ssl/statem/statem.c:563: error: INTEGER_OVERFLOW_L2
  ([2, max(2147483644, `s->init_buf->max`)] - [1, 2147483644]):unsigned64 by call to `grow_init_buf`.
Showing all 11 steps of the trace


ssl/statem/statem.c:489:1: Parameter `s->init_buf->max`
487.    * will resume in the same state where we left off.
488.    */
489. > static SUB_STATE_RETURN read_state_machine(SSL *s)
490.   {
491.       OSSL_STATEM *st = &s->statem;

ssl/statem/statem.c:563:25: Call
561.               if (!SSL_IS_DTLS(s)
562.                       && s->s3->tmp.message_size > 0
563.                       && !grow_init_buf(s, s->s3->tmp.message_size
                               ^
564.                                            + SSL3_HM_HEADER_LENGTH)) {
565.                   ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);

ssl/statem/statem.c:448:1: Parameter `s->init_buf->max`
  446.   }
  447.   
  448. > static int grow_init_buf(SSL *s, size_t size) {
  449.   
  450.       size_t msg_offset = (char *)s->init_msg - s->init_buf->data;

ssl/statem/statem.c:452:10: Call
  450.       size_t msg_offset = (char *)s->init_msg - s->init_buf->data;
  451.   
  452.       if (!BUF_MEM_grow_clean(s->init_buf, (int)size))
                  ^
  453.           return 0;
  454.   

crypto/buffer/buffer.c:109:1: Parameter `len`
    107.   }
    108.   
    109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
    110.   {
    111.       char *ret;

crypto/buffer/buffer.c:134:15: Call
    132.           ret = sec_alloc_realloc(str, n);
    133.       else
    134.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                         ^
    135.       if (ret == NULL) {
    136.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:136:1: <LHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
      134.   }
      135.   
      136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
      137.                              const char *file, int line)
      138.   {

crypto/mem.c:136:1: <RHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
      134.   }
      135.   
      136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
      137.                              const char *file, int line)
      138.   {

crypto/mem.c:151:9: Binary operation: ([2, max(2147483644, s->init_buf->max)] - [1, 2147483644]):unsigned64 by call to `grow_init_buf` 
      149.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
      150.       if (num < old_len) {
      151.           OPENSSL_cleanse((char*)str + num, old_len - num);
                     ^
      152.           return str;
      153.       }

