ssl/statem/statem_srvr.c:1966: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [0, 2]):unsigned64 by call to `WPACKET_close`.
Showing all 11 steps of the trace


ssl/statem/statem_srvr.c:1954:10: Call
1952.   
1953.       /* get the list of acceptable cert types */
1954.       if (!WPACKET_start_sub_packet_u8(&pkt)
                 ^
1955.               || !ssl3_get_req_cert_type(s, &pkt)
1956.               || !WPACKET_close(&pkt)) {

ssl/packet.c:224:1: Parameter `lenbytes`
  222.   }
  223.   
  224. > int WPACKET_start_sub_packet_len__(WPACKET *pkt, size_t lenbytes)
  225.   {
  226.       WPACKET_SUB *sub;

ssl/packet.c:241:5: Assignment
  239.       pkt->subs = sub;
  240.       sub->pwritten = pkt->written + lenbytes;
  241.       sub->lenbytes = lenbytes;
             ^
  242.   
  243.       if (lenbytes == 0) {

ssl/statem/statem_srvr.c:1966:21: Call
1964.           if (!WPACKET_start_sub_packet_u16(&pkt)
1965.                   || !tls12_copy_sigalgs(s, &pkt, psigs, nl)
1966.                   || !WPACKET_close(&pkt)) {
                            ^
1967.               SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST,
1968.                      ERR_R_INTERNAL_ERROR);

ssl/packet.c:192:1: Parameter `pkt->curr`
  190.   }
  191.   
  192. > int WPACKET_close(WPACKET *pkt)
  193.   {
  194.       /*

ssl/packet.c:201:12: Call
  199.           return 0;
  200.   
  201.       return wpacket_intern_close(pkt);
                    ^
  202.   }
  203.   

ssl/packet.c:158:1: <LHS trace>
156.    * close a sub-packet and write out its length if necessary.
157.    */
158. > static int wpacket_intern_close(WPACKET *pkt)
159.   {
160.       WPACKET_SUB *sub = pkt->subs;

ssl/packet.c:158:1: Parameter `pkt->curr`
    156.    * close a sub-packet and write out its length if necessary.
    157.    */
    158. > static int wpacket_intern_close(WPACKET *pkt)
    159.   {
    160.       WPACKET_SUB *sub = pkt->subs;

ssl/packet.c:158:1: <RHS trace>
156.    * close a sub-packet and write out its length if necessary.
157.    */
158. > static int wpacket_intern_close(WPACKET *pkt)
159.   {
160.       WPACKET_SUB *sub = pkt->subs;

ssl/packet.c:158:1: Parameter `pkt->subs->lenbytes`
    156.    * close a sub-packet and write out its length if necessary.
    157.    */
    158. > static int wpacket_intern_close(WPACKET *pkt)
    159.   {
    160.       WPACKET_SUB *sub = pkt->subs;

ssl/packet.c:170:13: Binary operation: ([0, +oo] - [0, 2]):unsigned64 by call to `WPACKET_close` 
    168.               && sub->flags & WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH) {
    169.           /* Deallocate any bytes allocated for the length of the WPACKET */
    170.           if ((pkt->curr - sub->lenbytes) == sub->packet_len) {
                       ^
    171.               pkt->written -= sub->lenbytes;
    172.               pkt->curr -= sub->lenbytes;

