  196|       |
  197|  20.0k|  if (where >= sk->num) {
  ------------------
  |  Branch (197:7): [True: 20.0k, False: 0]
  ------------------
  198|  20.0k|    sk->data[sk->num] = p;
  199|  20.0k|  } else {
  200|      0|    OPENSSL_memmove(&sk->data[where + 1], &sk->data[where],
  201|      0|                    sizeof(void *) * (sk->num - where));
  202|      0|    sk->data[where] = p;
  203|      0|  }
  204|       |
  205|  20.0k|  sk->num++;
  206|  20.0k|  sk->sorted = 0;
  207|       |
  208|  20.0k|  return sk->num;
  209|  20.0k|}
sk_push:
  340|  20.0k|size_t sk_push(_STACK *sk, void *p) { return (sk_insert(sk, p, sk->num)); }

CRYPTO_MUTEX_init:
   31|  1.94k|void CRYPTO_MUTEX_init(CRYPTO_MUTEX *lock) {
   32|  1.94k|  if (pthread_rwlock_init((pthread_rwlock_t *) lock, NULL) != 0) {
  ------------------
  |  Branch (32:7): [True: 0, False: 1.94k]
  ------------------
   33|      0|    abort();
   34|      0|  }
   35|  1.94k|}
CRYPTO_MUTEX_cleanup:
   61|  1.94k|void CRYPTO_MUTEX_cleanup(CRYPTO_MUTEX *lock) {
   62|  1.94k|  pthread_rwlock_destroy((pthread_rwlock_t *) lock);
   63|  1.94k|}
CRYPTO_STATIC_MUTEX_lock_read:
   65|  1.56k|void CRYPTO_STATIC_MUTEX_lock_read(struct CRYPTO_STATIC_MUTEX *lock) {
   66|  1.56k|  if (pthread_rwlock_rdlock(&lock->lock) != 0) {
  ------------------
  |  Branch (66:7): [True: 0, False: 1.56k]
  ------------------
   67|      0|    abort();
   68|      0|  }
   69|  1.56k|}
CRYPTO_STATIC_MUTEX_lock_write:
   71|      4|void CRYPTO_STATIC_MUTEX_lock_write(struct CRYPTO_STATIC_MUTEX *lock) {
   72|      4|  if (pthread_rwlock_wrlock(&lock->lock) != 0) {
  ------------------
  |  Branch (72:7): [True: 0, False: 4]
  ------------------
   73|      0|    abort();
   74|      0|  }
   75|      4|}
CRYPTO_STATIC_MUTEX_unlock_read:
   77|  1.56k|void CRYPTO_STATIC_MUTEX_unlock_read(struct CRYPTO_STATIC_MUTEX *lock) {
   78|  1.56k|  if (pthread_rwlock_unlock(&lock->lock) != 0) {
  ------------------
  |  Branch (78:7): [True: 0, False: 1.56k]
  ------------------
   79|      0|    abort();
   80|      0|  }
   81|  1.56k|}
CRYPTO_STATIC_MUTEX_unlock_write:
   83|      4|void CRYPTO_STATIC_MUTEX_unlock_write(struct CRYPTO_STATIC_MUTEX *lock) {
   84|      4|  if (pthread_rwlock_unlock(&lock->lock) != 0) {
  ------------------
  |  Branch (84:7): [True: 0, False: 4]
  ------------------
   85|      0|    abort();
   86|      0|  }
   87|      4|}
CRYPTO_once:
   89|  15.5k|void CRYPTO_once(CRYPTO_once_t *once, void (*init)(void)) {
   90|  15.5k|  if (pthread_once(once, init) != 0) {
  ------------------
  |  Branch (90:7): [True: 0, False: 15.5k]
  ------------------
   91|      0|    abort();
   92|      0|  }
   93|  15.5k|}
CRYPTO_get_thread_local:
  132|  11.5k|void *CRYPTO_get_thread_local(thread_local_data_t index) {
  133|  11.5k|  CRYPTO_once(&g_thread_local_init_once, thread_local_init);
  134|  11.5k|  if (!g_thread_local_key_created) {
  ------------------
  |  Branch (134:7): [True: 0, False: 11.5k]
  ------------------
  135|      0|    return NULL;
  136|      0|  }
  137|       |
  138|  11.5k|  void **pointers = pthread_getspecific(g_thread_local_key);
  139|  11.5k|  if (pointers == NULL) {
  ------------------
  |  Branch (139:7): [True: 1, False: 11.5k]
  ------------------
  140|      1|    return NULL;
  141|      1|  }
  142|  11.5k|  return pointers[index];
  143|  11.5k|}
CRYPTO_set_thread_local:
  146|      1|                            thread_local_destructor_t destructor) {
  147|      1|  CRYPTO_once(&g_thread_local_init_once, thread_local_init);
  148|      1|  if (!g_thread_local_key_created) {
  ------------------
  |  Branch (148:7): [True: 0, False: 1]
  ------------------
  149|      0|    destructor(value);
  150|      0|    return 0;
  151|      0|  }
  152|       |
  153|      1|  void **pointers = pthread_getspecific(g_thread_local_key);
  154|      1|  if (pointers == NULL) {
  ------------------
  |  Branch (154:7): [True: 1, False: 0]
  ------------------
  155|      1|    pointers = malloc(sizeof(void *) * NUM_OPENSSL_THREAD_LOCALS);
  156|      1|    if (pointers == NULL) {
  ------------------
  |  Branch (156:9): [True: 0, False: 1]
  ------------------
  157|      0|      destructor(value);
  158|      0|      return 0;
  159|      0|    }
  160|      1|    OPENSSL_memset(pointers, 0, sizeof(void *) * NUM_OPENSSL_THREAD_LOCALS);
  161|      1|    if (pthread_setspecific(g_thread_local_key, pointers) != 0) {
  ------------------
  |  Branch (161:9): [True: 0, False: 1]
  ------------------
  162|      0|      free(pointers);
  163|      0|      destructor(value);
  164|      0|      return 0;
  165|      0|    }
  166|      1|  }
  167|       |
  168|      1|  if (pthread_mutex_lock(&g_destructors_lock) != 0) {
  ------------------
  |  Branch (168:7): [True: 0, False: 1]
  ------------------
  169|      0|    destructor(value);
  170|      0|    return 0;
  171|      0|  }
  172|      1|  g_destructors[index] = destructor;
  173|      1|  pthread_mutex_unlock(&g_destructors_lock);
  174|       |
  175|      1|  pointers[index] = value;
  176|      1|  return 1;
  177|      1|}
thread_pthread.c:thread_local_init:
  127|      1|static void thread_local_init(void) {
  128|      1|  g_thread_local_key_created =
  129|      1|      pthread_key_create(&g_thread_local_key, thread_local_destructor) == 0;
  130|      1|}

_ZN4bssl8internal14StackAllocatedI6cbb_stvXadL_Z8CBB_zeroEEXadL_Z11CBB_cleanupEEEC2Ev:
  577|    978|  StackAllocated() { init(&ctx_); }
_ZN4bssl8internal14StackAllocatedI6cbb_stvXadL_Z8CBB_zeroEEXadL_Z11CBB_cleanupEEE3getEv:
  583|  2.93k|  T *get() { return &ctx_; }
_ZN4bssl8internal14StackAllocatedI6cbb_stvXadL_Z8CBB_zeroEEXadL_Z11CBB_cleanupEEED2Ev:
  578|    978|  ~StackAllocated() { cleanup(&ctx_); }
_ZN4bssl8internal7DeleterclI11evp_pkey_stEEvPT_:
  560|    978|  void operator()(T *ptr) {
  561|       |    // Rather than specialize Deleter for each type, we specialize
  562|       |    // DeleterImpl. This allows bssl::UniquePtr<T> to be used while only
  563|       |    // including base.h as long as the destructor is not emitted. This matches
  564|       |    // std::unique_ptr's behavior on forward-declared types.
  565|       |    //
  566|       |    // DeleterImpl itself is specialized in the corresponding module's header
  567|       |    // and must be included to release an object. If not included, the compiler
  568|       |    // will error that DeleterImpl<T> does not have a method Free.
  569|    978|    DeleterImpl<T>::Free(ptr);
  570|    978|  }
_ZN4bssl8internal11DeleterImplI11evp_pkey_stvE4FreeEPS2_:
  635|    978|    static void Free(type *ptr) { deleter(ptr); } \

bcm.c:ERR_GET_LIB:
  166|    200|OPENSSL_INLINE int ERR_GET_LIB(uint32_t packed_error) {
  167|    200|  return (int)((packed_error >> 24) & 0xff);
  168|    200|}
bcm.c:ERR_GET_REASON:
  173|    200|OPENSSL_INLINE int ERR_GET_REASON(uint32_t packed_error) {
  174|    200|  return (int)(packed_error & 0xfff);
  175|    200|}

bcm.c:sk_BIGNUM_pop_free:
  447|  1.60k|                                           sk_##name##_free_func free_func) { \
  448|  1.60k|    sk_pop_free_ex((_STACK *)sk, sk_##name##_call_free_func,                  \
  449|  1.60k|                   (OPENSSL_sk_free_func)free_func);                          \
  450|  1.60k|  }                                                                           \
bcm.c:sk_BIGNUM_call_free_func:
  391|  20.0k|      OPENSSL_sk_free_func free_func, void *ptr) {                            \
  392|  20.0k|    ((sk_##name##_free_func)free_func)((ptrtype)ptr);                         \
  393|  20.0k|  }                                                                           \
bcm.c:sk_BIGNUM_new_null:
  420|  1.52k|  OPENSSL_INLINE STACK_OF(name) *sk_##name##_new_null(void) {                 \
  421|  1.52k|    return (STACK_OF(name) *)sk_new_null();                                   \
  422|  1.52k|  }                                                                           \
bcm.c:sk_BIGNUM_num:
  424|  4.49M|  OPENSSL_INLINE size_t sk_##name##_num(const STACK_OF(name) *sk) {           \
  425|  4.49M|    return sk_num((const _STACK *)sk);                                        \
  426|  4.49M|  }                                                                           \
bcm.c:sk_BIGNUM_push:
  483|  20.0k|  OPENSSL_INLINE size_t sk_##name##_push(STACK_OF(name) *sk, ptrtype p) {     \
  484|  20.0k|    return sk_push((_STACK *)sk, (void *)p);                                  \
  485|  20.0k|  }                                                                           \
bcm.c:sk_BIGNUM_value:
  433|  4.49M|                                           size_t i) {                        \
  434|  4.49M|    return (ptrtype)sk_value((const _STACK *)sk, i);                          \
  435|  4.49M|  }                                                                           \

curve25519.c:fiat_25519_carry_mul:
  133|  1.68k|static FIAT_25519_FIAT_INLINE void fiat_25519_carry_mul(fiat_25519_tight_field_element out1, const fiat_25519_loose_field_element arg1, const fiat_25519_loose_field_element arg2) {
  134|  1.68k|  fiat_25519_uint128 x1;
  135|  1.68k|  fiat_25519_uint128 x2;
  136|  1.68k|  fiat_25519_uint128 x3;
  137|  1.68k|  fiat_25519_uint128 x4;
  138|  1.68k|  fiat_25519_uint128 x5;
  139|  1.68k|  fiat_25519_uint128 x6;
  140|  1.68k|  fiat_25519_uint128 x7;
  141|  1.68k|  fiat_25519_uint128 x8;
  142|  1.68k|  fiat_25519_uint128 x9;
  143|  1.68k|  fiat_25519_uint128 x10;
  144|  1.68k|  fiat_25519_uint128 x11;
  145|  1.68k|  fiat_25519_uint128 x12;
  146|  1.68k|  fiat_25519_uint128 x13;
  147|  1.68k|  fiat_25519_uint128 x14;
  148|  1.68k|  fiat_25519_uint128 x15;
  149|  1.68k|  fiat_25519_uint128 x16;
  150|  1.68k|  fiat_25519_uint128 x17;
  151|  1.68k|  fiat_25519_uint128 x18;
  152|  1.68k|  fiat_25519_uint128 x19;
  153|  1.68k|  fiat_25519_uint128 x20;
  154|  1.68k|  fiat_25519_uint128 x21;
  155|  1.68k|  fiat_25519_uint128 x22;
  156|  1.68k|  fiat_25519_uint128 x23;
  157|  1.68k|  fiat_25519_uint128 x24;
  158|  1.68k|  fiat_25519_uint128 x25;
  159|  1.68k|  fiat_25519_uint128 x26;
  160|  1.68k|  uint64_t x27;
  161|  1.68k|  uint64_t x28;
  162|  1.68k|  fiat_25519_uint128 x29;
  163|  1.68k|  fiat_25519_uint128 x30;
  164|  1.68k|  fiat_25519_uint128 x31;
  165|  1.68k|  fiat_25519_uint128 x32;
  166|  1.68k|  fiat_25519_uint128 x33;
  167|  1.68k|  uint64_t x34;
  168|  1.68k|  uint64_t x35;
  169|  1.68k|  fiat_25519_uint128 x36;
  170|  1.68k|  uint64_t x37;
  171|  1.68k|  uint64_t x38;
  172|  1.68k|  fiat_25519_uint128 x39;
  173|  1.68k|  uint64_t x40;
  174|  1.68k|  uint64_t x41;
  175|  1.68k|  fiat_25519_uint128 x42;
  176|  1.68k|  uint64_t x43;
  177|  1.68k|  uint64_t x44;
  178|  1.68k|  uint64_t x45;
  179|  1.68k|  uint64_t x46;
  180|  1.68k|  uint64_t x47;
  181|  1.68k|  uint64_t x48;
  182|  1.68k|  uint64_t x49;
  183|  1.68k|  fiat_25519_uint1 x50;
  184|  1.68k|  uint64_t x51;
  185|  1.68k|  uint64_t x52;
  186|  1.68k|  x1 = ((fiat_25519_uint128)(arg1[4]) * ((arg2[4]) * UINT8_C(0x13)));
  187|  1.68k|  x2 = ((fiat_25519_uint128)(arg1[4]) * ((arg2[3]) * UINT8_C(0x13)));
  188|  1.68k|  x3 = ((fiat_25519_uint128)(arg1[4]) * ((arg2[2]) * UINT8_C(0x13)));
  189|  1.68k|  x4 = ((fiat_25519_uint128)(arg1[4]) * ((arg2[1]) * UINT8_C(0x13)));
  190|  1.68k|  x5 = ((fiat_25519_uint128)(arg1[3]) * ((arg2[4]) * UINT8_C(0x13)));
  191|  1.68k|  x6 = ((fiat_25519_uint128)(arg1[3]) * ((arg2[3]) * UINT8_C(0x13)));
  192|  1.68k|  x7 = ((fiat_25519_uint128)(arg1[3]) * ((arg2[2]) * UINT8_C(0x13)));
  193|  1.68k|  x8 = ((fiat_25519_uint128)(arg1[2]) * ((arg2[4]) * UINT8_C(0x13)));
  194|  1.68k|  x9 = ((fiat_25519_uint128)(arg1[2]) * ((arg2[3]) * UINT8_C(0x13)));
  195|  1.68k|  x10 = ((fiat_25519_uint128)(arg1[1]) * ((arg2[4]) * UINT8_C(0x13)));
  196|  1.68k|  x11 = ((fiat_25519_uint128)(arg1[4]) * (arg2[0]));
  197|  1.68k|  x12 = ((fiat_25519_uint128)(arg1[3]) * (arg2[1]));
  198|  1.68k|  x13 = ((fiat_25519_uint128)(arg1[3]) * (arg2[0]));
  199|  1.68k|  x14 = ((fiat_25519_uint128)(arg1[2]) * (arg2[2]));
  200|  1.68k|  x15 = ((fiat_25519_uint128)(arg1[2]) * (arg2[1]));
  201|  1.68k|  x16 = ((fiat_25519_uint128)(arg1[2]) * (arg2[0]));
  202|  1.68k|  x17 = ((fiat_25519_uint128)(arg1[1]) * (arg2[3]));
  203|  1.68k|  x18 = ((fiat_25519_uint128)(arg1[1]) * (arg2[2]));
  204|  1.68k|  x19 = ((fiat_25519_uint128)(arg1[1]) * (arg2[1]));
  205|  1.68k|  x20 = ((fiat_25519_uint128)(arg1[1]) * (arg2[0]));
  206|  1.68k|  x21 = ((fiat_25519_uint128)(arg1[0]) * (arg2[4]));
  207|  1.68k|  x22 = ((fiat_25519_uint128)(arg1[0]) * (arg2[3]));
  208|  1.68k|  x23 = ((fiat_25519_uint128)(arg1[0]) * (arg2[2]));
