test/bad_dtls_test.c:156: error: INTEGER_OVERFLOW_L2
  ([2, +oo] - 11):unsigned64 by call to `PACKET_forward`.
Showing all 24 steps of the trace


test/bad_dtls_test.c:139:10: Call
137.   
138.       len = BIO_get_mem_data(wbio, (char **)&data);
139.       if (!PACKET_buf_init(&pkt, data, len))
                ^
140.           return 0;
141.   

ssl/packet_locl.h:71:8: Parameter `pkt->remaining`
  69.    * is being used.
  70.    */
  71.   __owur static ossl_inline int PACKET_buf_init(PACKET *pkt,
               ^
  72.                                                 const unsigned char *buf,
  73.                                                 size_t len)

test/bad_dtls_test.c:143:10: Call
141.   
142.       /* Check record header type */
143.       if (!PACKET_get_1(&pkt, &u) || u != SSL3_RT_HANDSHAKE)
                ^
144.           return 0;
145.       /* Version */

ssl/packet_locl.h:239:8: Parameter `pkt->remaining`
  237.   
  238.   /* Get 1 byte from |pkt| and store the value in |*data| */
  239.   __owur static ossl_inline int PACKET_get_1(PACKET *pkt, unsigned int *data)
                ^
  240.   {
  241.       if (!PACKET_peek_1(pkt, data))

ssl/packet_locl.h:241:10: Call
  239.   __owur static ossl_inline int PACKET_get_1(PACKET *pkt, unsigned int *data)
  240.   {
  241.       if (!PACKET_peek_1(pkt, data))
                  ^
  242.           return 0;
  243.   

ssl/packet_locl.h:227:8: Parameter `pkt->remaining`
    225.   
    226.   /* Peek ahead at 1 byte from |pkt| and store the value in |*data| */
    227.   __owur static ossl_inline int PACKET_peek_1(const PACKET *pkt,
                  ^
    228.                                               unsigned int *data)
    229.   {

test/bad_dtls_test.c:146:10: Call
144.           return 0;
145.       /* Version */
146.       if (!PACKET_get_net_2(&pkt, &u) || u != DTLS1_BAD_VER)
                ^
147.           return 0;
148.       /* Skip the rest of the record header */

ssl/packet_locl.h:154:8: Parameter `pkt->remaining`
  152.   /* Equivalent of n2s */
  153.   /* Get 2 bytes in network order from |pkt| and store the value in |*data| */
  154.   __owur static ossl_inline int PACKET_get_net_2(PACKET *pkt,
                ^
  155.                                                  unsigned int *data)
  156.   {

ssl/packet_locl.h:157:10: Call
  155.                                                  unsigned int *data)
  156.   {
  157.       if (!PACKET_peek_net_2(pkt, data))
                  ^
  158.           return 0;
  159.   

ssl/packet_locl.h:140:8: Parameter `pkt->remaining`
    138.    * |*data|
    139.    */
    140.   __owur static ossl_inline int PACKET_peek_net_2(const PACKET *pkt,
                  ^
    141.                                                   unsigned int *data)
    142.   {

test/bad_dtls_test.c:149:10: Call
147.           return 0;
148.       /* Skip the rest of the record header */
149.       if (!PACKET_forward(&pkt, DTLS1_RT_HEADER_LENGTH - 3))
                ^
150.           return 0;
151.   

ssl/packet_locl.h:424:8: Parameter `len`
  422.   
  423.   /* Move the current reading position forward |len| bytes */
  424.   __owur static ossl_inline int PACKET_forward(PACKET *pkt, size_t len)
                ^
  425.   {
  426.       if (PACKET_remaining(pkt) < len)

test/bad_dtls_test.c:153:10: Call
151.   
152.       /* Check it's a ClientHello */
153.       if (!PACKET_get_1(&pkt, &u) || u != SSL3_MT_CLIENT_HELLO)
                ^
154.           return 0;
155.       /* Skip the rest of the handshake message header */

ssl/packet_locl.h:239:8: Parameter `pkt->remaining`
  237.   
  238.   /* Get 1 byte from |pkt| and store the value in |*data| */
  239.   __owur static ossl_inline int PACKET_get_1(PACKET *pkt, unsigned int *data)
                ^
  240.   {
  241.       if (!PACKET_peek_1(pkt, data))

ssl/packet_locl.h:241:10: Call
  239.   __owur static ossl_inline int PACKET_get_1(PACKET *pkt, unsigned int *data)
  240.   {
  241.       if (!PACKET_peek_1(pkt, data))
                  ^
  242.           return 0;
  243.   