static int wpacket_intern_close(WPACKET *pkt)
{
    WPACKET_SUB *sub = pkt->subs;
    size_t packlen = pkt->written - sub->pwritten;
    if (packlen == 0
            && (sub->flags & WPACKET_FLAGS_NON_ZERO_LENGTH) != 0)
        return 0;
    if (packlen == 0
            && sub->flags & WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH) {
        if ((pkt->curr - sub->lenbytes) == sub->packet_len) {
            pkt->written -= sub->lenbytes;
            pkt->curr -= sub->lenbytes;
        }
        sub->packet_len = 0;
        sub->lenbytes = 0;
    }
    if (sub->lenbytes > 0
                && !put_value((unsigned char *)&pkt->buf->data[sub->packet_len],
                              packlen, sub->lenbytes))
            return 0;
    pkt->subs = sub->parent;
    OPENSSL_free(sub);
    return 1;
}
['int tls_construct_certificate_request(SSL *s)\n{\n    int i, nl;\n    STACK_OF(X509_NAME) *sk = NULL;\n    WPACKET pkt;\n    if (!WPACKET_init(&pkt, s->init_buf)\n            || !ssl_set_handshake_header2(s, &pkt,\n                                          SSL3_MT_CERTIFICATE_REQUEST)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    if (!WPACKET_start_sub_packet_u8(&pkt)\n            || !ssl3_get_req_cert_type(s, &pkt)\n            || !WPACKET_close(&pkt)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    if (SSL_USE_SIGALGS(s)) {\n        const unsigned char *psigs;\n        nl = tls12_get_psigalgs(s, &psigs);\n        if (!WPACKET_start_sub_packet_u16(&pkt)\n                || !tls12_copy_sigalgs(s, &pkt, psigs, nl)\n                || !WPACKET_close(&pkt)) {\n            SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST,\n                   ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n    }\n    if (!WPACKET_start_sub_packet_u16(&pkt)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    sk = SSL_get_client_CA_list(s);\n    if (sk != NULL) {\n        for (i = 0; i < sk_X509_NAME_num(sk); i++) {\n            unsigned char *namebytes;\n            X509_NAME *name = sk_X509_NAME_value(sk, i);\n            int namelen;\n            if (name == NULL\n                    || (namelen = i2d_X509_NAME(name, NULL)) < 0\n                    || !WPACKET_sub_allocate_bytes_u16(&pkt, namelen,\n                                                       &namebytes)\n                    || i2d_X509_NAME(name, &namebytes) != namelen) {\n                SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST,\n                       ERR_R_INTERNAL_ERROR);\n                goto err;\n            }\n        }\n    }\n    if (!WPACKET_close(&pkt)\n            || !ssl_close_construct_packet(s, &pkt)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    s->s3->tmp.cert_request = 1;\n    return 1;\n err:\n    WPACKET_cleanup(&pkt);\n    ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);\n    ossl_statem_set_error(s);\n    return 0;\n}', 'int WPACKET_start_sub_packet_len__(WPACKET *pkt, size_t lenbytes)\n{\n    WPACKET_SUB *sub;\n    unsigned char *lenchars;\n    assert(pkt->subs != NULL);\n    if (pkt->subs == NULL)\n        return 0;\n    sub = OPENSSL_zalloc(sizeof(*sub));\n    if (sub == NULL)\n        return 0;\n    sub->parent = pkt->subs;\n    pkt->subs = sub;\n    sub->pwritten = pkt->written + lenbytes;\n    sub->lenbytes = lenbytes;\n    if (lenbytes == 0) {\n        sub->packet_len = 0;\n        return 1;\n    }\n    if (!WPACKET_allocate_bytes(pkt, lenbytes, &lenchars))\n        return 0;\n    sub->packet_len = lenchars - (unsigned char *)pkt->buf->data;\n    return 1;\n}', 'int WPACKET_close(WPACKET *pkt)\n{\n    if (pkt->subs == NULL || pkt->subs->parent == NULL)\n        return 0;\n    return wpacket_intern_close(pkt);\n}', 'static int wpacket_intern_close(WPACKET *pkt)\n{\n    WPACKET_SUB *sub = pkt->subs;\n    size_t packlen = pkt->written - sub->pwritten;\n    if (packlen == 0\n            && (sub->flags & WPACKET_FLAGS_NON_ZERO_LENGTH) != 0)\n        return 0;\n    if (packlen == 0\n            && sub->flags & WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH) {\n        if ((pkt->curr - sub->lenbytes) == sub->packet_len) {\n            pkt->written -= sub->lenbytes;\n            pkt->curr -= sub->lenbytes;\n        }\n        sub->packet_len = 0;\n        sub->lenbytes = 0;\n    }\n    if (sub->lenbytes > 0\n                && !put_value((unsigned char *)&pkt->buf->data[sub->packet_len],\n                              packlen, sub->lenbytes))\n            return 0;\n    pkt->subs = sub->parent;\n    OPENSSL_free(sub);\n    return 1;\n}']