  209|  1.68k|  x24 = ((fiat_25519_uint128)(arg1[0]) * (arg2[1]));
  210|  1.68k|  x25 = ((fiat_25519_uint128)(arg1[0]) * (arg2[0]));
  211|  1.68k|  x26 = (x25 + (x10 + (x9 + (x7 + x4))));
  212|  1.68k|  x27 = (uint64_t)(x26 >> 51);
  213|  1.68k|  x28 = (uint64_t)(x26 & UINT64_C(0x7ffffffffffff));
  214|  1.68k|  x29 = (x21 + (x17 + (x14 + (x12 + x11))));
  215|  1.68k|  x30 = (x22 + (x18 + (x15 + (x13 + x1))));
  216|  1.68k|  x31 = (x23 + (x19 + (x16 + (x5 + x2))));
  217|  1.68k|  x32 = (x24 + (x20 + (x8 + (x6 + x3))));
  218|  1.68k|  x33 = (x27 + x32);
  219|  1.68k|  x34 = (uint64_t)(x33 >> 51);
  220|  1.68k|  x35 = (uint64_t)(x33 & UINT64_C(0x7ffffffffffff));
  221|  1.68k|  x36 = (x34 + x31);
  222|  1.68k|  x37 = (uint64_t)(x36 >> 51);
  223|  1.68k|  x38 = (uint64_t)(x36 & UINT64_C(0x7ffffffffffff));
  224|  1.68k|  x39 = (x37 + x30);
  225|  1.68k|  x40 = (uint64_t)(x39 >> 51);
  226|  1.68k|  x41 = (uint64_t)(x39 & UINT64_C(0x7ffffffffffff));
  227|  1.68k|  x42 = (x40 + x29);
  228|  1.68k|  x43 = (uint64_t)(x42 >> 51);
  229|  1.68k|  x44 = (uint64_t)(x42 & UINT64_C(0x7ffffffffffff));
  230|  1.68k|  x45 = (x43 * UINT8_C(0x13));
  231|  1.68k|  x46 = (x28 + x45);
  232|  1.68k|  x47 = (x46 >> 51);
  233|  1.68k|  x48 = (x46 & UINT64_C(0x7ffffffffffff));
  234|  1.68k|  x49 = (x47 + x35);
  235|  1.68k|  x50 = (fiat_25519_uint1)(x49 >> 51);
  236|  1.68k|  x51 = (x49 & UINT64_C(0x7ffffffffffff));
  237|  1.68k|  x52 = (x50 + x38);
  238|  1.68k|  out1[0] = x48;
  239|  1.68k|  out1[1] = x51;
  240|  1.68k|  out1[2] = x52;
  241|  1.68k|  out1[3] = x41;
  242|  1.68k|  out1[4] = x44;
  243|  1.68k|}
curve25519.c:fiat_25519_to_bytes:
  514|    187|static FIAT_25519_FIAT_INLINE void fiat_25519_to_bytes(uint8_t out1[32], const fiat_25519_tight_field_element arg1) {
  515|    187|  uint64_t x1;
  516|    187|  fiat_25519_uint1 x2;
  517|    187|  uint64_t x3;
  518|    187|  fiat_25519_uint1 x4;
  519|    187|  uint64_t x5;
  520|    187|  fiat_25519_uint1 x6;
  521|    187|  uint64_t x7;
  522|    187|  fiat_25519_uint1 x8;
  523|    187|  uint64_t x9;
  524|    187|  fiat_25519_uint1 x10;
  525|    187|  uint64_t x11;
  526|    187|  uint64_t x12;
  527|    187|  fiat_25519_uint1 x13;
  528|    187|  uint64_t x14;
  529|    187|  fiat_25519_uint1 x15;
  530|    187|  uint64_t x16;
  531|    187|  fiat_25519_uint1 x17;
  532|    187|  uint64_t x18;
  533|    187|  fiat_25519_uint1 x19;
  534|    187|  uint64_t x20;
  535|    187|  fiat_25519_uint1 x21;
  536|    187|  uint64_t x22;
  537|    187|  uint64_t x23;
  538|    187|  uint64_t x24;
  539|    187|  uint64_t x25;
  540|    187|  uint8_t x26;
  541|    187|  uint64_t x27;
  542|    187|  uint8_t x28;
  543|    187|  uint64_t x29;
  544|    187|  uint8_t x30;
  545|    187|  uint64_t x31;
  546|    187|  uint8_t x32;
  547|    187|  uint64_t x33;
  548|    187|  uint8_t x34;
  549|    187|  uint64_t x35;
  550|    187|  uint8_t x36;
  551|    187|  uint8_t x37;
  552|    187|  uint64_t x38;
  553|    187|  uint8_t x39;
  554|    187|  uint64_t x40;
  555|    187|  uint8_t x41;
  556|    187|  uint64_t x42;
  557|    187|  uint8_t x43;
  558|    187|  uint64_t x44;
  559|    187|  uint8_t x45;
  560|    187|  uint64_t x46;
  561|    187|  uint8_t x47;
  562|    187|  uint64_t x48;
  563|    187|  uint8_t x49;
  564|    187|  uint8_t x50;
  565|    187|  uint64_t x51;
  566|    187|  uint8_t x52;
  567|    187|  uint64_t x53;
  568|    187|  uint8_t x54;
  569|    187|  uint64_t x55;
  570|    187|  uint8_t x56;
  571|    187|  uint64_t x57;
  572|    187|  uint8_t x58;
  573|    187|  uint64_t x59;
  574|    187|  uint8_t x60;
  575|    187|  uint64_t x61;
  576|    187|  uint8_t x62;
  577|    187|  uint64_t x63;
  578|    187|  uint8_t x64;
  579|    187|  fiat_25519_uint1 x65;
  580|    187|  uint64_t x66;
  581|    187|  uint8_t x67;
  582|    187|  uint64_t x68;
  583|    187|  uint8_t x69;
  584|    187|  uint64_t x70;
  585|    187|  uint8_t x71;
  586|    187|  uint64_t x72;
  587|    187|  uint8_t x73;
  588|    187|  uint64_t x74;
  589|    187|  uint8_t x75;
  590|    187|  uint64_t x76;
  591|    187|  uint8_t x77;
  592|    187|  uint8_t x78;
  593|    187|  uint64_t x79;
  594|    187|  uint8_t x80;
  595|    187|  uint64_t x81;
  596|    187|  uint8_t x82;
  597|    187|  uint64_t x83;
  598|    187|  uint8_t x84;
  599|    187|  uint64_t x85;
  600|    187|  uint8_t x86;
  601|    187|  uint64_t x87;
  602|    187|  uint8_t x88;
  603|    187|  uint64_t x89;
  604|    187|  uint8_t x90;
  605|    187|  uint8_t x91;
  606|    187|  fiat_25519_subborrowx_u51(&x1, &x2, 0x0, (arg1[0]), UINT64_C(0x7ffffffffffed));
  607|    187|  fiat_25519_subborrowx_u51(&x3, &x4, x2, (arg1[1]), UINT64_C(0x7ffffffffffff));
  608|    187|  fiat_25519_subborrowx_u51(&x5, &x6, x4, (arg1[2]), UINT64_C(0x7ffffffffffff));
  609|    187|  fiat_25519_subborrowx_u51(&x7, &x8, x6, (arg1[3]), UINT64_C(0x7ffffffffffff));
  610|    187|  fiat_25519_subborrowx_u51(&x9, &x10, x8, (arg1[4]), UINT64_C(0x7ffffffffffff));
  611|    187|  fiat_25519_cmovznz_u64(&x11, x10, 0x0, UINT64_C(0xffffffffffffffff));
  612|    187|  fiat_25519_addcarryx_u51(&x12, &x13, 0x0, x1, (x11 & UINT64_C(0x7ffffffffffed)));
  613|    187|  fiat_25519_addcarryx_u51(&x14, &x15, x13, x3, (x11 & UINT64_C(0x7ffffffffffff)));
  614|    187|  fiat_25519_addcarryx_u51(&x16, &x17, x15, x5, (x11 & UINT64_C(0x7ffffffffffff)));
  615|    187|  fiat_25519_addcarryx_u51(&x18, &x19, x17, x7, (x11 & UINT64_C(0x7ffffffffffff)));
  616|    187|  fiat_25519_addcarryx_u51(&x20, &x21, x19, x9, (x11 & UINT64_C(0x7ffffffffffff)));
  617|    187|  x22 = (x20 << 4);
  618|    187|  x23 = (x18 * (uint64_t)0x2);
  619|    187|  x24 = (x16 << 6);
  620|    187|  x25 = (x14 << 3);
  621|    187|  x26 = (uint8_t)(x12 & UINT8_C(0xff));
  622|    187|  x27 = (x12 >> 8);
  623|    187|  x28 = (uint8_t)(x27 & UINT8_C(0xff));
  624|    187|  x29 = (x27 >> 8);
  625|    187|  x30 = (uint8_t)(x29 & UINT8_C(0xff));
  626|    187|  x31 = (x29 >> 8);
  627|    187|  x32 = (uint8_t)(x31 & UINT8_C(0xff));
  628|    187|  x33 = (x31 >> 8);
  629|    187|  x34 = (uint8_t)(x33 & UINT8_C(0xff));
  630|    187|  x35 = (x33 >> 8);
  631|    187|  x36 = (uint8_t)(x35 & UINT8_C(0xff));
  632|    187|  x37 = (uint8_t)(x35 >> 8);
  633|    187|  x38 = (x25 + (uint64_t)x37);
  634|    187|  x39 = (uint8_t)(x38 & UINT8_C(0xff));
  635|    187|  x40 = (x38 >> 8);
  636|    187|  x41 = (uint8_t)(x40 & UINT8_C(0xff));
  637|    187|  x42 = (x40 >> 8);
  638|    187|  x43 = (uint8_t)(x42 & UINT8_C(0xff));
  639|    187|  x44 = (x42 >> 8);
  640|    187|  x45 = (uint8_t)(x44 & UINT8_C(0xff));
  641|    187|  x46 = (x44 >> 8);
  642|    187|  x47 = (uint8_t)(x46 & UINT8_C(0xff));
  643|    187|  x48 = (x46 >> 8);
  644|    187|  x49 = (uint8_t)(x48 & UINT8_C(0xff));
  645|    187|  x50 = (uint8_t)(x48 >> 8);
  646|    187|  x51 = (x24 + (uint64_t)x50);
  647|    187|  x52 = (uint8_t)(x51 & UINT8_C(0xff));
  648|    187|  x53 = (x51 >> 8);
  649|    187|  x54 = (uint8_t)(x53 & UINT8_C(0xff));
  650|    187|  x55 = (x53 >> 8);
  651|    187|  x56 = (uint8_t)(x55 & UINT8_C(0xff));
  652|    187|  x57 = (x55 >> 8);
  653|    187|  x58 = (uint8_t)(x57 & UINT8_C(0xff));
  654|    187|  x59 = (x57 >> 8);
  655|    187|  x60 = (uint8_t)(x59 & UINT8_C(0xff));
  656|    187|  x61 = (x59 >> 8);
  657|    187|  x62 = (uint8_t)(x61 & UINT8_C(0xff));
  658|    187|  x63 = (x61 >> 8);
  659|    187|  x64 = (uint8_t)(x63 & UINT8_C(0xff));
  660|    187|  x65 = (fiat_25519_uint1)(x63 >> 8);
  661|    187|  x66 = (x23 + (uint64_t)x65);
  662|    187|  x67 = (uint8_t)(x66 & UINT8_C(0xff));
  663|    187|  x68 = (x66 >> 8);
  664|    187|  x69 = (uint8_t)(x68 & UINT8_C(0xff));
  665|    187|  x70 = (x68 >> 8);
  666|    187|  x71 = (uint8_t)(x70 & UINT8_C(0xff));
  667|    187|  x72 = (x70 >> 8);
  668|    187|  x73 = (uint8_t)(x72 & UINT8_C(0xff));
  669|    187|  x74 = (x72 >> 8);
  670|    187|  x75 = (uint8_t)(x74 & UINT8_C(0xff));
  671|    187|  x76 = (x74 >> 8);
  672|    187|  x77 = (uint8_t)(x76 & UINT8_C(0xff));
  673|    187|  x78 = (uint8_t)(x76 >> 8);
  674|    187|  x79 = (x22 + (uint64_t)x78);
  675|    187|  x80 = (uint8_t)(x79 & UINT8_C(0xff));
  676|    187|  x81 = (x79 >> 8);
  677|    187|  x82 = (uint8_t)(x81 & UINT8_C(0xff));
  678|    187|  x83 = (x81 >> 8);
  679|    187|  x84 = (uint8_t)(x83 & UINT8_C(0xff));
  680|    187|  x85 = (x83 >> 8);
  681|    187|  x86 = (uint8_t)(x85 & UINT8_C(0xff));
  682|    187|  x87 = (x85 >> 8);
  683|    187|  x88 = (uint8_t)(x87 & UINT8_C(0xff));
  684|    187|  x89 = (x87 >> 8);
  685|    187|  x90 = (uint8_t)(x89 & UINT8_C(0xff));
  686|    187|  x91 = (uint8_t)(x89 >> 8);
  687|    187|  out1[0] = x26;
  688|    187|  out1[1] = x28;
  689|    187|  out1[2] = x30;
  690|    187|  out1[3] = x32;
  691|    187|  out1[4] = x34;
  692|    187|  out1[5] = x36;
  693|    187|  out1[6] = x39;
  694|    187|  out1[7] = x41;
  695|    187|  out1[8] = x43;
  696|    187|  out1[9] = x45;
  697|    187|  out1[10] = x47;
  698|    187|  out1[11] = x49;
  699|    187|  out1[12] = x52;
  700|    187|  out1[13] = x54;
  701|    187|  out1[14] = x56;
  702|    187|  out1[15] = x58;
  703|    187|  out1[16] = x60;
  704|    187|  out1[17] = x62;
  705|    187|  out1[18] = x64;
  706|    187|  out1[19] = x67;
  707|    187|  out1[20] = x69;
  708|    187|  out1[21] = x71;
  709|    187|  out1[22] = x73;
  710|    187|  out1[23] = x75;
  711|    187|  out1[24] = x77;
  712|    187|  out1[25] = x80;
  713|    187|  out1[26] = x82;
  714|    187|  out1[27] = x84;
  715|    187|  out1[28] = x86;
  716|    187|  out1[29] = x88;
  717|    187|  out1[30] = x90;
  718|    187|  out1[31] = x91;
  719|    187|}
curve25519.c:fiat_25519_subborrowx_u51:
   92|    935|static FIAT_25519_FIAT_INLINE void fiat_25519_subborrowx_u51(uint64_t* out1, fiat_25519_uint1* out2, fiat_25519_uint1 arg1, uint64_t arg2, uint64_t arg3) {
   93|    935|  int64_t x1;
   94|    935|  fiat_25519_int1 x2;
   95|    935|  uint64_t x3;
   96|    935|  x1 = ((int64_t)(arg2 - (int64_t)arg1) - (int64_t)arg3);
   97|    935|  x2 = (fiat_25519_int1)(x1 >> 51);
   98|    935|  x3 = (x1 & UINT64_C(0x7ffffffffffff));
   99|    935|  *out1 = x3;
  100|    935|  *out2 = (fiat_25519_uint1)(0x0 - x2);
  101|    935|}
curve25519.c:fiat_25519_cmovznz_u64:
  116|    187|static FIAT_25519_FIAT_INLINE void fiat_25519_cmovznz_u64(uint64_t* out1, fiat_25519_uint1 arg1, uint64_t arg2, uint64_t arg3) {
  117|    187|  fiat_25519_uint1 x1;
  118|    187|  uint64_t x2;
  119|    187|  uint64_t x3;
  120|    187|  x1 = (!(!arg1));
  121|    187|  x2 = ((fiat_25519_int1)(0x0 - x1) & UINT64_C(0xffffffffffffffff));
  122|    187|  x3 = ((fiat_25519_value_barrier_u64(x2) & arg3) | (fiat_25519_value_barrier_u64((~x2)) & arg2));
  123|    187|  *out1 = x3;
  124|    187|}
curve25519.c:fiat_25519_value_barrier_u64:
   42|    374|static __inline__ uint64_t fiat_25519_value_barrier_u64(uint64_t a) {
   43|    374|  __asm__("" : "+r"(a) : /* no inputs */);
   44|    374|  return a;
   45|    374|}
curve25519.c:fiat_25519_addcarryx_u51:
   66|    935|static FIAT_25519_FIAT_INLINE void fiat_25519_addcarryx_u51(uint64_t* out1, fiat_25519_uint1* out2, fiat_25519_uint1 arg1, uint64_t arg2, uint64_t arg3) {
   67|    935|  uint64_t x1;
   68|    935|  uint64_t x2;
   69|    935|  fiat_25519_uint1 x3;
   70|    935|  x1 = ((arg1 + arg2) + arg3);
   71|    935|  x2 = (x1 & UINT64_C(0x7ffffffffffff));
   72|    935|  x3 = (fiat_25519_uint1)(x1 >> 51);
   73|    935|  *out1 = x2;
   74|    935|  *out2 = x3;
   75|    935|}
curve25519.c:fiat_25519_carry_square:
  252|  34.5k|static FIAT_25519_FIAT_INLINE void fiat_25519_carry_square(fiat_25519_tight_field_element out1, const fiat_25519_loose_field_element arg1) {
  253|  34.5k|  uint64_t x1;
  254|  34.5k|  uint64_t x2;
  255|  34.5k|  uint64_t x3;
  256|  34.5k|  uint64_t x4;
  257|  34.5k|  uint64_t x5;
  258|  34.5k|  uint64_t x6;
  259|  34.5k|  uint64_t x7;
  260|  34.5k|  uint64_t x8;
  261|  34.5k|  fiat_25519_uint128 x9;
  262|  34.5k|  fiat_25519_uint128 x10;
  263|  34.5k|  fiat_25519_uint128 x11;
  264|  34.5k|  fiat_25519_uint128 x12;
  265|  34.5k|  fiat_25519_uint128 x13;
  266|  34.5k|  fiat_25519_uint128 x14;
  267|  34.5k|  fiat_25519_uint128 x15;
  268|  34.5k|  fiat_25519_uint128 x16;
  269|  34.5k|  fiat_25519_uint128 x17;
  270|  34.5k|  fiat_25519_uint128 x18;
  271|  34.5k|  fiat_25519_uint128 x19;
  272|  34.5k|  fiat_25519_uint128 x20;
  273|  34.5k|  fiat_25519_uint128 x21;
  274|  34.5k|  fiat_25519_uint128 x22;
  275|  34.5k|  fiat_25519_uint128 x23;
  276|  34.5k|  fiat_25519_uint128 x24;
  277|  34.5k|  uint64_t x25;
  278|  34.5k|  uint64_t x26;
