ssl/statem/statem_clnt.c:1094: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [0, 256]):unsigned64 by call to `PACKET_copy_bytes`.
Showing all 10 steps of the trace


ssl/statem/statem_clnt.c:1081:17: Call
1079.   
1080.       if (!PACKET_forward(pkt, 2)
1081.               || !PACKET_get_length_prefixed_1(pkt, &cookiepkt)) {
                        ^
1082.           al = SSL_AD_DECODE_ERROR;
1083.           SSLerr(SSL_F_DTLS_PROCESS_HELLO_VERIFY, SSL_R_LENGTH_MISMATCH);

ssl/packet_locl.h:457:8: Parameter `subpkt->remaining`
  455.    * Upon failure, the original |pkt| and |subpkt| are not modified.
  456.    */
  457.   __owur static inline int PACKET_get_length_prefixed_1(PACKET *pkt, PACKET *subpkt)
                ^
  458.   {
  459.     unsigned int length;

ssl/statem/statem_clnt.c:1094:10: Call
1092.       }
1093.   
1094.       if (!PACKET_copy_bytes(&cookiepkt, s->d1->cookie, cookie_len)) {
                 ^
1095.           al = SSL_AD_DECODE_ERROR;
1096.           SSLerr(SSL_F_DTLS_PROCESS_HELLO_VERIFY, SSL_R_LENGTH_MISMATCH);

ssl/packet_locl.h:359:8: Parameter `len`
  357.    * The caller is responsible for ensuring that |data| can hold |len| bytes.
  358.    */
  359.   __owur static inline int PACKET_copy_bytes(PACKET *pkt, unsigned char *data,
                ^
  360.                                              size_t len)
  361.   {

ssl/packet_locl.h:365:5: Call
  363.           return 0;
  364.   
  365.       packet_forward(pkt, len);
             ^
  366.   
  367.       return 1;

ssl/packet_locl.h:80:1: <LHS trace>
78.   
79.   /* Internal unchecked shorthand; don't use outside this file. */
80. > static inline void packet_forward(PACKET *pkt, size_t len)
81.   {
82.       pkt->curr += len;

ssl/packet_locl.h:80:1: Parameter `pkt->remaining`
    78.   
    79.   /* Internal unchecked shorthand; don't use outside this file. */
    80. > static inline void packet_forward(PACKET *pkt, size_t len)
    81.   {
    82.       pkt->curr += len;

ssl/packet_locl.h:80:1: <RHS trace>
78.   
79.   /* Internal unchecked shorthand; don't use outside this file. */
80. > static inline void packet_forward(PACKET *pkt, size_t len)
81.   {
82.       pkt->curr += len;

ssl/packet_locl.h:80:1: Parameter `len`
    78.   
    79.   /* Internal unchecked shorthand; don't use outside this file. */
    80. > static inline void packet_forward(PACKET *pkt, size_t len)
    81.   {
    82.       pkt->curr += len;

ssl/packet_locl.h:83:5: Binary operation: ([0, +oo] - [0, 256]):unsigned64 by call to `PACKET_copy_bytes` 
    81.   {
    82.       pkt->curr += len;
    83.       pkt->remaining -= len;
              ^
    84.   }
    85.   

static inline void packet_forward(PACKET *pkt, size_t len)
{
    pkt->curr += len;
    pkt->remaining -= len;
}
['enum MSG_PROCESS_RETURN dtls_process_hello_verify(SSL *s, PACKET *pkt)\n{\n    int al;\n    unsigned int cookie_len;\n    PACKET cookiepkt;\n    if (!PACKET_forward(pkt, 2)\n            || !PACKET_get_length_prefixed_1(pkt, &cookiepkt)) {\n        al = SSL_AD_DECODE_ERROR;\n        SSLerr(SSL_F_DTLS_PROCESS_HELLO_VERIFY, SSL_R_LENGTH_MISMATCH);\n        goto f_err;\n    }\n    cookie_len = PACKET_remaining(&cookiepkt);\n    if (cookie_len > sizeof(s->d1->cookie)) {\n        al = SSL_AD_ILLEGAL_PARAMETER;\n        SSLerr(SSL_F_DTLS_PROCESS_HELLO_VERIFY, SSL_R_LENGTH_TOO_LONG);\n        goto f_err;\n    }\n    if (!PACKET_copy_bytes(&cookiepkt, s->d1->cookie, cookie_len)) {\n        al = SSL_AD_DECODE_ERROR;\n        SSLerr(SSL_F_DTLS_PROCESS_HELLO_VERIFY, SSL_R_LENGTH_MISMATCH);\n        goto f_err;\n    }\n    s->d1->cookie_len = cookie_len;\n    return MSG_PROCESS_FINISHED_READING;\n f_err:\n    ssl3_send_alert(s, SSL3_AL_FATAL, al);\n    statem_set_error(s);\n    return MSG_PROCESS_ERROR;\n}', '__owur static inline int PACKET_get_length_prefixed_1(PACKET *pkt, PACKET *subpkt)\n{\n  unsigned int length;\n  unsigned char *data;\n  PACKET tmp = *pkt;\n  if (!PACKET_get_1(&tmp, &length) ||\n      !PACKET_get_bytes(&tmp, &data, (size_t)length)) {\n      return 0;\n  }\n  *pkt = tmp;\n  subpkt->curr = data;\n  subpkt->remaining = length;\n  return 1;\n}', '__owur static inline int PACKET_copy_bytes(PACKET *pkt, unsigned char *data,\n                                           size_t len)\n{\n    if (!PACKET_peek_copy_bytes(pkt, data, len))\n        return 0;\n    packet_forward(pkt, len);\n    return 1;\n}', 'static inline void packet_forward(PACKET *pkt, size_t len)\n{\n    pkt->curr += len;\n    pkt->remaining -= len;\n}']