crypto/bio/bss_mem.c:260: error: INTEGER_OVERFLOW_L2
  ([2, +oo] - [1, 2147483644]):unsigned64 by call to `BUF_MEM_grow_clean`.
Showing all 8 steps of the trace


crypto/bio/bss_mem.c:260:9: Call
258.       blen = bbm->readp->length;
259.       mem_buf_sync(b);
260.       if (BUF_MEM_grow_clean(bbm->buf, blen + inl) == 0)
               ^
261.           goto end;
262.       memcpy(bbm->buf->data + blen, in, inl);

crypto/buffer/buffer.c:157:1: Parameter `len`
  155.   }
  156.   
  157. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
  158.   {
  159.       char *ret;

crypto/buffer/buffer.c:181:15: Call
  179.           ret = sec_alloc_realloc(str, n);
  180.       else
  181.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                       ^
  182.       if (ret == NULL) {
  183.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:184:1: <LHS trace>
182.   }
183.   
184. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
185.                              const char *file, int line)
186.   {

crypto/mem.c:184:1: Parameter `num`
    182.   }
    183.   
    184. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
    185.                              const char *file, int line)
    186.   {

crypto/mem.c:184:1: <RHS trace>
182.   }
183.   
184. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
185.                              const char *file, int line)
186.   {

crypto/mem.c:184:1: Parameter `num`
    182.   }
    183.   
    184. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
    185.                              const char *file, int line)
    186.   {

crypto/mem.c:199:9: Binary operation: ([2, +oo] - [1, 2147483644]):unsigned64 by call to `BUF_MEM_grow_clean` 
    197.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
    198.       if (num < old_len) {
    199.           memset((char*)str + num, 0, old_len - num);
                   ^
    200.           return str;
    201.       }

void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
                           const char *file, int line)
{
    void *ret = NULL;
    if (str == NULL)
        return CRYPTO_malloc(num, file, line);
    if (num == 0) {
        CRYPTO_clear_free(str, old_len, file, line);
        return NULL;
    }
    if (num < old_len) {
        memset((char*)str + num, 0, old_len - num);
        return str;
    }
    ret = CRYPTO_malloc(num, file, line);
    if (ret)
        memcpy(ret, str, old_len);
    CRYPTO_clear_free(str, old_len, file, line);
    return ret;
}
['static int mem_write(BIO *b, const char *in, int inl)\n{\n    int ret = -1;\n    int blen;\n    BIO_BUF_MEM *bbm = (BIO_BUF_MEM *)b->ptr;\n    if (in == NULL) {\n        BIOerr(BIO_F_MEM_WRITE, BIO_R_NULL_PARAMETER);\n        goto end;\n    }\n    if (b->flags & BIO_FLAGS_MEM_RDONLY) {\n        BIOerr(BIO_F_MEM_WRITE, BIO_R_WRITE_TO_READ_ONLY_BIO);\n        goto end;\n    }\n    BIO_clear_retry_flags(b);\n    blen = bbm->readp->length;\n    mem_buf_sync(b);\n    if (BUF_MEM_grow_clean(bbm->buf, blen + inl) == 0)\n        goto end;\n    memcpy(bbm->buf->data + blen, in, inl);\n    *bbm->readp = *bbm->buf;\n    ret = inl;\n end:\n    return (ret);\n}', 'size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)\n{\n    char *ret;\n    size_t n;\n    if (str->length >= len) {\n        memset(&str->data[len], 0, str->length - len);\n        str->length = len;\n        return (len);\n    }\n    if (str->max >= len) {\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n        return (len);\n    }\n    if (len > LIMIT_BEFORE_EXPANSION) {\n        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    n = (len + 3) / 3 * 4;\n    if ((str->flags & BUF_MEM_FLAG_SECURE))\n        ret = sec_alloc_realloc(str, n);\n    else\n        ret = OPENSSL_clear_realloc(str->data, str->max, n);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);\n        len = 0;\n    } else {\n        str->data = ret;\n        str->max = n;\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n    }\n    return (len);\n}', 'void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,\n                           const char *file, int line)\n{\n    void *ret = NULL;\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_clear_free(str, old_len, file, line);\n        return NULL;\n    }\n    if (num < old_len) {\n        memset((char*)str + num, 0, old_len - num);\n        return str;\n    }\n    ret = CRYPTO_malloc(num, file, line);\n    if (ret)\n        memcpy(ret, str, old_len);\n    CRYPTO_clear_free(str, old_len, file, line);\n    return ret;\n}']