  279|  34.5k|  fiat_25519_uint128 x27;
  280|  34.5k|  fiat_25519_uint128 x28;
  281|  34.5k|  fiat_25519_uint128 x29;
  282|  34.5k|  fiat_25519_uint128 x30;
  283|  34.5k|  fiat_25519_uint128 x31;
  284|  34.5k|  uint64_t x32;
  285|  34.5k|  uint64_t x33;
  286|  34.5k|  fiat_25519_uint128 x34;
  287|  34.5k|  uint64_t x35;
  288|  34.5k|  uint64_t x36;
  289|  34.5k|  fiat_25519_uint128 x37;
  290|  34.5k|  uint64_t x38;
  291|  34.5k|  uint64_t x39;
  292|  34.5k|  fiat_25519_uint128 x40;
  293|  34.5k|  uint64_t x41;
  294|  34.5k|  uint64_t x42;
  295|  34.5k|  uint64_t x43;
  296|  34.5k|  uint64_t x44;
  297|  34.5k|  uint64_t x45;
  298|  34.5k|  uint64_t x46;
  299|  34.5k|  uint64_t x47;
  300|  34.5k|  fiat_25519_uint1 x48;
  301|  34.5k|  uint64_t x49;
  302|  34.5k|  uint64_t x50;
  303|  34.5k|  x1 = ((arg1[4]) * UINT8_C(0x13));
  304|  34.5k|  x2 = (x1 * 0x2);
  305|  34.5k|  x3 = ((arg1[4]) * 0x2);
  306|  34.5k|  x4 = ((arg1[3]) * UINT8_C(0x13));
  307|  34.5k|  x5 = (x4 * 0x2);
  308|  34.5k|  x6 = ((arg1[3]) * 0x2);
  309|  34.5k|  x7 = ((arg1[2]) * 0x2);
  310|  34.5k|  x8 = ((arg1[1]) * 0x2);
  311|  34.5k|  x9 = ((fiat_25519_uint128)(arg1[4]) * x1);
  312|  34.5k|  x10 = ((fiat_25519_uint128)(arg1[3]) * x2);
  313|  34.5k|  x11 = ((fiat_25519_uint128)(arg1[3]) * x4);
  314|  34.5k|  x12 = ((fiat_25519_uint128)(arg1[2]) * x2);
  315|  34.5k|  x13 = ((fiat_25519_uint128)(arg1[2]) * x5);
  316|  34.5k|  x14 = ((fiat_25519_uint128)(arg1[2]) * (arg1[2]));
  317|  34.5k|  x15 = ((fiat_25519_uint128)(arg1[1]) * x2);
  318|  34.5k|  x16 = ((fiat_25519_uint128)(arg1[1]) * x6);
  319|  34.5k|  x17 = ((fiat_25519_uint128)(arg1[1]) * x7);
  320|  34.5k|  x18 = ((fiat_25519_uint128)(arg1[1]) * (arg1[1]));
  321|  34.5k|  x19 = ((fiat_25519_uint128)(arg1[0]) * x3);
  322|  34.5k|  x20 = ((fiat_25519_uint128)(arg1[0]) * x6);
  323|  34.5k|  x21 = ((fiat_25519_uint128)(arg1[0]) * x7);
  324|  34.5k|  x22 = ((fiat_25519_uint128)(arg1[0]) * x8);
  325|  34.5k|  x23 = ((fiat_25519_uint128)(arg1[0]) * (arg1[0]));
  326|  34.5k|  x24 = (x23 + (x15 + x13));
  327|  34.5k|  x25 = (uint64_t)(x24 >> 51);
  328|  34.5k|  x26 = (uint64_t)(x24 & UINT64_C(0x7ffffffffffff));
  329|  34.5k|  x27 = (x19 + (x16 + x14));
  330|  34.5k|  x28 = (x20 + (x17 + x9));
  331|  34.5k|  x29 = (x21 + (x18 + x10));
  332|  34.5k|  x30 = (x22 + (x12 + x11));
  333|  34.5k|  x31 = (x25 + x30);
  334|  34.5k|  x32 = (uint64_t)(x31 >> 51);
  335|  34.5k|  x33 = (uint64_t)(x31 & UINT64_C(0x7ffffffffffff));
  336|  34.5k|  x34 = (x32 + x29);
  337|  34.5k|  x35 = (uint64_t)(x34 >> 51);
  338|  34.5k|  x36 = (uint64_t)(x34 & UINT64_C(0x7ffffffffffff));
  339|  34.5k|  x37 = (x35 + x28);
  340|  34.5k|  x38 = (uint64_t)(x37 >> 51);
  341|  34.5k|  x39 = (uint64_t)(x37 & UINT64_C(0x7ffffffffffff));
  342|  34.5k|  x40 = (x38 + x27);
  343|  34.5k|  x41 = (uint64_t)(x40 >> 51);
  344|  34.5k|  x42 = (uint64_t)(x40 & UINT64_C(0x7ffffffffffff));
  345|  34.5k|  x43 = (x41 * UINT8_C(0x13));
  346|  34.5k|  x44 = (x26 + x43);
  347|  34.5k|  x45 = (x44 >> 51);
  348|  34.5k|  x46 = (x44 & UINT64_C(0x7ffffffffffff));
  349|  34.5k|  x47 = (x45 + x33);
  350|  34.5k|  x48 = (fiat_25519_uint1)(x47 >> 51);
  351|  34.5k|  x49 = (x47 & UINT64_C(0x7ffffffffffff));
  352|  34.5k|  x50 = (x48 + x36);
  353|  34.5k|  out1[0] = x46;
  354|  34.5k|  out1[1] = x49;
  355|  34.5k|  out1[2] = x50;
  356|  34.5k|  out1[3] = x39;
  357|  34.5k|  out1[4] = x42;
  358|  34.5k|}
curve25519.c:fiat_25519_sub:
  431|     85|static FIAT_25519_FIAT_INLINE void fiat_25519_sub(fiat_25519_loose_field_element out1, const fiat_25519_tight_field_element arg1, const fiat_25519_tight_field_element arg2) {
  432|     85|  uint64_t x1;
  433|     85|  uint64_t x2;
  434|     85|  uint64_t x3;
  435|     85|  uint64_t x4;
  436|     85|  uint64_t x5;
  437|     85|  x1 = ((UINT64_C(0xfffffffffffda) + (arg1[0])) - (arg2[0]));
  438|     85|  x2 = ((UINT64_C(0xffffffffffffe) + (arg1[1])) - (arg2[1]));
  439|     85|  x3 = ((UINT64_C(0xffffffffffffe) + (arg1[2])) - (arg2[2]));
  440|     85|  x4 = ((UINT64_C(0xffffffffffffe) + (arg1[3])) - (arg2[3]));
  441|     85|  x5 = ((UINT64_C(0xffffffffffffe) + (arg1[4])) - (arg2[4]));
  442|     85|  out1[0] = x1;
  443|     85|  out1[1] = x2;
  444|     85|  out1[2] = x3;
  445|     85|  out1[3] = x4;
  446|     85|  out1[4] = x5;
  447|     85|}
curve25519.c:fiat_25519_add:
  406|     85|static FIAT_25519_FIAT_INLINE void fiat_25519_add(fiat_25519_loose_field_element out1, const fiat_25519_tight_field_element arg1, const fiat_25519_tight_field_element arg2) {
  407|     85|  uint64_t x1;
  408|     85|  uint64_t x2;
  409|     85|  uint64_t x3;
  410|     85|  uint64_t x4;
  411|     85|  uint64_t x5;
  412|     85|  x1 = ((arg1[0]) + (arg2[0]));
  413|     85|  x2 = ((arg1[1]) + (arg2[1]));
  414|     85|  x3 = ((arg1[2]) + (arg2[2]));
  415|     85|  x4 = ((arg1[3]) + (arg2[3]));
  416|     85|  x5 = ((arg1[4]) + (arg2[4]));
  417|     85|  out1[0] = x1;
  418|     85|  out1[1] = x2;
  419|     85|  out1[2] = x3;
  420|     85|  out1[3] = x4;
  421|     85|  out1[4] = x5;
  422|     85|}
curve25519.c:fiat_25519_from_bytes:
  730|    544|static FIAT_25519_FIAT_INLINE void fiat_25519_from_bytes(fiat_25519_tight_field_element out1, const uint8_t arg1[32]) {
  731|    544|  uint64_t x1;
  732|    544|  uint64_t x2;
  733|    544|  uint64_t x3;
  734|    544|  uint64_t x4;
  735|    544|  uint64_t x5;
  736|    544|  uint64_t x6;
  737|    544|  uint64_t x7;
  738|    544|  uint64_t x8;
  739|    544|  uint64_t x9;
  740|    544|  uint64_t x10;
  741|    544|  uint64_t x11;
  742|    544|  uint64_t x12;
  743|    544|  uint64_t x13;
  744|    544|  uint64_t x14;
  745|    544|  uint64_t x15;
  746|    544|  uint64_t x16;
  747|    544|  uint64_t x17;
  748|    544|  uint64_t x18;
  749|    544|  uint64_t x19;
  750|    544|  uint64_t x20;
  751|    544|  uint64_t x21;
  752|    544|  uint64_t x22;
  753|    544|  uint64_t x23;
  754|    544|  uint64_t x24;
  755|    544|  uint64_t x25;
  756|    544|  uint64_t x26;
  757|    544|  uint64_t x27;
  758|    544|  uint64_t x28;
  759|    544|  uint64_t x29;
  760|    544|  uint64_t x30;
  761|    544|  uint64_t x31;
  762|    544|  uint8_t x32;
  763|    544|  uint64_t x33;
  764|    544|  uint64_t x34;
  765|    544|  uint64_t x35;
  766|    544|  uint64_t x36;
  767|    544|  uint64_t x37;
  768|    544|  uint64_t x38;
  769|    544|  uint64_t x39;
  770|    544|  uint8_t x40;
  771|    544|  uint64_t x41;
  772|    544|  uint64_t x42;
  773|    544|  uint64_t x43;
  774|    544|  uint64_t x44;
  775|    544|  uint64_t x45;
  776|    544|  uint64_t x46;
  777|    544|  uint64_t x47;
  778|    544|  uint8_t x48;
  779|    544|  uint64_t x49;
  780|    544|  uint64_t x50;
  781|    544|  uint64_t x51;
  782|    544|  uint64_t x52;
  783|    544|  uint64_t x53;
  784|    544|  uint64_t x54;
  785|    544|  uint64_t x55;
  786|    544|  uint64_t x56;
  787|    544|  uint8_t x57;
  788|    544|  uint64_t x58;
  789|    544|  uint64_t x59;
  790|    544|  uint64_t x60;
  791|    544|  uint64_t x61;
  792|    544|  uint64_t x62;
  793|    544|  uint64_t x63;
  794|    544|  uint64_t x64;
  795|    544|  uint8_t x65;
  796|    544|  uint64_t x66;
  797|    544|  uint64_t x67;
  798|    544|  uint64_t x68;
  799|    544|  uint64_t x69;
  800|    544|  uint64_t x70;
  801|    544|  uint64_t x71;
  802|    544|  x1 = ((uint64_t)(arg1[31]) << 44);
  803|    544|  x2 = ((uint64_t)(arg1[30]) << 36);
  804|    544|  x3 = ((uint64_t)(arg1[29]) << 28);
  805|    544|  x4 = ((uint64_t)(arg1[28]) << 20);
  806|    544|  x5 = ((uint64_t)(arg1[27]) << 12);
  807|    544|  x6 = ((uint64_t)(arg1[26]) << 4);
  808|    544|  x7 = ((uint64_t)(arg1[25]) << 47);
  809|    544|  x8 = ((uint64_t)(arg1[24]) << 39);
  810|    544|  x9 = ((uint64_t)(arg1[23]) << 31);
  811|    544|  x10 = ((uint64_t)(arg1[22]) << 23);
  812|    544|  x11 = ((uint64_t)(arg1[21]) << 15);
  813|    544|  x12 = ((uint64_t)(arg1[20]) << 7);
  814|    544|  x13 = ((uint64_t)(arg1[19]) << 50);
  815|    544|  x14 = ((uint64_t)(arg1[18]) << 42);
  816|    544|  x15 = ((uint64_t)(arg1[17]) << 34);
  817|    544|  x16 = ((uint64_t)(arg1[16]) << 26);
  818|    544|  x17 = ((uint64_t)(arg1[15]) << 18);
  819|    544|  x18 = ((uint64_t)(arg1[14]) << 10);
  820|    544|  x19 = ((uint64_t)(arg1[13]) << 2);
  821|    544|  x20 = ((uint64_t)(arg1[12]) << 45);
  822|    544|  x21 = ((uint64_t)(arg1[11]) << 37);
  823|    544|  x22 = ((uint64_t)(arg1[10]) << 29);
  824|    544|  x23 = ((uint64_t)(arg1[9]) << 21);
  825|    544|  x24 = ((uint64_t)(arg1[8]) << 13);
  826|    544|  x25 = ((uint64_t)(arg1[7]) << 5);
  827|    544|  x26 = ((uint64_t)(arg1[6]) << 48);
  828|    544|  x27 = ((uint64_t)(arg1[5]) << 40);
  829|    544|  x28 = ((uint64_t)(arg1[4]) << 32);
  830|    544|  x29 = ((uint64_t)(arg1[3]) << 24);
  831|    544|  x30 = ((uint64_t)(arg1[2]) << 16);
  832|    544|  x31 = ((uint64_t)(arg1[1]) << 8);
  833|    544|  x32 = (arg1[0]);
  834|    544|  x33 = (x31 + (uint64_t)x32);
  835|    544|  x34 = (x30 + x33);
  836|    544|  x35 = (x29 + x34);
  837|    544|  x36 = (x28 + x35);
  838|    544|  x37 = (x27 + x36);
  839|    544|  x38 = (x26 + x37);
  840|    544|  x39 = (x38 & UINT64_C(0x7ffffffffffff));
  841|    544|  x40 = (uint8_t)(x38 >> 51);
  842|    544|  x41 = (x25 + (uint64_t)x40);
  843|    544|  x42 = (x24 + x41);
  844|    544|  x43 = (x23 + x42);
  845|    544|  x44 = (x22 + x43);
  846|    544|  x45 = (x21 + x44);
  847|    544|  x46 = (x20 + x45);
  848|    544|  x47 = (x46 & UINT64_C(0x7ffffffffffff));
  849|    544|  x48 = (uint8_t)(x46 >> 51);
  850|    544|  x49 = (x19 + (uint64_t)x48);
  851|    544|  x50 = (x18 + x49);
  852|    544|  x51 = (x17 + x50);
  853|    544|  x52 = (x16 + x51);
  854|    544|  x53 = (x15 + x52);
  855|    544|  x54 = (x14 + x53);
  856|    544|  x55 = (x13 + x54);
  857|    544|  x56 = (x55 & UINT64_C(0x7ffffffffffff));
  858|    544|  x57 = (uint8_t)(x55 >> 51);
  859|    544|  x58 = (x12 + (uint64_t)x57);
  860|    544|  x59 = (x11 + x58);
  861|    544|  x60 = (x10 + x59);
  862|    544|  x61 = (x9 + x60);
  863|    544|  x62 = (x8 + x61);
  864|    544|  x63 = (x7 + x62);
  865|    544|  x64 = (x63 & UINT64_C(0x7ffffffffffff));
  866|    544|  x65 = (uint8_t)(x63 >> 51);
  867|    544|  x66 = (x6 + (uint64_t)x65);
  868|    544|  x67 = (x5 + x66);
  869|    544|  x68 = (x4 + x67);
  870|    544|  x69 = (x3 + x68);
  871|    544|  x70 = (x2 + x69);
  872|    544|  x71 = (x1 + x70);
  873|    544|  out1[0] = x39;
  874|    544|  out1[1] = x47;
  875|    544|  out1[2] = x56;
  876|    544|  out1[3] = x64;
  877|    544|  out1[4] = x71;
  878|    544|}

x25519_ge_scalarmult_base_adx:
  626|    136|void x25519_ge_scalarmult_base_adx(uint8_t h[4][32], const uint8_t a[32]) {
  627|    136|  signed char e[64];
  628|    136|  signed char carry;
  629|       |
  630|  4.48k|  for (unsigned i = 0; i < 32; ++i) {
  ------------------
  |  Branch (630:24): [True: 4.35k, False: 136]
  ------------------
  631|  4.35k|    e[2 * i + 0] = (a[i] >> 0) & 15;
  632|  4.35k|    e[2 * i + 1] = (a[i] >> 4) & 15;
  633|  4.35k|  }
  634|       |  // each e[i] is between 0 and 15
  635|       |  // e[63] is between 0 and 7
  636|       |
  637|    136|  carry = 0;
  638|  8.70k|  for (unsigned i = 0; i < 63; ++i) {
  ------------------
  |  Branch (638:24): [True: 8.56k, False: 136]
  ------------------
  639|  8.56k|    e[i] += carry;
  640|  8.56k|    carry = e[i] + 8;
  641|  8.56k|    carry >>= 4;
  642|  8.56k|    e[i] -= carry << 4;
  643|  8.56k|  }
  644|    136|  e[63] += carry;
  645|       |  // each e[i] is between -8 and 8
  646|       |
  647|    136|  ge_p3_4 r = {{0}, {1}, {1}, {0}};
  648|  4.48k|  for (unsigned i = 1; i < 64; i += 2) {
  ------------------
  |  Branch (648:24): [True: 4.35k, False: 136]
  ------------------
  649|  4.35k|    ge_precomp_4 t;
  650|  4.35k|    table_select_4(&t, i / 2, e[i]);
  651|  4.35k|    ge_p3_add_p3_precomp_4(&r, &r, &t);
  652|  4.35k|  }
  653|       |
  654|    136|  inline_x25519_ge_dbl_4(&r, &r, /*skip_t=*/true);
  655|    136|  inline_x25519_ge_dbl_4(&r, &r, /*skip_t=*/true);
  656|    136|  inline_x25519_ge_dbl_4(&r, &r, /*skip_t=*/true);
  657|    136|  inline_x25519_ge_dbl_4(&r, &r, /*skip_t=*/false);
  658|       |
  659|  4.48k|  for (unsigned i = 0; i < 64; i += 2) {
  ------------------
  |  Branch (659:24): [True: 4.35k, False: 136]
  ------------------
  660|  4.35k|    ge_precomp_4 t;
  661|  4.35k|    table_select_4(&t, i / 2, e[i]);
  662|  4.35k|    ge_p3_add_p3_precomp_4(&r, &r, &t);
  663|  4.35k|  }
  664|       |
  665|       |  // fe4 uses saturated 64-bit limbs, so converting to bytes is just a copy.
