ssl/d1_enc.c:256: error: INTEGER_OVERFLOW_L2
  ([-1, +oo] - [0, 254]):unsigned32 by call to `tls1_cbc_remove_padding`.
Showing all 7 steps of the trace


ssl/d1_enc.c:137:1: Parameter `s->s3->rrec.length`
135.    *   -1: if the record's padding/AEAD-authenticator is invalid or, if sending,
136.    *       an internal error occured. */
137. > int dtls1_enc(SSL *s, int send)
138.   	{
139.   	SSL3_RECORD *rec;

ssl/d1_enc.c:256:11: Call
254.   
255.   		if ((bs != 1) && !send)
256.   			return tls1_cbc_remove_padding(s, rec, bs, mac_size);
                 ^
257.   		}
258.   	return(1);

ssl/s3_cbc.c:136:1: <LHS trace>
134.    *   1: if the padding was valid
135.    *  -1: otherwise. */
136. > int tls1_cbc_remove_padding(const SSL* s,
137.   			    SSL3_RECORD *rec,
138.   			    unsigned block_size,

ssl/s3_cbc.c:136:1: Parameter `rec->length`
  134.    *   1: if the padding was valid
  135.    *  -1: otherwise. */
  136. > int tls1_cbc_remove_padding(const SSL* s,
  137.   			    SSL3_RECORD *rec,
  138.   			    unsigned block_size,

ssl/s3_cbc.c:136:1: <RHS trace>
134.    *   1: if the padding was valid
135.    *  -1: otherwise. */
136. > int tls1_cbc_remove_padding(const SSL* s,
137.   			    SSL3_RECORD *rec,
138.   			    unsigned block_size,

ssl/s3_cbc.c:136:1: Parameter `rec->length`
  134.    *   1: if the padding was valid
  135.    *  -1: otherwise. */
  136. > int tls1_cbc_remove_padding(const SSL* s,
  137.   			    SSL3_RECORD *rec,
  138.   			    unsigned block_size,

ssl/s3_cbc.c:192:21: Binary operation: ([-1, +oo] - [0, 254]):unsigned32 by call to `tls1_cbc_remove_padding` 
  190.   		{
  191.   		unsigned char mask = constant_time_ge(padding_length, i);
  192.   		unsigned char b = rec->data[rec->length-1-i];
                             ^
  193.   		/* The final |padding_length+1| bytes should all have the value
  194.   		 * |padding_length|. Therefore the XOR should be zero. */