ssl/packet_locl.h:227:8: Parameter `pkt->remaining`
    225.   
    226.   /* Peek ahead at 1 byte from |pkt| and store the value in |*data| */
    227.   __owur static ossl_inline int PACKET_peek_1(const PACKET *pkt,
                  ^
    228.                                               unsigned int *data)
    229.   {

test/bad_dtls_test.c:156:10: Call
154.           return 0;
155.       /* Skip the rest of the handshake message header */
156.       if (!PACKET_forward(&pkt, DTLS1_HM_HEADER_LENGTH - 1))
                ^
157.           return 0;
158.   

ssl/packet_locl.h:424:8: Parameter `len`
  422.   
  423.   /* Move the current reading position forward |len| bytes */
  424.   __owur static ossl_inline int PACKET_forward(PACKET *pkt, size_t len)
                ^
  425.   {
  426.       if (PACKET_remaining(pkt) < len)

ssl/packet_locl.h:429:5: Call
  427.           return 0;
  428.   
  429.       packet_forward(pkt, len);
             ^
  430.   
  431.       return 1;

ssl/packet_locl.h:33:1: <LHS trace>
31.   
32.   /* Internal unchecked shorthand; don't use outside this file. */
33. > static ossl_inline void packet_forward(PACKET *pkt, size_t len)
34.   {
35.       pkt->curr += len;

ssl/packet_locl.h:33:1: Parameter `pkt->remaining`
    31.   
    32.   /* Internal unchecked shorthand; don't use outside this file. */
    33. > static ossl_inline void packet_forward(PACKET *pkt, size_t len)
    34.   {
    35.       pkt->curr += len;

ssl/packet_locl.h:33:1: <RHS trace>
31.   
32.   /* Internal unchecked shorthand; don't use outside this file. */
33. > static ossl_inline void packet_forward(PACKET *pkt, size_t len)
34.   {
35.       pkt->curr += len;

ssl/packet_locl.h:33:1: Parameter `len`
    31.   
    32.   /* Internal unchecked shorthand; don't use outside this file. */
    33. > static ossl_inline void packet_forward(PACKET *pkt, size_t len)
    34.   {
    35.       pkt->curr += len;

ssl/packet_locl.h:36:5: Binary operation: ([2, +oo] - 11):unsigned64 by call to `PACKET_forward` 
    34.   {
    35.       pkt->curr += len;
    36.       pkt->remaining -= len;
              ^
    37.   }
    38.   

static ossl_inline void packet_forward(PACKET *pkt, size_t len)
{
    pkt->curr += len;
    pkt->remaining -= len;
}
['static int validate_client_hello(BIO *wbio)\n{\n    PACKET pkt;\n    long len;\n    unsigned char *data;\n    int cookie_found = 0;\n    unsigned int u;\n    len = BIO_get_mem_data(wbio, (char **)&data);\n    if (!PACKET_buf_init(&pkt, data, len))\n        return 0;\n    if (!PACKET_get_1(&pkt, &u) || u != SSL3_RT_HANDSHAKE)\n        return 0;\n    if (!PACKET_get_net_2(&pkt, &u) || u != DTLS1_BAD_VER)\n        return 0;\n    if (!PACKET_forward(&pkt, DTLS1_RT_HEADER_LENGTH - 3))\n        return 0;\n    if (!PACKET_get_1(&pkt, &u) || u != SSL3_MT_CLIENT_HELLO)\n        return 0;\n    if (!PACKET_forward(&pkt, DTLS1_HM_HEADER_LENGTH - 1))\n        return 0;\n    if (!PACKET_get_net_2(&pkt, &u) || u != DTLS1_BAD_VER)\n        return 0;\n    if (!PACKET_copy_bytes(&pkt, client_random, SSL3_RANDOM_SIZE))\n        return 0;\n    if (!PACKET_get_1(&pkt, &u))\n        return 0;\n    if (u != sizeof(session_id) || !PACKET_starts(&pkt, session_id, u))\n        return 0;\n    if (!PACKET_get_1(&pkt, &u))\n        return 0;\n    if (u) {\n        if (u != sizeof(cookie) || !PACKET_starts(&pkt, cookie, u))\n            return 0;\n        cookie_found = 1;\n    }\n    if (!PACKET_get_net_2(&pkt, &u) || !PACKET_forward(&pkt, u))\n        return 0;\n    if (!PACKET_get_1(&pkt, &u) || !PACKET_forward(&pkt, u))\n        return 0;\n    if (!PACKET_get_net_2(&pkt, &u) || !PACKET_forward(&pkt, u))\n        return 0;\n    if (PACKET_remaining(&pkt))\n        return 0;\n    if (cookie_found && !EVP_DigestUpdate(handshake_md, data + MAC_OFFSET,\n                                          len - MAC_OFFSET))\n            printf("EVP_DigestUpdate() failed\\n");\n    (void)BIO_reset(wbio);\n    return 1 + cookie_found;\n}', 'static ossl_inline void packet_forward(PACKET *pkt, size_t len)\n{\n    pkt->curr += len;\n    pkt->remaining -= len;\n}']