  666|       |  // Satisfy stated precondition of fiat_25519_from_bytes; tests pass either way
  667|    136|  fe4_canon(r.X, r.X);
  668|    136|  fe4_canon(r.Y, r.Y);
  669|    136|  fe4_canon(r.Z, r.Z);
  670|    136|  fe4_canon(r.T, r.T);
  671|    136|  static_assert(sizeof(ge_p3_4) == sizeof(uint8_t[4][32]), "");
  672|    136|  OPENSSL_memcpy(h, &r, sizeof(ge_p3_4));
  673|    136|}
curve25519_64_adx.c:fiat_cmovznz_u64:
  137|   150k|static inline void fiat_cmovznz_u64(uint64_t* out1, fiat_uint1 arg1, uint64_t arg2, uint64_t arg3) {
  138|   150k|  fiat_uint1 x1;
  139|   150k|  uint64_t x2;
  140|   150k|  uint64_t x3;
  141|   150k|  x1 = (!(!arg1));
  142|   150k|  x2 = ((fiat_int1)(0x0 - x1) & UINT64_C(0xffffffffffffffff));
  143|   150k|  x3 = ((fiat_value_barrier_u64(x2) & arg3) | (fiat_value_barrier_u64((~x2)) & arg2));
  144|   150k|  *out1 = x3;
  145|   150k|}
curve25519_64_adx.c:fiat_value_barrier_u64:
   10|   300k|static __inline__ uint64_t fiat_value_barrier_u64(uint64_t a) {
   11|   300k|  __asm__("" : "+r"(a) : /* no inputs */);
   12|   300k|  return a;
   13|   300k|}
curve25519_64_adx.c:fe4_sub:
  199|  36.4k|static void fe4_sub(uint64_t out1[4], const uint64_t arg1[4], const uint64_t arg2[4]) {
  200|  36.4k|  uint64_t x1;
  201|  36.4k|  uint64_t x2;
  202|  36.4k|  fiat_uint1 x3;
  203|  36.4k|  uint64_t x4;
  204|  36.4k|  uint64_t x5;
  205|  36.4k|  fiat_uint1 x6;
  206|  36.4k|  uint64_t x7;
  207|  36.4k|  uint64_t x8;
  208|  36.4k|  fiat_uint1 x9;
  209|  36.4k|  uint64_t x10;
  210|  36.4k|  uint64_t x11;
  211|  36.4k|  fiat_uint1 x12;
  212|  36.4k|  uint64_t x13;
  213|  36.4k|  uint64_t x14;
  214|  36.4k|  fiat_uint1 x15;
  215|  36.4k|  uint64_t x16;
  216|  36.4k|  fiat_uint1 x17;
  217|  36.4k|  uint64_t x18;
  218|  36.4k|  fiat_uint1 x19;
  219|  36.4k|  uint64_t x20;
  220|  36.4k|  fiat_uint1 x21;
  221|  36.4k|  uint64_t x22;
  222|  36.4k|  uint64_t x23;
  223|  36.4k|  fiat_uint1 x24;
  224|  36.4k|  x1 = (arg2[0]);
  225|  36.4k|  fiat_subborrowx_u64(&x2, &x3, 0x0, (arg1[0]), x1);
  226|  36.4k|  x4 = (arg2[1]);
  227|  36.4k|  fiat_subborrowx_u64(&x5, &x6, x3, (arg1[1]), x4);
  228|  36.4k|  x7 = (arg2[2]);
  229|  36.4k|  fiat_subborrowx_u64(&x8, &x9, x6, (arg1[2]), x7);
  230|  36.4k|  x10 = (arg2[3]);
  231|  36.4k|  fiat_subborrowx_u64(&x11, &x12, x9, (arg1[3]), x10);
  232|  36.4k|  fiat_cmovznz_u64(&x13, x12, 0x0, UINT8_C(0x26)); // NOTE: clang 14 for Zen 2 uses sbb, and
  233|  36.4k|  fiat_subborrowx_u64(&x14, &x15, 0x0, x2, x13);
  234|  36.4k|  fiat_subborrowx_u64(&x16, &x17, x15, x5, 0x0);
  235|  36.4k|  fiat_subborrowx_u64(&x18, &x19, x17, x8, 0x0);
  236|  36.4k|  fiat_subborrowx_u64(&x20, &x21, x19, x11, 0x0);
  237|  36.4k|  fiat_cmovznz_u64(&x22, x21, 0x0, UINT8_C(0x26)); // NOTE: clang 14 for Zen 2 uses sbb, and
  238|  36.4k|  fiat_subborrowx_u64(&x23, &x24, 0x0, x14, x22);
  239|  36.4k|  out1[0] = x23;
  240|  36.4k|  out1[1] = x16;
  241|  36.4k|  out1[2] = x18;
  242|  36.4k|  out1[3] = x20;
  243|  36.4k|}
curve25519_64_adx.c:fiat_subborrowx_u64:
  103|   332k|static inline void fiat_subborrowx_u64(uint64_t* out1, fiat_uint1* out2, fiat_uint1 arg1, uint64_t arg2, uint64_t arg3) {
  104|   332k|#if defined(__has_builtin)
  105|   332k|#  if __has_builtin(__builtin_ia32_subborrow_u64)
  106|   332k|#    define subborrow64 __builtin_ia32_subborrow_u64
  107|   332k|#  endif
  108|   332k|#endif
  109|   332k|#if defined(subborrow64)
  110|   332k|  long long unsigned int t;
  111|   332k|  *out2 = subborrow64(arg1, arg2, arg3, &t);
  ------------------
  |  |  106|   332k|#    define subborrow64 __builtin_ia32_subborrow_u64
  ------------------
  112|   332k|  *out1 = t;
  113|       |#elif defined(_M_X64)
  114|       |  long long unsigned int t;
  115|       |  *out2 = _subborrow_u64(arg1, arg2, arg3, &t); // NOTE: edited after generation
  116|       |  *out1 = t;
  117|       |#else
  118|       |  *out1 = arg2 - arg3 - arg1;
  119|       |  *out2 = (arg2 < arg3) | ((arg2 == arg3) & arg1);
  120|       |#endif
  121|   332k|#undef subborrow64
  122|   332k|}
curve25519_64_adx.c:fe4_add:
  154|  36.4k|static void fe4_add(uint64_t out1[4], const uint64_t arg1[4], const uint64_t arg2[4]) {
  155|  36.4k|  uint64_t x1;
  156|  36.4k|  fiat_uint1 x2;
  157|  36.4k|  uint64_t x3;
  158|  36.4k|  fiat_uint1 x4;
  159|  36.4k|  uint64_t x5;
  160|  36.4k|  fiat_uint1 x6;
  161|  36.4k|  uint64_t x7;
  162|  36.4k|  fiat_uint1 x8;
  163|  36.4k|  uint64_t x9;
  164|  36.4k|  uint64_t x10;
  165|  36.4k|  fiat_uint1 x11;
  166|  36.4k|  uint64_t x12;
  167|  36.4k|  fiat_uint1 x13;
  168|  36.4k|  uint64_t x14;
  169|  36.4k|  fiat_uint1 x15;
  170|  36.4k|  uint64_t x16;
  171|  36.4k|  fiat_uint1 x17;
  172|  36.4k|  uint64_t x18;
  173|  36.4k|  uint64_t x19;
  174|  36.4k|  fiat_uint1 x20;
  175|  36.4k|  fiat_addcarryx_u64(&x1, &x2, 0x0, (arg1[0]), (arg2[0]));
  176|  36.4k|  fiat_addcarryx_u64(&x3, &x4, x2, (arg1[1]), (arg2[1]));
  177|  36.4k|  fiat_addcarryx_u64(&x5, &x6, x4, (arg1[2]), (arg2[2]));
  178|  36.4k|  fiat_addcarryx_u64(&x7, &x8, x6, (arg1[3]), (arg2[3]));
  179|  36.4k|  fiat_cmovznz_u64(&x9, x8, 0x0, UINT8_C(0x26)); // NOTE: clang 14 for Zen 2 uses sbb, and
  180|  36.4k|  fiat_addcarryx_u64(&x10, &x11, 0x0, x1, x9);
  181|  36.4k|  fiat_addcarryx_u64(&x12, &x13, x11, x3, 0x0);
  182|  36.4k|  fiat_addcarryx_u64(&x14, &x15, x13, x5, 0x0);
  183|  36.4k|  fiat_addcarryx_u64(&x16, &x17, x15, x7, 0x0);
  184|  36.4k|  fiat_cmovznz_u64(&x18, x17, 0x0, UINT8_C(0x26)); // NOTE: clang 14 for Zen 2 uses sbb, and
  185|  36.4k|  fiat_addcarryx_u64(&x19, &x20, 0x0, x10, x18);
  186|  36.4k|  out1[0] = x19;
  187|  36.4k|  out1[1] = x12;
  188|  36.4k|  out1[2] = x14;
  189|  36.4k|  out1[3] = x16;
  190|  36.4k|}
curve25519_64_adx.c:fiat_addcarryx_u64:
   62|   328k|static inline void fiat_addcarryx_u64(uint64_t* out1, fiat_uint1* out2, fiat_uint1 arg1, uint64_t arg2, uint64_t arg3) {
   63|       |// NOTE: edited after generation
   64|   328k|#if defined(__has_builtin)
   65|   328k|#  if __has_builtin(__builtin_ia32_addcarryx_u64)
   66|   328k|#    define addcarry64 __builtin_ia32_addcarryx_u64
   67|   328k|#  endif
   68|   328k|#endif
   69|   328k|#if defined(addcarry64)
   70|   328k|  long long unsigned int t;
   71|   328k|  *out2 = addcarry64(arg1, arg2, arg3, &t);
  ------------------
  |  |   66|   328k|#    define addcarry64 __builtin_ia32_addcarryx_u64
  ------------------
   72|   328k|  *out1 = t;
   73|       |#elif defined(_M_X64)
   74|       |  long long unsigned int t;
   75|       |  *out2 = _addcarry_u64(arg1, arg2, arg3, out1);
   76|       |  *out1 = t;
   77|       |#else
   78|       |  arg2 += arg1;
   79|       |  arg1 = arg2 < arg1;
   80|       |  uint64_t ret = arg2 + arg3;
   81|       |  arg1 += ret < arg2;
   82|       |  *out1 = ret;
   83|       |  *out2 = arg1;
   84|       |#endif
   85|   328k|#undef addcarry64
   86|   328k|}
curve25519_64_adx.c:fe4_mul:
   14|  62.6k|static inline void fe4_mul(fe4 out, const fe4 x, const fe4 y) { fiat_curve25519_adx_mul(out, x, y); }
curve25519_64_adx.c:fe4_sq:
   15|  2.17k|static inline void fe4_sq(fe4 out, const fe4 x) { fiat_curve25519_adx_square(out, x); }
curve25519_64_adx.c:fe4_canon:
  306|    544|static void fe4_canon(uint64_t out1[4], const uint64_t arg1[4]) {
  307|    544|  uint64_t x1;
  308|    544|  fiat_uint1 x2;
  309|    544|  uint64_t x3;
  310|    544|  fiat_uint1 x4;
  311|    544|  uint64_t x5;
  312|    544|  fiat_uint1 x6;
  313|    544|  uint64_t x7;
  314|    544|  fiat_uint1 x8;
  315|    544|  uint64_t x9;
  316|    544|  uint64_t x10;
  317|    544|  uint64_t x11;
  318|    544|  uint64_t x12;
  319|    544|  uint64_t x13;
  320|    544|  fiat_uint1 x14;
  321|    544|  uint64_t x15;
  322|    544|  fiat_uint1 x16;
  323|    544|  uint64_t x17;
  324|    544|  fiat_uint1 x18;
  325|    544|  uint64_t x19;
  326|    544|  fiat_uint1 x20;
  327|    544|  uint64_t x21;
  328|    544|  uint64_t x22;
  329|    544|  uint64_t x23;
  330|    544|  uint64_t x24;
  331|    544|  fiat_subborrowx_u64(&x1, &x2, 0x0, (arg1[0]), UINT64_C(0xffffffffffffffed));
  332|    544|  fiat_subborrowx_u64(&x3, &x4, x2, (arg1[1]), UINT64_C(0xffffffffffffffff));
  333|    544|  fiat_subborrowx_u64(&x5, &x6, x4, (arg1[2]), UINT64_C(0xffffffffffffffff));
  334|    544|  fiat_subborrowx_u64(&x7, &x8, x6, (arg1[3]), UINT64_C(0x7fffffffffffffff));
  335|    544|  fiat_cmovznz_u64(&x9, x8, x1, (arg1[0]));
  336|    544|  fiat_cmovznz_u64(&x10, x8, x3, (arg1[1]));
  337|    544|  fiat_cmovznz_u64(&x11, x8, x5, (arg1[2]));
  338|    544|  fiat_cmovznz_u64(&x12, x8, x7, (arg1[3]));
  339|    544|  fiat_subborrowx_u64(&x13, &x14, 0x0, x9, UINT64_C(0xffffffffffffffed));
  340|    544|  fiat_subborrowx_u64(&x15, &x16, x14, x10, UINT64_C(0xffffffffffffffff));
  341|    544|  fiat_subborrowx_u64(&x17, &x18, x16, x11, UINT64_C(0xffffffffffffffff));
  342|    544|  fiat_subborrowx_u64(&x19, &x20, x18, x12, UINT64_C(0x7fffffffffffffff));
  343|    544|  fiat_cmovznz_u64(&x21, x20, x13, x9);
  344|    544|  fiat_cmovznz_u64(&x22, x20, x15, x10);
  345|    544|  fiat_cmovznz_u64(&x23, x20, x17, x11);
  346|    544|  fiat_cmovznz_u64(&x24, x20, x19, x12);
  347|    544|  out1[0] = x21;
  348|    544|  out1[1] = x22;
  349|    544|  out1[2] = x23;
  350|    544|  out1[3] = x24;
  351|    544|}
curve25519_64_adx.c:table_select_4:
  590|  8.70k|                                  const signed char b) {
  591|  8.70k|  uint8_t bnegative = constant_time_msb_w(b);
  592|  8.70k|  uint8_t babs = b - ((bnegative & b) << 1);
  593|       |
  594|  8.70k|  uint8_t t_bytes[3][32] = {
  595|  8.70k|      {constant_time_is_zero_w(b) & 1}, {constant_time_is_zero_w(b) & 1}, {0}};
  596|  8.70k|#if defined(__clang__)
  597|  8.70k|  __asm__("" : "+m" (t_bytes) : /*no inputs*/);
  598|  8.70k|#endif
  599|  8.70k|  static_assert(sizeof(t_bytes) == sizeof(k25519Precomp[pos][0]), "");
  600|  78.3k|  for (int i = 0; i < 8; i++) {
  ------------------
  |  Branch (600:19): [True: 69.6k, False: 8.70k]
  ------------------
  601|  69.6k|    constant_time_conditional_memxor(t_bytes, k25519Precomp[pos][i],
  602|  69.6k|                                     sizeof(t_bytes),
  603|  69.6k|                                     constant_time_eq_w(babs, 1 + i));
  604|  69.6k|  }
  605|       |
  606|  8.70k|  static_assert(sizeof(t_bytes) == sizeof(ge_precomp_4), "");
  607|       |
  608|       |  // fe4 uses saturated 64-bit limbs, so converting from bytes is just a copy.
  609|  8.70k|  OPENSSL_memcpy(t, t_bytes, sizeof(ge_precomp_4));
  610|       |
  611|  8.70k|  fe4 xy2d_neg = {0};
  612|  8.70k|  fe4_sub(xy2d_neg, xy2d_neg, t->xy2d);
  613|  8.70k|  constant_time_conditional_memcpy(t->yplusx, t_bytes[1], sizeof(fe4),
  614|  8.70k|                                   bnegative);
  615|  8.70k|  constant_time_conditional_memcpy(t->yminusx, t_bytes[0], sizeof(fe4),
  616|  8.70k|                                   bnegative);
  617|  8.70k|  constant_time_conditional_memcpy(t->xy2d, xy2d_neg, sizeof(fe4), bnegative);
  618|  8.70k|}
curve25519_64_adx.c:ge_p3_add_p3_precomp_4:
  568|  8.70k|ge_p3_add_p3_precomp_4(ge_p3_4 *r, const ge_p3_4 *p, const ge_precomp_4 *q) {
  569|  8.70k|  fe4 A, B, C, YplusX, YminusX, D, X3, Y3, Z3, T3;
  570|       |  // Transcribed from a Coq function proven against affine coordinates.