int tls1_cbc_remove_padding(const SSL* s,
			    SSL3_RECORD *rec,
			    unsigned block_size,
			    unsigned mac_size)
	{
	unsigned padding_length, good, to_check, i;
	const char has_explicit_iv =
		s->version >= TLS1_1_VERSION || s->version == DTLS1_VERSION;
	const unsigned overhead = 1   +
				  mac_size +
				  (has_explicit_iv ? block_size : 0);
	if (overhead > rec->length)
		return 0;
	padding_length = rec->data[rec->length-1];
	if ( (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand)
		{
		if ((memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0",8) == 0) &&
		    !(padding_length & 1))
			{
			s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
			}
		if ((s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) &&
		    padding_length > 0)
			{
			padding_length--;
			}
		}
	good = constant_time_ge(rec->length, overhead+padding_length);
	to_check = 255;
	if (to_check > rec->length-1)
		to_check = rec->length-1;
	for (i = 0; i < to_check; i++)
		{
		unsigned char mask = constant_time_ge(padding_length, i);
		unsigned char b = rec->data[rec->length-1-i];
		good &= ~(mask&(padding_length ^ b));
		}
	good &= good >> 4;
	good &= good >> 2;
	good &= good >> 1;
	good <<= sizeof(good)*8-1;
	good = DUPLICATE_MSB_TO_ALL(good);
	padding_length = good & (padding_length+1);
	rec->length -= padding_length;
	rec->type |= padding_length<<8;
	if (has_explicit_iv)
		{
		rec->data += block_size;
		rec->input += block_size;
		rec->length -= block_size;
		}
	return (int)((good & 1) | (~good & -1));
	}
['int dtls1_enc(SSL *s, int send)\n\t{\n\tSSL3_RECORD *rec;\n\tEVP_CIPHER_CTX *ds;\n\tunsigned long l;\n\tint bs,i,j,k,mac_size=0;\n\tconst EVP_CIPHER *enc;\n\tif (send)\n\t\t{\n\t\tif (EVP_MD_CTX_md(s->write_hash))\n\t\t\t{\n\t\t\tmac_size=EVP_MD_CTX_size(s->write_hash);\n\t\t\tif (mac_size < 0)\n\t\t\t\treturn -1;\n\t\t\t}\n\t\tds=s->enc_write_ctx;\n\t\trec= &(s->s3->wrec);\n\t\tif (s->enc_write_ctx == NULL)\n\t\t\tenc=NULL;\n\t\telse\n\t\t\t{\n\t\t\tenc=EVP_CIPHER_CTX_cipher(s->enc_write_ctx);\n\t\t\tif ( rec->data != rec->input)\n\t\t\t\tfprintf(stderr, "%s:%d: rec->data != rec->input\\n",\n\t\t\t\t\t__FILE__, __LINE__);\n\t\t\telse if ( EVP_CIPHER_block_size(ds->cipher) > 1)\n\t\t\t\t{\n\t\t\t\tif (RAND_bytes(rec->input, EVP_CIPHER_block_size(ds->cipher)) <= 0)\n\t\t\t\t\treturn -1;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\telse\n\t\t{\n\t\tif (EVP_MD_CTX_md(s->read_hash))\n\t\t\t{\n\t\t\tmac_size=EVP_MD_CTX_size(s->read_hash);\n\t\t\tOPENSSL_assert(mac_size >= 0);\n\t\t\t}\n\t\tds=s->enc_read_ctx;\n\t\trec= &(s->s3->rrec);\n\t\tif (s->enc_read_ctx == NULL)\n\t\t\tenc=NULL;\n\t\telse\n\t\t\tenc=EVP_CIPHER_CTX_cipher(s->enc_read_ctx);\n\t\t}\n#ifdef KSSL_DEBUG\n\tprintf("dtls1_enc(%d)\\n", send);\n#endif\n\tif ((s->session == NULL) || (ds == NULL) ||\n\t\t(enc == NULL))\n\t\t{\n\t\tmemmove(rec->data,rec->input,rec->length);\n\t\trec->input=rec->data;\n\t\t}\n\telse\n\t\t{\n\t\tl=rec->length;\n\t\tbs=EVP_CIPHER_block_size(ds->cipher);\n\t\tif ((bs != 1) && send)\n\t\t\t{\n\t\t\ti=bs-((int)l%bs);\n\t\t\tj=i-1;\n\t\t\tif (s->options & SSL_OP_TLS_BLOCK_PADDING_BUG)\n\t\t\t\t{\n\t\t\t\tif (s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG)\n\t\t\t\t\tj++;\n\t\t\t\t}\n\t\t\tfor (k=(int)l; k<(int)(l+i); k++)\n\t\t\t\trec->input[k]=j;\n\t\t\tl+=i;\n\t\t\trec->length+=i;\n\t\t\t}\n#ifdef KSSL_DEBUG\n\t\t{\n                unsigned long ui;\n\t\tprintf("EVP_Cipher(ds=%p,rec->data=%p,rec->input=%p,l=%ld) ==>\\n",\n                        ds,rec->data,rec->input,l);\n\t\tprintf("\\tEVP_CIPHER_CTX: %d buf_len, %d key_len [%d %d], %d iv_len\\n",\n                        ds->buf_len, ds->cipher->key_len,\n                        DES_KEY_SZ, DES_SCHEDULE_SZ,\n                        ds->cipher->iv_len);\n\t\tprintf("\\t\\tIV: ");\n\t\tfor (i=0; i<ds->cipher->iv_len; i++) printf("%02X", ds->iv[i]);\n\t\tprintf("\\n");\n\t\tprintf("\\trec->input=");\n\t\tfor (ui=0; ui<l; ui++) printf(" %02x", rec->input[ui]);\n\t\tprintf("\\n");\n\t\t}\n#endif\n\t\tif (!send)\n\t\t\t{\n\t\t\tif (l == 0 || l%bs != 0)\n\t\t\t\treturn 0;\n\t\t\t}\n\t\tEVP_Cipher(ds,rec->data,rec->input,l);\n#ifdef KSSL_DEBUG\n\t\t{\n                unsigned long i;\n                printf("\\trec->data=");\n\t\tfor (i=0; i<l; i++)\n                        printf(" %02x", rec->data[i]);  printf("\\n");\n                }\n#endif\n\t\tif ((bs != 1) && !send)\n\t\t\treturn tls1_cbc_remove_padding(s, rec, bs, mac_size);\n\t\t}\n\treturn(1);\n\t}', 'int tls1_cbc_remove_padding(const SSL* s,\n\t\t\t    SSL3_RECORD *rec,\n\t\t\t    unsigned block_size,\n\t\t\t    unsigned mac_size)\n\t{\n\tunsigned padding_length, good, to_check, i;\n\tconst char has_explicit_iv =\n\t\ts->version >= TLS1_1_VERSION || s->version == DTLS1_VERSION;\n\tconst unsigned overhead = 1   +\n\t\t\t\t  mac_size +\n\t\t\t\t  (has_explicit_iv ? block_size : 0);\n\tif (overhead > rec->length)\n\t\treturn 0;\n\tpadding_length = rec->data[rec->length-1];\n\tif ( (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand)\n\t\t{\n\t\tif ((memcmp(s->s3->read_sequence, "\\0\\0\\0\\0\\0\\0\\0\\0",8) == 0) &&\n\t\t    !(padding_length & 1))\n\t\t\t{\n\t\t\ts->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;\n\t\t\t}\n\t\tif ((s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) &&\n\t\t    padding_length > 0)\n\t\t\t{\n\t\t\tpadding_length--;\n\t\t\t}\n\t\t}\n\tgood = constant_time_ge(rec->length, overhead+padding_length);\n\tto_check = 255;\n\tif (to_check > rec->length-1)\n\t\tto_check = rec->length-1;\n\tfor (i = 0; i < to_check; i++)\n\t\t{\n\t\tunsigned char mask = constant_time_ge(padding_length, i);\n\t\tunsigned char b = rec->data[rec->length-1-i];\n\t\tgood &= ~(mask&(padding_length ^ b));\n\t\t}\n\tgood &= good >> 4;\n\tgood &= good >> 2;\n\tgood &= good >> 1;\n\tgood <<= sizeof(good)*8-1;\n\tgood = DUPLICATE_MSB_TO_ALL(good);\n\tpadding_length = good & (padding_length+1);\n\trec->length -= padding_length;\n\trec->type |= padding_length<<8;\n\tif (has_explicit_iv)\n\t\t{\n\t\trec->data += block_size;\n\t\trec->input += block_size;\n\t\trec->length -= block_size;\n\t\t}\n\treturn (int)((good & 1) | (~good & -1));\n\t}']