void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
                           const char *file, int line)
{
    void *ret = NULL;
    if (str == NULL)
        return CRYPTO_malloc(num, file, line);
    if (num == 0) {
        CRYPTO_clear_free(str, old_len, file, line);
        return NULL;
    }
    if (num < old_len) {
        OPENSSL_cleanse((char*)str + num, old_len - num);
        return str;
    }
    ret = CRYPTO_malloc(num, file, line);
    if (ret != NULL) {
        memcpy(ret, str, old_len);
        CRYPTO_clear_free(str, old_len, file, line);
    }
    return ret;
}
['static SUB_STATE_RETURN read_state_machine(SSL *s)\n{\n    OSSL_STATEM *st = &s->statem;\n    int ret, mt;\n    unsigned long len = 0;\n    int (*transition) (SSL *s, int mt);\n    PACKET pkt;\n    MSG_PROCESS_RETURN(*process_message) (SSL *s, PACKET *pkt);\n    WORK_STATE(*post_process_message) (SSL *s, WORK_STATE wst);\n    unsigned long (*max_message_size) (SSL *s);\n    void (*cb) (const SSL *ssl, int type, int val) = NULL;\n    cb = get_callback(s);\n    if (s->server) {\n        transition = ossl_statem_server_read_transition;\n        process_message = ossl_statem_server_process_message;\n        max_message_size = ossl_statem_server_max_message_size;\n        post_process_message = ossl_statem_server_post_process_message;\n    } else {\n        transition = ossl_statem_client_read_transition;\n        process_message = ossl_statem_client_process_message;\n        max_message_size = ossl_statem_client_max_message_size;\n        post_process_message = ossl_statem_client_post_process_message;\n    }\n    if (st->read_state_first_init) {\n        s->first_packet = 1;\n        st->read_state_first_init = 0;\n    }\n    while (1) {\n        switch (st->read_state) {\n        case READ_STATE_HEADER:\n            if (SSL_IS_DTLS(s)) {\n                ret = dtls_get_message(s, &mt, &len);\n            } else {\n                ret = tls_get_message_header(s, &mt);\n            }\n            if (ret == 0) {\n                return SUB_STATE_ERROR;\n            }\n            if (cb != NULL) {\n                if (s->server)\n                    cb(s, SSL_CB_ACCEPT_LOOP, 1);\n                else\n                    cb(s, SSL_CB_CONNECT_LOOP, 1);\n            }\n            if (!transition(s, mt)) {\n                ossl_statem_set_error(s);\n                return SUB_STATE_ERROR;\n            }\n            if (s->s3->tmp.message_size > max_message_size(s)) {\n                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);\n                SSLerr(SSL_F_READ_STATE_MACHINE, SSL_R_EXCESSIVE_MESSAGE_SIZE);\n                return SUB_STATE_ERROR;\n            }\n            if (!SSL_IS_DTLS(s)\n                    && s->s3->tmp.message_size > 0\n                    && !grow_init_buf(s, s->s3->tmp.message_size\n                                         + SSL3_HM_HEADER_LENGTH)) {\n                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);\n                SSLerr(SSL_F_READ_STATE_MACHINE, ERR_R_BUF_LIB);\n                return SUB_STATE_ERROR;\n            }\n            st->read_state = READ_STATE_BODY;\n        case READ_STATE_BODY:\n            if (!SSL_IS_DTLS(s)) {\n                ret = tls_get_message_body(s, &len);\n                if (ret == 0) {\n                    return SUB_STATE_ERROR;\n                }\n            }\n            s->first_packet = 0;\n            if (!PACKET_buf_init(&pkt, s->init_msg, len)) {\n                ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);\n                SSLerr(SSL_F_READ_STATE_MACHINE, ERR_R_INTERNAL_ERROR);\n                return SUB_STATE_ERROR;\n            }\n            ret = process_message(s, &pkt);\n            s->init_num = 0;\n            switch (ret) {\n            case MSG_PROCESS_ERROR:\n                return SUB_STATE_ERROR;\n            case MSG_PROCESS_FINISHED_READING:\n                if (SSL_IS_DTLS(s)) {\n                    dtls1_stop_timer(s);\n                }\n                return SUB_STATE_FINISHED;\n            case MSG_PROCESS_CONTINUE_PROCESSING:\n                st->read_state = READ_STATE_POST_PROCESS;\n                st->read_state_work = WORK_MORE_A;\n                break;\n            default:\n                st->read_state = READ_STATE_HEADER;\n                break;\n            }\n            break;\n        case READ_STATE_POST_PROCESS:\n            st->read_state_work = post_process_message(s, st->read_state_work);\n            switch (st->read_state_work) {\n            case WORK_ERROR:\n            case WORK_MORE_A:\n            case WORK_MORE_B:\n                return SUB_STATE_ERROR;\n            case WORK_FINISHED_CONTINUE:\n                st->read_state = READ_STATE_HEADER;\n                break;\n            case WORK_FINISHED_STOP:\n                if (SSL_IS_DTLS(s)) {\n                    dtls1_stop_timer(s);\n                }\n                return SUB_STATE_FINISHED;\n            }\n            break;\n        default:\n            ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);\n            SSLerr(SSL_F_READ_STATE_MACHINE, ERR_R_INTERNAL_ERROR);\n            ossl_statem_set_error(s);\n            return SUB_STATE_ERROR;\n        }\n    }\n}', 'static int grow_init_buf(SSL *s, size_t size) {\n    size_t msg_offset = (char *)s->init_msg - s->init_buf->data;\n    if (!BUF_MEM_grow_clean(s->init_buf, (int)size))\n        return 0;\n    if (size < msg_offset)\n        return 0;\n    s->init_msg = s->init_buf->data + msg_offset;\n    return 1;\n}', 'size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)\n{\n    char *ret;\n    size_t n;\n    if (str->length >= len) {\n        if (str->data != NULL)\n            memset(&str->data[len], 0, str->length - len);\n        str->length = len;\n        return (len);\n    }\n    if (str->max >= len) {\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n        return (len);\n    }\n    if (len > LIMIT_BEFORE_EXPANSION) {\n        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    n = (len + 3) / 3 * 4;\n    if ((str->flags & BUF_MEM_FLAG_SECURE))\n        ret = sec_alloc_realloc(str, n);\n    else\n        ret = OPENSSL_clear_realloc(str->data, str->max, n);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);\n        len = 0;\n    } else {\n        str->data = ret;\n        str->max = n;\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n    }\n    return (len);\n}', 'void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,\n                           const char *file, int line)\n{\n    void *ret = NULL;\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_clear_free(str, old_len, file, line);\n        return NULL;\n    }\n    if (num < old_len) {\n        OPENSSL_cleanse((char*)str + num, old_len - num);\n        return str;\n    }\n    ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL) {\n        memcpy(ret, str, old_len);\n        CRYPTO_clear_free(str, old_len, file, line);\n    }\n    return ret;\n}']