  571|       |  // https://github.com/mit-plv/fiat-crypto/blob/a36568d1d73aff5d7accc79fd28be672882f9c17/src/Curves/Edwards/XYZT/Precomputed.v#L38-L56
  572|  8.70k|  fe4_add(YplusX, p->Y, p->X);
  573|  8.70k|  fe4_sub(YminusX, p->Y, p->X);
  574|  8.70k|  fe4_mul(A, YplusX, q->yplusx);
  575|  8.70k|  fe4_mul(B, YminusX, q->yminusx);
  576|  8.70k|  fe4_mul(C, q->xy2d, p->T);
  577|  8.70k|  fe4_add(D, p->Z, p->Z);
  578|  8.70k|  fe4_sub(X3, A, B);
  579|  8.70k|  fe4_add(Y3, A, B);
  580|  8.70k|  fe4_add(Z3, D, C);
  581|  8.70k|  fe4_sub(T3, D, C);
  582|  8.70k|  fe4_mul(r->X, X3, T3);
  583|  8.70k|  fe4_mul(r->Y, Y3, Z3);
  584|  8.70k|  fe4_mul(r->Z, Z3, T3);
  585|  8.70k|  fe4_mul(r->T, X3, Y3);
  586|  8.70k|}
curve25519_64_adx.c:inline_x25519_ge_dbl_4:
  544|    544|static void inline_x25519_ge_dbl_4(ge_p3_4 *r, const ge_p3_4 *p, bool skip_t) {
  545|       |  // Transcribed from a Coq function proven against affine coordinates.
  546|       |  // https://github.com/mit-plv/fiat-crypto/blob/9943ba9e7d8f3e1c0054b2c94a5edca46ea73ef8/src/Curves/Edwards/XYZT/Basic.v#L136-L165
  547|    544|  fe4 trX, trZ, trT, t0, cX, cY, cZ, cT;
  548|    544|  fe4_sq(trX, p->X);
  549|    544|  fe4_sq(trZ, p->Y);
  550|    544|  fe4_sq(trT, p->Z);
  551|    544|  fe4_add(trT, trT, trT);
  552|    544|  fe4_add(cY, p->X, p->Y);
  553|    544|  fe4_sq(t0, cY);
  554|    544|  fe4_add(cY, trZ, trX);
  555|    544|  fe4_sub(cZ, trZ, trX);
  556|    544|  fe4_sub(cX, t0, cY);
  557|    544|  fe4_sub(cT, trT, cZ);
  558|    544|  fe4_mul(r->X, cX, cT);
  559|    544|  fe4_mul(r->Y, cY, cZ);
  560|    544|  fe4_mul(r->Z, cZ, cT);
  561|    544|  if (!skip_t) {
  ------------------
  |  Branch (561:7): [True: 136, False: 408]
  ------------------
  562|    136|    fe4_mul(r->T, cX, cY);
  563|    136|  }
  564|    544|}

_Z17GetVariableIntLenmm:
   22|  27.7k|uint8_t GetVariableIntLen(uint64_t value, size_t base) {
   23|  27.7k|  uint8_t base_bits = log2(base);
   24|   209k|  for (uint8_t num_bits = (sizeof(value) - 1) * CHAR_BIT; num_bits >= base_bits;
  ------------------
  |  Branch (24:59): [True: 191k, False: 17.6k]
  ------------------
   25|   191k|       num_bits -= base_bits) {
   26|   191k|    if (value >> num_bits) {
  ------------------
  |  Branch (26:9): [True: 10.0k, False: 181k]
  ------------------
   27|  10.0k|      return ceil(static_cast<double>(num_bits) / base_bits) + 1;
   28|  10.0k|    }
   29|   191k|  }
   30|       |  // Special-case: zero requires one, not zero bytes.
   31|  17.6k|  return 1;
   32|  27.7k|}
_Z24InsertVariableIntBase128mmRNSt3__16vectorIhNS_9allocatorIhEEEE:
   36|  1.75k|                              std::vector<uint8_t>& der) {
   37|  1.75k|  std::vector<uint8_t> variable_int;
   38|  5.90k|  for (uint8_t i = GetVariableIntLen(value, 128) - 1; i != 0; --i) {
  ------------------
  |  Branch (38:55): [True: 4.15k, False: 1.75k]
  ------------------
   39|       |    // If it's not the last byte, the high bit is set to 1.
   40|  4.15k|    variable_int.push_back((0x01 << 7) | ((value >> (i * 7)) & 0x7F));
   41|  4.15k|  }
   42|  1.75k|  variable_int.push_back(value & 0x7F);
   43|  1.75k|  der.insert(der.begin() + pos, variable_int.begin(), variable_int.end());
   44|  1.75k|}
_Z24InsertVariableIntBase256mmRNSt3__16vectorIhNS_9allocatorIhEEEE:
   48|  19.9k|                              std::vector<uint8_t>& der) {
   49|  19.9k|  std::vector<uint8_t> variable_int;
   50|  45.1k|  for (uint8_t shift = GetVariableIntLen(value, 256); shift != 0; --shift) {
  ------------------
  |  Branch (50:55): [True: 25.1k, False: 19.9k]
  ------------------
   51|  25.1k|    variable_int.push_back((value >> ((shift - 1) * CHAR_BIT)) & 0xFF);
   52|  25.1k|  }
   53|  19.9k|  der.insert(der.begin() + pos, variable_int.begin(), variable_int.end());
   54|  19.9k|}

fuzz_pkcs8.cc:_ZL17TestOneProtoInputRKN8asn1_pdu3PDUE:
   29|  5.97k|DEFINE_PROTO_FUZZER(const asn1_pdu::PDU& asn1) {
   30|  5.97k|  asn1_pdu::ASN1PDUToDER converter;
   31|  5.97k|  std::vector<uint8_t> encoded = converter.PDUToDER(asn1);
   32|  5.97k|  const uint8_t* buf = encoded.data();
   33|  5.97k|  size_t len = encoded.size();
   34|       |
   35|  5.97k|  CBS cbs;
   36|  5.97k|  CBS_init(&cbs, buf, len);
   37|  5.97k|  bssl::UniquePtr<EVP_PKEY> pkey(EVP_parse_private_key(&cbs));
   38|  5.97k|  if (pkey == NULL) {
  ------------------
  |  Branch (38:7): [True: 5.00k, False: 978]
  ------------------
   39|  5.00k|    return;
   40|  5.00k|  }
   41|       |
   42|    978|  uint8_t* der;
   43|    978|  size_t der_len;
   44|    978|  bssl::ScopedCBB cbb;
   45|    978|  if (CBB_init(cbb.get(), 0) &&
  ------------------
  |  Branch (45:7): [True: 978, False: 0]
  ------------------
   46|    978|      EVP_marshal_private_key(cbb.get(), pkey.get()) &&
  ------------------
  |  Branch (46:7): [True: 978, False: 0]
  ------------------
   47|    978|      CBB_finish(cbb.get(), &der, &der_len)) {
  ------------------
  |  Branch (47:7): [True: 978, False: 0]
  ------------------
   48|    978|    OPENSSL_free(der);
   49|    978|  }
   50|    978|  ERR_clear_error();
   51|    978|}

_Z42descriptor_table_asn1_5fpdu_2eproto_getterv:
  280|      1|PROTOBUF_ATTRIBUTE_WEAK const ::_pbi::DescriptorTable* descriptor_table_asn1_5fpdu_2eproto_getter() {
  281|      1|  return &descriptor_table_asn1_5fpdu_2eproto;
  282|      1|}
_ZN8asn1_pdu3PDUC2EPN6google8protobuf5ArenaE:
  394|  29.8k|  : ::PROTOBUF_NAMESPACE_ID::Message(arena) {
  395|  29.8k|  SharedCtor(arena);
  396|       |  // @@protoc_insertion_point(arena_constructor:asn1_pdu.PDU)
  397|  29.8k|}
_ZN8asn1_pdu3PDUD2Ev:
  432|  29.8k|PDU::~PDU() {
  433|       |  // @@protoc_insertion_point(destructor:asn1_pdu.PDU)
  434|  29.8k|  if (auto *arena = _internal_metadata_.DeleteReturnArena<::PROTOBUF_NAMESPACE_ID::UnknownFieldSet>()) {
  ------------------
  |  Branch (434:13): [True: 0, False: 29.8k]
  ------------------
  435|      0|  (void)arena;
  436|      0|    return;
  437|      0|  }
  438|  29.8k|  SharedDtor();
  439|  29.8k|}
_ZN8asn1_pdu3PDU5ClearEv:
  452|  17.1k|void PDU::Clear() {
  453|       |// @@protoc_insertion_point(message_clear_start:asn1_pdu.PDU)
  454|  17.1k|  ::uint32_t cached_has_bits = 0;
  455|       |  // Prevent compiler warnings about cached_has_bits being unused
  456|  17.1k|  (void) cached_has_bits;
  457|       |
  458|  17.1k|  cached_has_bits = _impl_._has_bits_[0];
  459|  17.1k|  if (cached_has_bits & 0x00000007u) {
  ------------------
  |  Branch (459:7): [True: 4.25k, False: 12.8k]
  ------------------
  460|  4.25k|    if (cached_has_bits & 0x00000001u) {
  ------------------
  |  Branch (460:9): [True: 3.27k, False: 981]
  ------------------
  461|  3.27k|      ABSL_DCHECK(_impl_.id_ != nullptr);
  ------------------
  |  |   43|  3.27k|#define ABSL_DCHECK(condition) ABSL_DCHECK_IMPL((condition), #condition)
  |  |  ------------------
  |  |  |  |   43|  3.27k|  ABSL_CHECK_IMPL(true || (condition), "true")
  |  |  |  |  ------------------
  |  |  |  |  |  |   26|  3.27k|  ABSL_LOG_INTERNAL_CONDITION_FATAL(STATELESS,                        \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  157|  3.27k|  ABSL_LOG_INTERNAL_##type##_CONDITION(condition)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   27|  3.27k|                                    ABSL_PREDICT_FALSE(!(condition))) \
  |  |  |  |  |  |   28|  3.27k|  ABSL_LOG_INTERNAL_CHECK(condition_text).InternalStream()
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |   65|      0|  ::absl::log_internal::LogMessageFatal(__FILE__, __LINE__, failure_message)
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  462|  3.27k|      _impl_.id_->Clear();
  463|  3.27k|    }
  464|  4.25k|    if (cached_has_bits & 0x00000002u) {
  ------------------
  |  Branch (464:9): [True: 3.13k, False: 1.12k]
  ------------------
  465|  3.13k|      ABSL_DCHECK(_impl_.len_ != nullptr);
  ------------------
  |  |   43|  3.13k|#define ABSL_DCHECK(condition) ABSL_DCHECK_IMPL((condition), #condition)
  |  |  ------------------
  |  |  |  |   43|  3.13k|  ABSL_CHECK_IMPL(true || (condition), "true")
  |  |  |  |  ------------------
  |  |  |  |  |  |   26|  3.13k|  ABSL_LOG_INTERNAL_CONDITION_FATAL(STATELESS,                        \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  157|  3.13k|  ABSL_LOG_INTERNAL_##type##_CONDITION(condition)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   27|  3.13k|                                    ABSL_PREDICT_FALSE(!(condition))) \
  |  |  |  |  |  |   28|  3.13k|  ABSL_LOG_INTERNAL_CHECK(condition_text).InternalStream()
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |   65|      0|  ::absl::log_internal::LogMessageFatal(__FILE__, __LINE__, failure_message)
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  466|  3.13k|      _impl_.len_->Clear();
  467|  3.13k|    }
  468|  4.25k|    if (cached_has_bits & 0x00000004u) {
  ------------------
  |  Branch (468:9): [True: 2.89k, False: 1.36k]
  ------------------
  469|  2.89k|      ABSL_DCHECK(_impl_.val_ != nullptr);
  ------------------
  |  |   43|  2.89k|#define ABSL_DCHECK(condition) ABSL_DCHECK_IMPL((condition), #condition)
  |  |  ------------------
  |  |  |  |   43|  2.89k|  ABSL_CHECK_IMPL(true || (condition), "true")
  |  |  |  |  ------------------
  |  |  |  |  |  |   26|  2.89k|  ABSL_LOG_INTERNAL_CONDITION_FATAL(STATELESS,                        \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  157|  2.89k|  ABSL_LOG_INTERNAL_##type##_CONDITION(condition)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   27|  2.89k|                                    ABSL_PREDICT_FALSE(!(condition))) \
  |  |  |  |  |  |   28|  2.89k|  ABSL_LOG_INTERNAL_CHECK(condition_text).InternalStream()
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |   65|      0|  ::absl::log_internal::LogMessageFatal(__FILE__, __LINE__, failure_message)
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  470|  2.89k|      _impl_.val_->Clear();
  471|  2.89k|    }
  472|  4.25k|  }
  473|  17.1k|  _impl_._has_bits_.Clear();
  474|  17.1k|  _internal_metadata_.Clear<::PROTOBUF_NAMESPACE_ID::UnknownFieldSet>();
  475|  17.1k|}
_ZNK8asn1_pdu3PDU11GetMetadataEv:
  691|   414k|::PROTOBUF_NAMESPACE_ID::Metadata PDU::GetMetadata() const {
  692|   414k|  return ::_pbi::AssignDescriptors(
  693|   414k|      &descriptor_table_asn1_5fpdu_2eproto_getter, &descriptor_table_asn1_5fpdu_2eproto_once,
  694|   414k|      file_level_metadata_asn1_5fpdu_2eproto[0]);
  695|   414k|}
_ZN8asn1_pdu10IdentifierC2EPN6google8protobuf5ArenaE:
  723|  29.1k|  : ::PROTOBUF_NAMESPACE_ID::Message(arena) {
  724|  29.1k|  SharedCtor(arena);
  725|       |  // @@protoc_insertion_point(arena_constructor:asn1_pdu.Identifier)
  726|  29.1k|}
_ZN8asn1_pdu10IdentifierD2Ev:
  762|  29.1k|Identifier::~Identifier() {
  763|       |  // @@protoc_insertion_point(destructor:asn1_pdu.Identifier)
  764|  29.1k|  if (auto *arena = _internal_metadata_.DeleteReturnArena<::PROTOBUF_NAMESPACE_ID::UnknownFieldSet>()) {
  ------------------
  |  Branch (764:13): [True: 0, False: 29.1k]
  ------------------
  765|      0|  (void)arena;
  766|      0|    return;
  767|      0|  }
  768|  29.1k|  SharedDtor();
  769|  29.1k|}
_ZN8asn1_pdu10Identifier5ClearEv:
  780|  4.95k|void Identifier::Clear() {
  781|       |// @@protoc_insertion_point(message_clear_start:asn1_pdu.Identifier)
  782|  4.95k|  ::uint32_t cached_has_bits = 0;
  783|       |  // Prevent compiler warnings about cached_has_bits being unused
  784|  4.95k|  (void) cached_has_bits;
  785|       |
  786|  4.95k|  cached_has_bits = _impl_._has_bits_[0];
  787|  4.95k|  if (cached_has_bits & 0x00000001u) {
  ------------------
  |  Branch (787:7): [True: 1.45k, False: 3.49k]
  ------------------
  788|  1.45k|    ABSL_DCHECK(_impl_.tag_num_ != nullptr);
  ------------------
  |  |   43|  1.45k|#define ABSL_DCHECK(condition) ABSL_DCHECK_IMPL((condition), #condition)
  |  |  ------------------
  |  |  |  |   43|  1.45k|  ABSL_CHECK_IMPL(true || (condition), "true")
  |  |  |  |  ------------------
  |  |  |  |  |  |   26|  1.45k|  ABSL_LOG_INTERNAL_CONDITION_FATAL(STATELESS,                        \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  157|  1.45k|  ABSL_LOG_INTERNAL_##type##_CONDITION(condition)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   27|  1.45k|                                    ABSL_PREDICT_FALSE(!(condition))) \
  |  |  |  |  |  |   28|  1.45k|  ABSL_LOG_INTERNAL_CHECK(condition_text).InternalStream()
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |   65|      0|  ::absl::log_internal::LogMessageFatal(__FILE__, __LINE__, failure_message)
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  789|  1.45k|    _impl_.tag_num_->Clear();
  790|  1.45k|  }
  791|  4.95k|  if (cached_has_bits & 0x00000006u) {
  ------------------
  |  Branch (791:7): [True: 507, False: 4.44k]
  ------------------
  792|    507|    ::memset(&_impl_.encoding_, 0, static_cast<::size_t>(
  793|    507|        reinterpret_cast<char*>(&_impl_.id_class_) -
  794|    507|        reinterpret_cast<char*>(&_impl_.encoding_)) + sizeof(_impl_.id_class_));
  795|    507|  }
  796|  4.95k|  _impl_._has_bits_.Clear();
  797|  4.95k|  _internal_metadata_.Clear<::PROTOBUF_NAMESPACE_ID::UnknownFieldSet>();
  798|  4.95k|}
_ZNK8asn1_pdu10Identifier12GetClassDataEv:
  961|  2.51k|const ::PROTOBUF_NAMESPACE_ID::Message::ClassData*Identifier::GetClassData() const { return &_class_data_; }
_ZN8asn1_pdu10Identifier9MergeImplERN6google8protobuf7MessageERKS3_:
  964|    837|void Identifier::MergeImpl(::PROTOBUF_NAMESPACE_ID::Message& to_msg, const ::PROTOBUF_NAMESPACE_ID::Message& from_msg) {
  965|    837|  auto* const _this = static_cast<Identifier*>(&to_msg);
  966|    837|  auto& from = static_cast<const Identifier&>(from_msg);
  967|       |  // @@protoc_insertion_point(class_specific_merge_from_start:asn1_pdu.Identifier)
  968|    837|  ABSL_DCHECK_NE(&from, _this);
  ------------------
  |  |   72|    837|  ABSL_DCHECK_NE_IMPL((val1), #val1, (val2), #val2)
  |  |  ------------------
  |  |  |  |   88|    837|  ABSL_LOG_INTERNAL_DCHECK_NOP(val1, val2)
  |  |  |  |  ------------------
  |  |  |  |  |  |   56|    837|  while (false && ((void)(x), (void)(y), 0)) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (56:10): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (56:19): [True: 0, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   57|    837|  ::absl::log_internal::NullStream().InternalStream()
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  969|    837|  ::uint32_t cached_has_bits = 0;
  970|    837|  (void) cached_has_bits;
  971|       |
  972|    837|  cached_has_bits = from._impl_._has_bits_[0];
  973|    837|  if (cached_has_bits & 0x00000007u) {
  ------------------
  |  Branch (973:7): [True: 0, False: 837]
  ------------------
  974|      0|    if (cached_has_bits & 0x00000001u) {
  ------------------
  |  Branch (974:9): [True: 0, False: 0]
  ------------------
  975|      0|      _this->_internal_mutable_tag_num()->::asn1_pdu::TagNumber::MergeFrom(
  976|      0|          from._internal_tag_num());
  977|      0|    }
  978|      0|    if (cached_has_bits & 0x00000002u) {
  ------------------
  |  Branch (978:9): [True: 0, False: 0]
  ------------------
  979|      0|      _this->_impl_.encoding_ = from._impl_.encoding_;
  980|      0|    }
  981|      0|    if (cached_has_bits & 0x00000004u) {
  ------------------
  |  Branch (981:9): [True: 0, False: 0]
  ------------------
  982|      0|      _this->_impl_.id_class_ = from._impl_.id_class_;
  983|      0|    }
  984|      0|    _this->_impl_._has_bits_[0] |= cached_has_bits;
  985|      0|  }
  986|    837|  _this->_internal_metadata_.MergeFrom<::PROTOBUF_NAMESPACE_ID::UnknownFieldSet>(from._internal_metadata_);
  987|    837|}
_ZNK8asn1_pdu10Identifier11GetMetadataEv:
 1016|   371k|::PROTOBUF_NAMESPACE_ID::Metadata Identifier::GetMetadata() const {
 1017|   371k|  return ::_pbi::AssignDescriptors(
 1018|   371k|      &descriptor_table_asn1_5fpdu_2eproto_getter, &descriptor_table_asn1_5fpdu_2eproto_once,
 1019|   371k|      file_level_metadata_asn1_5fpdu_2eproto[1]);
 1020|   371k|}
_ZN8asn1_pdu9TagNumberC2EPN6google8protobuf5ArenaE:
 1040|  28.2k|  : ::PROTOBUF_NAMESPACE_ID::Message(arena) {
 1041|  28.2k|  SharedCtor(arena);
 1042|       |  // @@protoc_insertion_point(arena_constructor:asn1_pdu.TagNumber)
 1043|  28.2k|}
_ZN8asn1_pdu9TagNumberD2Ev:
 1063|  28.2k|TagNumber::~TagNumber() {
 1064|       |  // @@protoc_insertion_point(destructor:asn1_pdu.TagNumber)
 1065|  28.2k|  if (auto *arena = _internal_metadata_.DeleteReturnArena<::PROTOBUF_NAMESPACE_ID::UnknownFieldSet>()) {
  ------------------
  |  Branch (1065:13): [True: 0, False: 28.2k]
  ------------------
 1066|      0|  (void)arena;
 1067|      0|    return;
 1068|      0|  }
 1069|  28.2k|  SharedDtor();
 1070|  28.2k|}
_ZN8asn1_pdu9TagNumber5ClearEv:
 1080|  4.96k|void TagNumber::Clear() {
 1081|       |// @@protoc_insertion_point(message_clear_start:asn1_pdu.TagNumber)
 1082|  4.96k|  ::uint32_t cached_has_bits = 0;
 1083|       |  // Prevent compiler warnings about cached_has_bits being unused
 1084|  4.96k|  (void) cached_has_bits;
 1085|       |
 1086|  4.96k|  cached_has_bits = _impl_._has_bits_[0];
 1087|  4.96k|  if (cached_has_bits & 0x00000003u) {
  ------------------
  |  Branch (1087:7): [True: 759, False: 4.20k]
  ------------------
 1088|    759|    ::memset(&_impl_.high_tag_num_, 0, static_cast<::size_t>(
 1089|    759|        reinterpret_cast<char*>(&_impl_.low_tag_num_) -
 1090|    759|        reinterpret_cast<char*>(&_impl_.high_tag_num_)) + sizeof(_impl_.low_tag_num_));
 1091|    759|  }
 1092|  4.96k|  _impl_._has_bits_.Clear();
 1093|  4.96k|  _internal_metadata_.Clear<::PROTOBUF_NAMESPACE_ID::UnknownFieldSet>();
 1094|  4.96k|}
_ZNK8asn1_pdu9TagNumber12GetClassDataEv:
 1207|  5.26k|const ::PROTOBUF_NAMESPACE_ID::Message::ClassData*TagNumber::GetClassData() const { return &_class_data_; }
_ZN8asn1_pdu9TagNumber9MergeImplERN6google8protobuf7MessageERKS3_:
 1210|  1.75k|void TagNumber::MergeImpl(::PROTOBUF_NAMESPACE_ID::Message& to_msg, const ::PROTOBUF_NAMESPACE_ID::Message& from_msg) {
 1211|  1.75k|  auto* const _this = static_cast<TagNumber*>(&to_msg);
 1212|  1.75k|  auto& from = static_cast<const TagNumber&>(from_msg);
 1213|       |  // @@protoc_insertion_point(class_specific_merge_from_start:asn1_pdu.TagNumber)
 1214|  1.75k|  ABSL_DCHECK_NE(&from, _this);
  ------------------
  |  |   72|  1.75k|  ABSL_DCHECK_NE_IMPL((val1), #val1, (val2), #val2)
  |  |  ------------------
  |  |  |  |   88|  1.75k|  ABSL_LOG_INTERNAL_DCHECK_NOP(val1, val2)
  |  |  |  |  ------------------
  |  |  |  |  |  |   56|  1.75k|  while (false && ((void)(x), (void)(y), 0)) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (56:10): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (56:19): [True: 0, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   57|  1.75k|  ::absl::log_internal::NullStream().InternalStream()
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1215|  1.75k|  ::uint32_t cached_has_bits = 0;
 1216|  1.75k|  (void) cached_has_bits;
 1217|       |
 1218|  1.75k|  cached_has_bits = from._impl_._has_bits_[0];
 1219|  1.75k|  if (cached_has_bits & 0x00000003u) {
  ------------------
  |  Branch (1219:7): [True: 0, False: 1.75k]
  ------------------
 1220|      0|    if (cached_has_bits & 0x00000001u) {
  ------------------
  |  Branch (1220:9): [True: 0, False: 0]
  ------------------
 1221|      0|      _this->_impl_.high_tag_num_ = from._impl_.high_tag_num_;
 1222|      0|    }
 1223|      0|    if (cached_has_bits & 0x00000002u) {
  ------------------
  |  Branch (1223:9): [True: 0, False: 0]
  ------------------
 1224|      0|      _this->_impl_.low_tag_num_ = from._impl_.low_tag_num_;
 1225|      0|    }
 1226|      0|    _this->_impl_._has_bits_[0] |= cached_has_bits;
 1227|      0|  }
 1228|  1.75k|  _this->_internal_metadata_.MergeFrom<::PROTOBUF_NAMESPACE_ID::UnknownFieldSet>(from._internal_metadata_);
 1229|  1.75k|}
_ZNK8asn1_pdu9TagNumber11GetMetadataEv:
 1255|   224k|::PROTOBUF_NAMESPACE_ID::Metadata TagNumber::GetMetadata() const {
 1256|   224k|  return ::_pbi::AssignDescriptors(
 1257|   224k|      &descriptor_table_asn1_5fpdu_2eproto_getter, &descriptor_table_asn1_5fpdu_2eproto_once,
 1258|   224k|      file_level_metadata_asn1_5fpdu_2eproto[2]);
 1259|   224k|}
_ZN8asn1_pdu6LengthC2EPN6google8protobuf5ArenaE:
 1269|  29.0k|  : ::PROTOBUF_NAMESPACE_ID::Message(arena) {
 1270|  29.0k|  SharedCtor(arena);
 1271|       |  // @@protoc_insertion_point(arena_constructor:asn1_pdu.Length)
 1272|  29.0k|}
_ZN8asn1_pdu6LengthD2Ev:
 1309|  29.0k|Length::~Length() {
 1310|       |  // @@protoc_insertion_point(destructor:asn1_pdu.Length)
 1311|  29.0k|  if (auto *arena = _internal_metadata_.DeleteReturnArena<::PROTOBUF_NAMESPACE_ID::UnknownFieldSet>()) {
  ------------------
  |  Branch (1311:13): [True: 0, False: 29.0k]
  ------------------
 1312|      0|  (void)arena;
 1313|      0|    return;
 1314|      0|  }
 1315|  29.0k|  SharedDtor();
 1316|  29.0k|}
_ZN8asn1_pdu6Length11clear_typesEv:
 1329|  10.1k|void Length::clear_types() {
 1330|       |// @@protoc_insertion_point(one_of_clear_start:asn1_pdu.Length)
 1331|  10.1k|  switch (types_case()) {
  ------------------
  |  Branch (1331:11): [True: 0, False: 10.1k]
  ------------------
 1332|  2.22k|    case kIndefiniteForm: {
  ------------------
  |  Branch (1332:5): [True: 2.22k, False: 7.95k]
  ------------------
 1333|       |      // No need to clear
 1334|  2.22k|      break;
 1335|      0|    }
 1336|  4.22k|    case kLengthOverride: {
  ------------------
  |  Branch (1336:5): [True: 4.22k, False: 5.96k]
  ------------------
 1337|  4.22k|      _impl_.types_.length_override_.Destroy();
 1338|  4.22k|      break;
 1339|      0|    }
 1340|  3.73k|    case TYPES_NOT_SET: {
  ------------------
  |  Branch (1340:5): [True: 3.73k, False: 6.44k]
  ------------------
 1341|  3.73k|      break;
 1342|      0|    }
 1343|  10.1k|  }
 1344|  10.1k|  _impl_._oneof_case_[0] = TYPES_NOT_SET;
 1345|  10.1k|}
_ZN8asn1_pdu6Length5ClearEv:
 1348|  4.95k|void Length::Clear() {
 1349|       |// @@protoc_insertion_point(message_clear_start:asn1_pdu.Length)
 1350|  4.95k|  ::uint32_t cached_has_bits = 0;
 1351|       |  // Prevent compiler warnings about cached_has_bits being unused
 1352|  4.95k|  (void) cached_has_bits;
 1353|       |
 1354|  4.95k|  clear_types();
 1355|  4.95k|  _internal_metadata_.Clear<::PROTOBUF_NAMESPACE_ID::UnknownFieldSet>();
 1356|  4.95k|}
_ZNK8asn1_pdu6Length12GetClassDataEv:
 1465|  2.73k|const ::PROTOBUF_NAMESPACE_ID::Message::ClassData*Length::GetClassData() const { return &_class_data_; }
_ZN8asn1_pdu6Length9MergeImplERN6google8protobuf7MessageERKS3_:
 1468|    910|void Length::MergeImpl(::PROTOBUF_NAMESPACE_ID::Message& to_msg, const ::PROTOBUF_NAMESPACE_ID::Message& from_msg) {
 1469|    910|  auto* const _this = static_cast<Length*>(&to_msg);
 1470|    910|  auto& from = static_cast<const Length&>(from_msg);
 1471|       |  // @@protoc_insertion_point(class_specific_merge_from_start:asn1_pdu.Length)
 1472|    910|  ABSL_DCHECK_NE(&from, _this);
  ------------------
  |  |   72|    910|  ABSL_DCHECK_NE_IMPL((val1), #val1, (val2), #val2)
  |  |  ------------------
  |  |  |  |   88|    910|  ABSL_LOG_INTERNAL_DCHECK_NOP(val1, val2)
  |  |  |  |  ------------------
  |  |  |  |  |  |   56|    910|  while (false && ((void)(x), (void)(y), 0)) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (56:10): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (56:19): [True: 0, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   57|    910|  ::absl::log_internal::NullStream().InternalStream()
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1473|    910|  ::uint32_t cached_has_bits = 0;
 1474|    910|  (void) cached_has_bits;
 1475|       |
 1476|    910|  switch (from.types_case()) {
  ------------------
  |  Branch (1476:11): [True: 0, False: 910]
  ------------------
 1477|      0|    case kIndefiniteForm: {
  ------------------
  |  Branch (1477:5): [True: 0, False: 910]
  ------------------
 1478|      0|      _this->_internal_set_indefinite_form(from._internal_indefinite_form());
 1479|      0|      break;
 1480|      0|    }
 1481|      0|    case kLengthOverride: {
  ------------------
  |  Branch (1481:5): [True: 0, False: 910]
  ------------------
 1482|      0|      _this->_internal_set_length_override(from._internal_length_override());
 1483|      0|      break;
 1484|      0|    }
 1485|    910|    case TYPES_NOT_SET: {
  ------------------
  |  Branch (1485:5): [True: 910, False: 0]
  ------------------
 1486|    910|      break;
 1487|      0|    }
 1488|    910|  }
 1489|    910|  _this->_internal_metadata_.MergeFrom<::PROTOBUF_NAMESPACE_ID::UnknownFieldSet>(from._internal_metadata_);
 1490|    910|}
_ZNK8asn1_pdu6Length11GetMetadataEv:
 1510|   167k|::PROTOBUF_NAMESPACE_ID::Metadata Length::GetMetadata() const {
 1511|   167k|  return ::_pbi::AssignDescriptors(
 1512|   167k|      &descriptor_table_asn1_5fpdu_2eproto_getter, &descriptor_table_asn1_5fpdu_2eproto_once,
 1513|   167k|      file_level_metadata_asn1_5fpdu_2eproto[3]);
 1514|   167k|}
_ZN8asn1_pdu12ValueElementC2EPN6google8protobuf5ArenaE:
 1539|  51.2k|  : ::PROTOBUF_NAMESPACE_ID::Message(arena) {
 1540|  51.2k|  SharedCtor(arena);
 1541|       |  // @@protoc_insertion_point(arena_constructor:asn1_pdu.ValueElement)
 1542|  51.2k|}
_ZN8asn1_pdu12ValueElementD2Ev:
 1582|  51.2k|ValueElement::~ValueElement() {
 1583|       |  // @@protoc_insertion_point(destructor:asn1_pdu.ValueElement)
 1584|  51.2k|  if (auto *arena = _internal_metadata_.DeleteReturnArena<::PROTOBUF_NAMESPACE_ID::UnknownFieldSet>()) {
  ------------------
  |  Branch (1584:13): [True: 0, False: 51.2k]
  ------------------
 1585|      0|  (void)arena;
 1586|      0|    return;
 1587|      0|  }
 1588|  51.2k|  SharedDtor();
 1589|  51.2k|}
_ZN8asn1_pdu12ValueElement5ClearEv:
 1601|  6.80k|void ValueElement::Clear() {
 1602|       |// @@protoc_insertion_point(message_clear_start:asn1_pdu.ValueElement)
 1603|  6.80k|  ::uint32_t cached_has_bits = 0;
 1604|       |  // Prevent compiler warnings about cached_has_bits being unused
 1605|  6.80k|  (void) cached_has_bits;
 1606|       |
 1607|  6.80k|  cached_has_bits = _impl_._has_bits_[0];
 1608|  6.80k|  if (cached_has_bits & 0x00000003u) {
  ------------------
  |  Branch (1608:7): [True: 5.95k, False: 843]
  ------------------
 1609|  5.95k|    if (cached_has_bits & 0x00000001u) {
  ------------------
  |  Branch (1609:9): [True: 1.70k, False: 4.25k]
  ------------------
 1610|  1.70k|      _impl_.val_bits_.ClearNonDefaultToEmpty();
 1611|  1.70k|    }
 1612|  5.95k|    if (cached_has_bits & 0x00000002u) {
  ------------------
  |  Branch (1612:9): [True: 4.64k, False: 1.31k]
  ------------------
 1613|  4.64k|      ABSL_DCHECK(_impl_.pdu_ != nullptr);
  ------------------
  |  |   43|  4.64k|#define ABSL_DCHECK(condition) ABSL_DCHECK_IMPL((condition), #condition)
  |  |  ------------------
  |  |  |  |   43|  4.64k|  ABSL_CHECK_IMPL(true || (condition), "true")
  |  |  |  |  ------------------
  |  |  |  |  |  |   26|  4.64k|  ABSL_LOG_INTERNAL_CONDITION_FATAL(STATELESS,                        \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  157|  4.64k|  ABSL_LOG_INTERNAL_##type##_CONDITION(condition)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   27|  4.64k|                                    ABSL_PREDICT_FALSE(!(condition))) \
  |  |  |  |  |  |   28|  4.64k|  ABSL_LOG_INTERNAL_CHECK(condition_text).InternalStream()
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |   65|      0|  ::absl::log_internal::LogMessageFatal(__FILE__, __LINE__, failure_message)
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1614|  4.64k|      _impl_.pdu_->Clear();
 1615|  4.64k|    }
 1616|  5.95k|  }
 1617|  6.80k|  _impl_._has_bits_.Clear();
 1618|  6.80k|  _internal_metadata_.Clear<::PROTOBUF_NAMESPACE_ID::UnknownFieldSet>();
 1619|  6.80k|}
_ZNK8asn1_pdu12ValueElement11GetMetadataEv:
 1777|   473k|::PROTOBUF_NAMESPACE_ID::Metadata ValueElement::GetMetadata() const {
 1778|   473k|  return ::_pbi::AssignDescriptors(
 1779|   473k|      &descriptor_table_asn1_5fpdu_2eproto_getter, &descriptor_table_asn1_5fpdu_2eproto_once,
 1780|   473k|      file_level_metadata_asn1_5fpdu_2eproto[4]);
 1781|   473k|}
_ZN8asn1_pdu5ValueC2EPN6google8protobuf5ArenaE:
 1789|  28.9k|  : ::PROTOBUF_NAMESPACE_ID::Message(arena) {
 1790|  28.9k|  SharedCtor(arena);
 1791|       |  // @@protoc_insertion_point(arena_constructor:asn1_pdu.Value)
 1792|  28.9k|}
_ZN8asn1_pdu5ValueD2Ev:
 1812|  28.9k|Value::~Value() {
 1813|       |  // @@protoc_insertion_point(destructor:asn1_pdu.Value)
 1814|  28.9k|  if (auto *arena = _internal_metadata_.DeleteReturnArena<::PROTOBUF_NAMESPACE_ID::UnknownFieldSet>()) {
  ------------------
  |  Branch (1814:13): [True: 0, False: 28.9k]
  ------------------
 1815|      0|  (void)arena;
 1816|      0|    return;
 1817|      0|  }
 1818|  28.9k|  SharedDtor();
 1819|  28.9k|}
_ZN8asn1_pdu5Value5ClearEv:
 1830|  5.02k|void Value::Clear() {
 1831|       |// @@protoc_insertion_point(message_clear_start:asn1_pdu.Value)
 1832|  5.02k|  ::uint32_t cached_has_bits = 0;
 1833|       |  // Prevent compiler warnings about cached_has_bits being unused
 1834|  5.02k|  (void) cached_has_bits;
 1835|       |
 1836|  5.02k|  _impl_.val_array_.Clear();
 1837|  5.02k|  _internal_metadata_.Clear<::PROTOBUF_NAMESPACE_ID::UnknownFieldSet>();
 1838|  5.02k|}
_ZNK8asn1_pdu5Value12GetClassDataEv:
 1927|  3.18k|const ::PROTOBUF_NAMESPACE_ID::Message::ClassData*Value::GetClassData() const { return &_class_data_; }
_ZN8asn1_pdu5Value9MergeImplERN6google8protobuf7MessageERKS3_:
 1930|  1.06k|void Value::MergeImpl(::PROTOBUF_NAMESPACE_ID::Message& to_msg, const ::PROTOBUF_NAMESPACE_ID::Message& from_msg) {
 1931|  1.06k|  auto* const _this = static_cast<Value*>(&to_msg);
 1932|  1.06k|  auto& from = static_cast<const Value&>(from_msg);
 1933|       |  // @@protoc_insertion_point(class_specific_merge_from_start:asn1_pdu.Value)
 1934|  1.06k|  ABSL_DCHECK_NE(&from, _this);
  ------------------
  |  |   72|  1.06k|  ABSL_DCHECK_NE_IMPL((val1), #val1, (val2), #val2)
  |  |  ------------------
  |  |  |  |   88|  1.06k|  ABSL_LOG_INTERNAL_DCHECK_NOP(val1, val2)
  |  |  |  |  ------------------
  |  |  |  |  |  |   56|  1.06k|  while (false && ((void)(x), (void)(y), 0)) \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  Branch (56:10): [Folded - Ignored]
  |  |  |  |  |  |  |  Branch (56:19): [True: 0, False: 0]
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   57|  1.06k|  ::absl::log_internal::NullStream().InternalStream()
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1935|  1.06k|  ::uint32_t cached_has_bits = 0;
 1936|  1.06k|  (void) cached_has_bits;
 1937|       |
 1938|  1.06k|  _this->_impl_.val_array_.MergeFrom(from._impl_.val_array_);
 1939|  1.06k|  _this->_internal_metadata_.MergeFrom<::PROTOBUF_NAMESPACE_ID::UnknownFieldSet>(from._internal_metadata_);
 1940|  1.06k|}
_ZNK8asn1_pdu5Value11GetMetadataEv:
 1961|   301k|::PROTOBUF_NAMESPACE_ID::Metadata Value::GetMetadata() const {
 1962|   301k|  return ::_pbi::AssignDescriptors(
 1963|   301k|      &descriptor_table_asn1_5fpdu_2eproto_getter, &descriptor_table_asn1_5fpdu_2eproto_once,
 1964|   301k|      file_level_metadata_asn1_5fpdu_2eproto[5]);
 1965|   301k|}
_ZN6google8protobuf5Arena18CreateMaybeMessageIN8asn1_pdu3PDUEJEEEPT_PS1_DpOT0_:
 1970|  23.6k|Arena::CreateMaybeMessage< ::asn1_pdu::PDU >(Arena* arena) {
 1971|  23.6k|  return Arena::CreateMessageInternal< ::asn1_pdu::PDU >(arena);
 1972|  23.6k|}
_ZN6google8protobuf5Arena18CreateMaybeMessageIN8asn1_pdu10IdentifierEJEEEPT_PS1_DpOT0_:
 1974|  29.1k|Arena::CreateMaybeMessage< ::asn1_pdu::Identifier >(Arena* arena) {
 1975|  29.1k|  return Arena::CreateMessageInternal< ::asn1_pdu::Identifier >(arena);
 1976|  29.1k|}
_ZN6google8protobuf5Arena18CreateMaybeMessageIN8asn1_pdu9TagNumberEJEEEPT_PS1_DpOT0_:
 1978|  28.2k|Arena::CreateMaybeMessage< ::asn1_pdu::TagNumber >(Arena* arena) {
 1979|  28.2k|  return Arena::CreateMessageInternal< ::asn1_pdu::TagNumber >(arena);
 1980|  28.2k|}
_ZN6google8protobuf5Arena18CreateMaybeMessageIN8asn1_pdu6LengthEJEEEPT_PS1_DpOT0_:
 1982|  29.0k|Arena::CreateMaybeMessage< ::asn1_pdu::Length >(Arena* arena) {
 1983|  29.0k|  return Arena::CreateMessageInternal< ::asn1_pdu::Length >(arena);
 1984|  29.0k|}
_ZN6google8protobuf5Arena18CreateMaybeMessageIN8asn1_pdu12ValueElementEJEEEPT_PS1_DpOT0_:
 1986|  51.2k|Arena::CreateMaybeMessage< ::asn1_pdu::ValueElement >(Arena* arena) {
 1987|  51.2k|  return Arena::CreateMessageInternal< ::asn1_pdu::ValueElement >(arena);
 1988|  51.2k|}
_ZN6google8protobuf5Arena18CreateMaybeMessageIN8asn1_pdu5ValueEJEEEPT_PS1_DpOT0_:
 1990|  28.9k|Arena::CreateMaybeMessage< ::asn1_pdu::Value >(Arena* arena) {
 1991|  28.9k|  return Arena::CreateMessageInternal< ::asn1_pdu::Value >(arena);
 1992|  28.9k|}
_ZN8asn1_pdu3PDU10SharedCtorEPN6google8protobuf5ArenaE:
  421|  29.8k|inline void PDU::SharedCtor(::_pb::Arena* arena) {
  422|  29.8k|  (void)arena;
  423|  29.8k|  new (&_impl_) Impl_{
  424|  29.8k|      decltype(_impl_._has_bits_){}
  425|  29.8k|    , /*decltype(_impl_._cached_size_)*/{}
  426|  29.8k|    , decltype(_impl_.id_){nullptr}
  427|  29.8k|    , decltype(_impl_.len_){nullptr}
  428|  29.8k|    , decltype(_impl_.val_){nullptr}
  429|  29.8k|  };
  430|  29.8k|}
_ZN8asn1_pdu3PDU10SharedDtorEv:
  441|  29.8k|inline void PDU::SharedDtor() {
  442|  29.8k|  ABSL_DCHECK(GetArenaForAllocation() == nullptr);
  ------------------
  |  |   43|  29.8k|#define ABSL_DCHECK(condition) ABSL_DCHECK_IMPL((condition), #condition)
  |  |  ------------------
  |  |  |  |   43|  29.8k|  ABSL_CHECK_IMPL(true || (condition), "true")
  |  |  |  |  ------------------
  |  |  |  |  |  |   26|  29.8k|  ABSL_LOG_INTERNAL_CONDITION_FATAL(STATELESS,                        \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  157|  29.8k|  ABSL_LOG_INTERNAL_##type##_CONDITION(condition)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   27|  29.8k|                                    ABSL_PREDICT_FALSE(!(condition))) \
  |  |  |  |  |  |   28|  29.8k|  ABSL_LOG_INTERNAL_CHECK(condition_text).InternalStream()
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |   65|      0|  ::absl::log_internal::LogMessageFatal(__FILE__, __LINE__, failure_message)
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  443|  29.8k|  if (this != internal_default_instance()) delete _impl_.id_;
  ------------------
  |  Branch (443:7): [True: 29.8k, False: 0]
  ------------------
  444|  29.8k|  if (this != internal_default_instance()) delete _impl_.len_;
  ------------------
  |  Branch (444:7): [True: 29.8k, False: 0]
  ------------------
  445|  29.8k|  if (this != internal_default_instance()) delete _impl_.val_;
  ------------------
  |  Branch (445:7): [True: 29.8k, False: 0]
  ------------------
  446|  29.8k|}
_ZN8asn1_pdu10Identifier10SharedCtorEPN6google8protobuf5ArenaE:
  749|  29.1k|inline void Identifier::SharedCtor(::_pb::Arena* arena) {
  750|  29.1k|  (void)arena;
  751|  29.1k|  new (&_impl_) Impl_{
  752|  29.1k|      decltype(_impl_._has_bits_){}
  753|  29.1k|    , /*decltype(_impl_._cached_size_)*/{}
  754|  29.1k|    , decltype(_impl_.tag_num_){nullptr}
  755|  29.1k|    , decltype(_impl_.encoding_) { 0 }
  756|       |
  757|  29.1k|    , decltype(_impl_.id_class_) { 0 }
  758|       |
  759|  29.1k|  };
  760|  29.1k|}
_ZN8asn1_pdu10Identifier10SharedDtorEv:
  771|  29.1k|inline void Identifier::SharedDtor() {
  772|  29.1k|  ABSL_DCHECK(GetArenaForAllocation() == nullptr);
  ------------------
  |  |   43|  29.1k|#define ABSL_DCHECK(condition) ABSL_DCHECK_IMPL((condition), #condition)
  |  |  ------------------
  |  |  |  |   43|  29.1k|  ABSL_CHECK_IMPL(true || (condition), "true")
  |  |  |  |  ------------------
  |  |  |  |  |  |   26|  29.1k|  ABSL_LOG_INTERNAL_CONDITION_FATAL(STATELESS,                        \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  157|  29.1k|  ABSL_LOG_INTERNAL_##type##_CONDITION(condition)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   27|  29.1k|                                    ABSL_PREDICT_FALSE(!(condition))) \
  |  |  |  |  |  |   28|  29.1k|  ABSL_LOG_INTERNAL_CHECK(condition_text).InternalStream()
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |   65|      0|  ::absl::log_internal::LogMessageFatal(__FILE__, __LINE__, failure_message)
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  773|  29.1k|  if (this != internal_default_instance()) delete _impl_.tag_num_;
  ------------------
  |  Branch (773:7): [True: 29.1k, False: 0]
  ------------------
  774|  29.1k|}
_ZN8asn1_pdu9TagNumber10SharedCtorEPN6google8protobuf5ArenaE:
 1051|  28.2k|inline void TagNumber::SharedCtor(::_pb::Arena* arena) {
 1052|  28.2k|  (void)arena;
 1053|  28.2k|  new (&_impl_) Impl_{
 1054|  28.2k|      decltype(_impl_._has_bits_){}
 1055|  28.2k|    , /*decltype(_impl_._cached_size_)*/{}
 1056|  28.2k|    , decltype(_impl_.high_tag_num_) { 0u }
 1057|       |
 1058|  28.2k|    , decltype(_impl_.low_tag_num_) { 0 }
 1059|       |
 1060|  28.2k|  };
 1061|  28.2k|}
_ZN8asn1_pdu9TagNumber10SharedDtorEv:
 1072|  28.2k|inline void TagNumber::SharedDtor() {
 1073|  28.2k|  ABSL_DCHECK(GetArenaForAllocation() == nullptr);
  ------------------
  |  |   43|  28.2k|#define ABSL_DCHECK(condition) ABSL_DCHECK_IMPL((condition), #condition)
  |  |  ------------------
  |  |  |  |   43|  28.2k|  ABSL_CHECK_IMPL(true || (condition), "true")
  |  |  |  |  ------------------
  |  |  |  |  |  |   26|  28.2k|  ABSL_LOG_INTERNAL_CONDITION_FATAL(STATELESS,                        \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  157|  28.2k|  ABSL_LOG_INTERNAL_##type##_CONDITION(condition)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   27|  28.2k|                                    ABSL_PREDICT_FALSE(!(condition))) \
  |  |  |  |  |  |   28|  28.2k|  ABSL_LOG_INTERNAL_CHECK(condition_text).InternalStream()
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |   65|      0|  ::absl::log_internal::LogMessageFatal(__FILE__, __LINE__, failure_message)
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1074|  28.2k|}
_ZN8asn1_pdu6Length10SharedCtorEPN6google8protobuf5ArenaE:
 1299|  29.0k|inline void Length::SharedCtor(::_pb::Arena* arena) {
 1300|  29.0k|  (void)arena;
 1301|  29.0k|  new (&_impl_) Impl_{
 1302|  29.0k|      decltype(_impl_.types_){}
 1303|  29.0k|    , /*decltype(_impl_._cached_size_)*/{}
 1304|  29.0k|    , /*decltype(_impl_._oneof_case_)*/{}
 1305|  29.0k|  };
 1306|  29.0k|  clear_has_types();
 1307|  29.0k|}
_ZN8asn1_pdu6Length10SharedDtorEv:
 1318|  29.0k|inline void Length::SharedDtor() {
 1319|  29.0k|  ABSL_DCHECK(GetArenaForAllocation() == nullptr);
  ------------------
  |  |   43|  29.0k|#define ABSL_DCHECK(condition) ABSL_DCHECK_IMPL((condition), #condition)
  |  |  ------------------
  |  |  |  |   43|  29.0k|  ABSL_CHECK_IMPL(true || (condition), "true")
  |  |  |  |  ------------------
  |  |  |  |  |  |   26|  29.0k|  ABSL_LOG_INTERNAL_CONDITION_FATAL(STATELESS,                        \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  157|  29.0k|  ABSL_LOG_INTERNAL_##type##_CONDITION(condition)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   27|  29.0k|                                    ABSL_PREDICT_FALSE(!(condition))) \
  |  |  |  |  |  |   28|  29.0k|  ABSL_LOG_INTERNAL_CHECK(condition_text).InternalStream()
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |   65|      0|  ::absl::log_internal::LogMessageFatal(__FILE__, __LINE__, failure_message)
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1320|  29.0k|  if (has_types()) {
  ------------------
  |  Branch (1320:7): [True: 5.23k, False: 23.8k]
  ------------------
 1321|  5.23k|    clear_types();
 1322|  5.23k|  }
 1323|  29.0k|}
_ZN8asn1_pdu12ValueElement10SharedCtorEPN6google8protobuf5ArenaE:
 1567|  51.2k|inline void ValueElement::SharedCtor(::_pb::Arena* arena) {
 1568|  51.2k|  (void)arena;
 1569|  51.2k|  new (&_impl_) Impl_{
 1570|  51.2k|      decltype(_impl_._has_bits_){}
 1571|  51.2k|    , /*decltype(_impl_._cached_size_)*/{}
 1572|  51.2k|    , decltype(_impl_.val_bits_) {}
 1573|       |
 1574|  51.2k|    , decltype(_impl_.pdu_){nullptr}
 1575|  51.2k|  };
 1576|  51.2k|  _impl_.val_bits_.InitDefault();
 1577|       |  #ifdef PROTOBUF_FORCE_COPY_DEFAULT_STRING
 1578|       |        _impl_.val_bits_.Set("", GetArenaForAllocation());
 1579|       |  #endif  // PROTOBUF_FORCE_COPY_DEFAULT_STRING
 1580|  51.2k|}
_ZN8asn1_pdu12ValueElement10SharedDtorEv:
 1591|  51.2k|inline void ValueElement::SharedDtor() {
 1592|  51.2k|  ABSL_DCHECK(GetArenaForAllocation() == nullptr);
  ------------------
  |  |   43|  51.2k|#define ABSL_DCHECK(condition) ABSL_DCHECK_IMPL((condition), #condition)
  |  |  ------------------
  |  |  |  |   43|  51.2k|  ABSL_CHECK_IMPL(true || (condition), "true")
  |  |  |  |  ------------------
  |  |  |  |  |  |   26|  51.2k|  ABSL_LOG_INTERNAL_CONDITION_FATAL(STATELESS,                        \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  157|  51.2k|  ABSL_LOG_INTERNAL_##type##_CONDITION(condition)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   27|  51.2k|                                    ABSL_PREDICT_FALSE(!(condition))) \
  |  |  |  |  |  |   28|  51.2k|  ABSL_LOG_INTERNAL_CHECK(condition_text).InternalStream()
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |   65|      0|  ::absl::log_internal::LogMessageFatal(__FILE__, __LINE__, failure_message)
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1593|  51.2k|  _impl_.val_bits_.Destroy();
 1594|  51.2k|  if (this != internal_default_instance()) delete _impl_.pdu_;
  ------------------
  |  Branch (1594:7): [True: 51.2k, False: 0]
  ------------------
 1595|  51.2k|}
_ZN8asn1_pdu5Value10SharedCtorEPN6google8protobuf5ArenaE:
 1804|  28.9k|inline void Value::SharedCtor(::_pb::Arena* arena) {
 1805|  28.9k|  (void)arena;
 1806|  28.9k|  new (&_impl_) Impl_{
 1807|  28.9k|      decltype(_impl_.val_array_){arena}
 1808|  28.9k|    , /*decltype(_impl_._cached_size_)*/{}
 1809|  28.9k|  };
 1810|  28.9k|}
_ZN8asn1_pdu5Value10SharedDtorEv:
 1821|  28.9k|inline void Value::SharedDtor() {
 1822|  28.9k|  ABSL_DCHECK(GetArenaForAllocation() == nullptr);
  ------------------
  |  |   43|  28.9k|#define ABSL_DCHECK(condition) ABSL_DCHECK_IMPL((condition), #condition)
  |  |  ------------------
  |  |  |  |   43|  28.9k|  ABSL_CHECK_IMPL(true || (condition), "true")
  |  |  |  |  ------------------
  |  |  |  |  |  |   26|  28.9k|  ABSL_LOG_INTERNAL_CONDITION_FATAL(STATELESS,                        \
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  157|  28.9k|  ABSL_LOG_INTERNAL_##type##_CONDITION(condition)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |   27|  28.9k|                                    ABSL_PREDICT_FALSE(!(condition))) \
  |  |  |  |  |  |   28|  28.9k|  ABSL_LOG_INTERNAL_CHECK(condition_text).InternalStream()
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |   65|      0|  ::absl::log_internal::LogMessageFatal(__FILE__, __LINE__, failure_message)
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
 1823|  28.9k|  _impl_.val_array_.~RepeatedPtrField();
 1824|  28.9k|}

_ZN8asn1_pdu3PDUC2Ev:
  214|  6.14k|  inline PDU() : PDU(nullptr) {}
_ZN8asn1_pdu3PDU25internal_default_instanceEv:
  261|  89.4k|  static inline const PDU* internal_default_instance() {
  262|  89.4k|    return reinterpret_cast<const PDU*>(
  263|  89.4k|               &_PDU_default_instance_);
  264|  89.4k|  }
_ZNK8asn1_pdu3PDU3NewEPN6google8protobuf5ArenaE:
  292|  23.6k|  PDU* New(::PROTOBUF_NAMESPACE_ID::Arena* arena = nullptr) const final {
  293|  23.6k|    return CreateMaybeMessage<PDU>(arena);
  294|  23.6k|  }
_ZN8asn1_pdu10Identifier25internal_default_instanceEv:
  455|  29.1k|  static inline const Identifier* internal_default_instance() {
  456|  29.1k|    return reinterpret_cast<const Identifier*>(
  457|  29.1k|               &_Identifier_default_instance_);
  458|  29.1k|  }
_ZNK8asn1_pdu10Identifier3NewEPN6google8protobuf5ArenaE:
  486|  29.1k|  Identifier* New(::PROTOBUF_NAMESPACE_ID::Arena* arena = nullptr) const final {
  487|  29.1k|    return CreateMaybeMessage<Identifier>(arena);
  488|  29.1k|  }
_ZNK8asn1_pdu9TagNumber3NewEPN6google8protobuf5ArenaE:
  674|  28.2k|  TagNumber* New(::PROTOBUF_NAMESPACE_ID::Arena* arena = nullptr) const final {
  675|  28.2k|    return CreateMaybeMessage<TagNumber>(arena);
  676|  28.2k|  }
_ZNK8asn1_pdu6Length3NewEPN6google8protobuf5ArenaE:
  849|  29.0k|  Length* New(::PROTOBUF_NAMESPACE_ID::Arena* arena = nullptr) const final {
  850|  29.0k|    return CreateMaybeMessage<Length>(arena);
  851|  29.0k|  }
_ZN8asn1_pdu6Length5Impl_10TypesUnionC2Ev:
  946|  29.0k|      constexpr TypesUnion() : _constinit_{} {}
_ZN8asn1_pdu12ValueElement25internal_default_instanceEv:
 1009|  51.2k|  static inline const ValueElement* internal_default_instance() {
 1010|  51.2k|    return reinterpret_cast<const ValueElement*>(
 1011|  51.2k|               &_ValueElement_default_instance_);
 1012|  51.2k|  }
_ZNK8asn1_pdu12ValueElement3NewEPN6google8protobuf5ArenaE:
 1040|  51.2k|  ValueElement* New(::PROTOBUF_NAMESPACE_ID::Arena* arena = nullptr) const final {
 1041|  51.2k|    return CreateMaybeMessage<ValueElement>(arena);
 1042|  51.2k|  }
_ZNK8asn1_pdu5Value3NewEPN6google8protobuf5ArenaE:
 1222|  28.9k|  Value* New(::PROTOBUF_NAMESPACE_ID::Arena* arena = nullptr) const final {
 1223|  28.9k|    return CreateMaybeMessage<Value>(arena);
 1224|  28.9k|  }
_ZNK8asn1_pdu3PDU12_internal_idEv:
 1329|  25.0k|inline const ::asn1_pdu::Identifier& PDU::_internal_id() const {
 1330|  25.0k|  const ::asn1_pdu::Identifier* p = _impl_.id_;
 1331|  25.0k|  return p != nullptr ? *p : reinterpret_cast<const ::asn1_pdu::Identifier&>(
  ------------------
  |  Branch (1331:10): [True: 25.0k, False: 0]
  ------------------
 1332|      0|      ::asn1_pdu::_Identifier_default_instance_);
 1333|  25.0k|}
_ZNK8asn1_pdu3PDU2idEv:
 1334|  25.0k|inline const ::asn1_pdu::Identifier& PDU::id() const {
 1335|       |  // @@protoc_insertion_point(field_get:asn1_pdu.PDU.id)
 1336|  25.0k|  return _internal_id();
 1337|  25.0k|}
_ZNK8asn1_pdu3PDU13_internal_lenEv:
 1416|  25.0k|inline const ::asn1_pdu::Length& PDU::_internal_len() const {
 1417|  25.0k|  const ::asn1_pdu::Length* p = _impl_.len_;
 1418|  25.0k|  return p != nullptr ? *p : reinterpret_cast<const ::asn1_pdu::Length&>(
  ------------------
  |  Branch (1418:10): [True: 25.0k, False: 0]
  ------------------
 1419|      0|      ::asn1_pdu::_Length_default_instance_);
 1420|  25.0k|}
_ZNK8asn1_pdu3PDU3lenEv:
 1421|  25.0k|inline const ::asn1_pdu::Length& PDU::len() const {
 1422|       |  // @@protoc_insertion_point(field_get:asn1_pdu.PDU.len)
 1423|  25.0k|  return _internal_len();
 1424|  25.0k|}
_ZNK8asn1_pdu3PDU13_internal_valEv:
 1503|  25.0k|inline const ::asn1_pdu::Value& PDU::_internal_val() const {
 1504|  25.0k|  const ::asn1_pdu::Value* p = _impl_.val_;
 1505|  25.0k|  return p != nullptr ? *p : reinterpret_cast<const ::asn1_pdu::Value&>(
  ------------------
  |  Branch (1505:10): [True: 25.0k, False: 0]
  ------------------
 1506|      0|      ::asn1_pdu::_Value_default_instance_);
 1507|  25.0k|}
_ZNK8asn1_pdu3PDU3valEv:
 1508|  25.0k|inline const ::asn1_pdu::Value& PDU::val() const {
 1509|       |  // @@protoc_insertion_point(field_get:asn1_pdu.PDU.val)
 1510|  25.0k|  return _internal_val();
 1511|  25.0k|}
_ZNK8asn1_pdu10Identifier8id_classEv:
 1593|  25.0k|inline ::asn1_pdu::Class Identifier::id_class() const {
 1594|       |  // @@protoc_insertion_point(field_get:asn1_pdu.Identifier.id_class)
 1595|  25.0k|  return _internal_id_class();
 1596|  25.0k|}
_ZNK8asn1_pdu10Identifier18_internal_id_classEv:
 1601|  25.0k|inline ::asn1_pdu::Class Identifier::_internal_id_class() const {
 1602|  25.0k|  return static_cast<::asn1_pdu::Class>(_impl_.id_class_);
 1603|  25.0k|}
_ZNK8asn1_pdu10Identifier8encodingEv:
 1619|  25.0k|inline ::asn1_pdu::Encoding Identifier::encoding() const {
 1620|       |  // @@protoc_insertion_point(field_get:asn1_pdu.Identifier.encoding)
 1621|  25.0k|  return _internal_encoding();
 1622|  25.0k|}
_ZNK8asn1_pdu10Identifier18_internal_encodingEv:
 1627|  25.0k|inline ::asn1_pdu::Encoding Identifier::_internal_encoding() const {
 1628|  25.0k|  return static_cast<::asn1_pdu::Encoding>(_impl_.encoding_);
 1629|  25.0k|}
_ZNK8asn1_pdu10Identifier17_internal_tag_numEv:
 1646|  50.0k|inline const ::asn1_pdu::TagNumber& Identifier::_internal_tag_num() const {
 1647|  50.0k|  const ::asn1_pdu::TagNumber* p = _impl_.tag_num_;
 1648|  50.0k|  return p != nullptr ? *p : reinterpret_cast<const ::asn1_pdu::TagNumber&>(
  ------------------
  |  Branch (1648:10): [True: 50.0k, False: 0]
  ------------------
 1649|      0|      ::asn1_pdu::_TagNumber_default_instance_);
 1650|  50.0k|}
_ZNK8asn1_pdu10Identifier7tag_numEv:
 1651|  50.0k|inline const ::asn1_pdu::TagNumber& Identifier::tag_num() const {
 1652|       |  // @@protoc_insertion_point(field_get:asn1_pdu.Identifier.tag_num)
 1653|  50.0k|  return _internal_tag_num();
 1654|  50.0k|}
_ZNK8asn1_pdu9TagNumber16has_high_tag_numEv:
 1728|  25.0k|inline bool TagNumber::has_high_tag_num() const {
 1729|  25.0k|  bool value = (_impl_._has_bits_[0] & 0x00000001u) != 0;
 1730|  25.0k|  return value;
 1731|  25.0k|}
_ZNK8asn1_pdu9TagNumber12high_tag_numEv:
 1736|  1.88k|inline ::uint32_t TagNumber::high_tag_num() const {
 1737|       |  // @@protoc_insertion_point(field_get:asn1_pdu.TagNumber.high_tag_num)
 1738|  1.88k|  return _internal_high_tag_num();
 1739|  1.88k|}
_ZNK8asn1_pdu9TagNumber22_internal_high_tag_numEv:
 1744|  1.88k|inline ::uint32_t TagNumber::_internal_high_tag_num() const {
 1745|  1.88k|  return _impl_.high_tag_num_;
 1746|  1.88k|}
_ZNK8asn1_pdu9TagNumber11low_tag_numEv:
 1761|  23.1k|inline ::asn1_pdu::LowTagNumber TagNumber::low_tag_num() const {
 1762|       |  // @@protoc_insertion_point(field_get:asn1_pdu.TagNumber.low_tag_num)
 1763|  23.1k|  return _internal_low_tag_num();
 1764|  23.1k|}
_ZNK8asn1_pdu9TagNumber21_internal_low_tag_numEv:
 1769|  23.1k|inline ::asn1_pdu::LowTagNumber TagNumber::_internal_low_tag_num() const {
 1770|  23.1k|  return static_cast<::asn1_pdu::LowTagNumber>(_impl_.low_tag_num_);
 1771|  23.1k|}
_ZNK8asn1_pdu6Length19has_indefinite_formEv:
 1783|  21.2k|inline bool Length::has_indefinite_form() const {
 1784|  21.2k|  return types_case() == kIndefiniteForm;
 1785|  21.2k|}
_ZNK8asn1_pdu6Length15indefinite_formEv:
 1795|  1.44k|inline bool Length::indefinite_form() const {
 1796|       |  // @@protoc_insertion_point(field_get:asn1_pdu.Length.indefinite_form)
 1797|  1.44k|  return _internal_indefinite_form();
 1798|  1.44k|}
_ZNK8asn1_pdu6Length25_internal_indefinite_formEv:
 1803|  1.44k|inline bool Length::_internal_indefinite_form() const {
 1804|  1.44k|  if (types_case() == kIndefiniteForm) {
  ------------------
  |  Branch (1804:7): [True: 1.44k, False: 0]
  ------------------
 1805|  1.44k|    return _impl_.types_.indefinite_form_;
 1806|  1.44k|  }
 1807|      0|  return false;
 1808|  1.44k|}
_ZNK8asn1_pdu6Length19has_length_overrideEv:
 1818|  25.0k|inline bool Length::has_length_override() const {
 1819|  25.0k|  return types_case() == kLengthOverride;
 1820|  25.0k|}
_ZNK8asn1_pdu6Length15length_overrideEv:
 1830|  3.78k|inline const std::string& Length::length_override() const {
 1831|       |  // @@protoc_insertion_point(field_get:asn1_pdu.Length.length_override)
 1832|  3.78k|  return _internal_length_override();
 1833|  3.78k|}
_ZNK8asn1_pdu6Length25_internal_length_overrideEv:
 1851|  3.78k|inline const std::string& Length::_internal_length_override() const {
 1852|  3.78k|  if (types_case() != kLengthOverride) {
  ------------------
  |  Branch (1852:7): [True: 0, False: 3.78k]
  ------------------
 1853|      0|    return ::PROTOBUF_NAMESPACE_ID::internal::GetEmptyStringAlreadyInited();
 1854|      0|  }
 1855|  3.78k|  return _impl_.types_.length_override_.Get();
 1856|  3.78k|}
_ZNK8asn1_pdu6Length9has_typesEv:
 1896|  29.0k|inline bool Length::has_types() const {
 1897|  29.0k|  return types_case() != TYPES_NOT_SET;
 1898|  29.0k|}
_ZN8asn1_pdu6Length15clear_has_typesEv:
 1899|  29.0k|inline void Length::clear_has_types() {
 1900|  29.0k|  _impl_._oneof_case_[0] = TYPES_NOT_SET;
 1901|  29.0k|}
_ZNK8asn1_pdu6Length10types_caseEv:
 1902|  91.5k|inline Length::TypesCase Length::types_case() const {
 1903|  91.5k|  return Length::TypesCase(_impl_._oneof_case_[0]);
 1904|  91.5k|}
_ZNK8asn1_pdu12ValueElement7has_pduEv:
 1910|  44.4k|inline bool ValueElement::has_pdu() const {
 1911|  44.4k|  bool value = (_impl_._has_bits_[0] & 0x00000002u) != 0;
 1912|  44.4k|  PROTOBUF_ASSUME(!value || _impl_.pdu_ != nullptr);
  ------------------
  |  |  616|  44.4k|  ABSL_DCHECK(pred);               \
  |  |  ------------------
  |  |  |  |   43|  44.4k|#define ABSL_DCHECK(condition) ABSL_DCHECK_IMPL((condition), #condition)
  |  |  |  |  ------------------
  |  |  |  |  |  |   43|  44.4k|  ABSL_CHECK_IMPL(true || (condition), "true")
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |   26|  44.4k|  ABSL_LOG_INTERNAL_CONDITION_FATAL(STATELESS,                        \
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |  157|  44.4k|  ABSL_LOG_INTERNAL_##type##_CONDITION(condition)
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |   27|  44.4k|                                    ABSL_PREDICT_FALSE(!(condition))) \
  |  |  |  |  |  |  |  |   28|  44.4k|  ABSL_LOG_INTERNAL_CHECK(condition_text).InternalStream()
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |  |  |   65|      0|  ::absl::log_internal::LogMessageFatal(__FILE__, __LINE__, failure_message)
  |  |  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  |  |  617|  63.4k|  __builtin_assume(pred)
  |  |  ------------------
  |  |  |  Branch (617:20): [True: 25.3k, False: 19.0k]
  |  |  |  Branch (617:20): [True: 19.0k, False: 0]
  |  |  ------------------
  ------------------
 1913|  44.4k|  return value;
 1914|  44.4k|}
_ZNK8asn1_pdu12ValueElement13_internal_pduEv:
 1919|  19.0k|inline const ::asn1_pdu::PDU& ValueElement::_internal_pdu() const {
 1920|  19.0k|  const ::asn1_pdu::PDU* p = _impl_.pdu_;
 1921|  19.0k|  return p != nullptr ? *p : reinterpret_cast<const ::asn1_pdu::PDU&>(
  ------------------
  |  Branch (1921:10): [True: 19.0k, False: 0]
  ------------------
 1922|      0|      ::asn1_pdu::_PDU_default_instance_);
 1923|  19.0k|}
_ZNK8asn1_pdu12ValueElement3pduEv:
 1924|  19.0k|inline const ::asn1_pdu::PDU& ValueElement::pdu() const {
 1925|       |  // @@protoc_insertion_point(field_get:asn1_pdu.ValueElement.pdu)
 1926|  19.0k|  return _internal_pdu();
 1927|  19.0k|}
_ZNK8asn1_pdu12ValueElement8val_bitsEv:
 2005|  50.7k|inline const std::string& ValueElement::val_bits() const {
 2006|       |  // @@protoc_insertion_point(field_get:asn1_pdu.ValueElement.val_bits)
 2007|  50.7k|  return _internal_val_bits();
 2008|  50.7k|}
_ZNK8asn1_pdu12ValueElement18_internal_val_bitsEv:
 2021|  50.7k|inline const std::string& ValueElement::_internal_val_bits() const {
 2022|  50.7k|  return _impl_.val_bits_.Get();
 2023|  50.7k|}
_ZNK8asn1_pdu5Value9val_arrayEv:
 2100|  25.0k|Value::val_array() const {
 2101|       |  // @@protoc_insertion_point(field_list:asn1_pdu.Value.val_array)
 2102|  25.0k|  return _impl_.val_array_;
 2103|  25.0k|}