ssl/statem/statem.c:763: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [0, 2]):unsigned64 by call to `WPACKET_finish`.
Showing all 10 steps of the trace


ssl/statem/statem.c:763:25: Call
761.                       || (confunc != NULL && !confunc(s, &pkt))
762.                       || !ssl_close_construct_packet(s, &pkt, mt)
763.                       || !WPACKET_finish(&pkt)) {
                               ^
764.                   WPACKET_cleanup(&pkt);
765.                   ossl_statem_set_error(s);

ssl/packet.c:232:1: Parameter `pkt->subs->lenbytes`
  230.   }
  231.   
  232. > int WPACKET_finish(WPACKET *pkt)
  233.   {
  234.       int ret;

ssl/statem/statem.c:763:25: Call
761.                       || (confunc != NULL && !confunc(s, &pkt))
762.                       || !ssl_close_construct_packet(s, &pkt, mt)
763.                       || !WPACKET_finish(&pkt)) {
                               ^
764.                   WPACKET_cleanup(&pkt);
765.                   ossl_statem_set_error(s);

ssl/packet.c:232:1: Parameter `pkt->curr`
  230.   }
  231.   
  232. > int WPACKET_finish(WPACKET *pkt)
  233.   {
  234.       int ret;

ssl/packet.c:243:11: Call
  241.           return 0;
  242.   
  243.       ret = wpacket_intern_close(pkt);
                   ^
  244.       if (ret) {
  245.           OPENSSL_free(pkt->subs);

ssl/packet.c:186:1: <LHS trace>
184.    * close a sub-packet and write out its length if necessary.
185.    */
186. > static int wpacket_intern_close(WPACKET *pkt)
187.   {
188.       WPACKET_SUB *sub = pkt->subs;

ssl/packet.c:186:1: Parameter `pkt->curr`
    184.    * close a sub-packet and write out its length if necessary.
    185.    */
    186. > static int wpacket_intern_close(WPACKET *pkt)
    187.   {
    188.       WPACKET_SUB *sub = pkt->subs;

ssl/packet.c:186:1: <RHS trace>
184.    * close a sub-packet and write out its length if necessary.
185.    */
186. > static int wpacket_intern_close(WPACKET *pkt)
187.   {
188.       WPACKET_SUB *sub = pkt->subs;

ssl/packet.c:186:1: Parameter `pkt->subs->lenbytes`
    184.    * close a sub-packet and write out its length if necessary.
    185.    */
    186. > static int wpacket_intern_close(WPACKET *pkt)
    187.   {
    188.       WPACKET_SUB *sub = pkt->subs;

ssl/packet.c:198:13: Binary operation: ([0, +oo] - [0, 2]):unsigned64 by call to `WPACKET_finish` 
    196.               && sub->flags & WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH) {
    197.           /* Deallocate any bytes allocated for the length of the WPACKET */
    198.           if ((pkt->curr - sub->lenbytes) == sub->packet_len) {
                       ^
    199.               pkt->written -= sub->lenbytes;
    200.               pkt->curr -= sub->lenbytes;

static int wpacket_intern_close(WPACKET *pkt)
{
    WPACKET_SUB *sub = pkt->subs;
    size_t packlen = pkt->written - sub->pwritten;
    if (packlen == 0
            && (sub->flags & WPACKET_FLAGS_NON_ZERO_LENGTH) != 0)
        return 0;
    if (packlen == 0
            && sub->flags & WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH) {
        if ((pkt->curr - sub->lenbytes) == sub->packet_len) {
            pkt->written -= sub->lenbytes;
            pkt->curr -= sub->lenbytes;
        }
        sub->packet_len = 0;
        sub->lenbytes = 0;
    }
    if (sub->lenbytes > 0
                && !put_value(&GETBUF(pkt)[sub->packet_len], packlen,
                              sub->lenbytes))
            return 0;
    pkt->subs = sub->parent;
    OPENSSL_free(sub);
    return 1;
}
['static SUB_STATE_RETURN write_state_machine(SSL *s)\n{\n    OSSL_STATEM *st = &s->statem;\n    int ret;\n    WRITE_TRAN(*transition) (SSL *s);\n    WORK_STATE(*pre_work) (SSL *s, WORK_STATE wst);\n    WORK_STATE(*post_work) (SSL *s, WORK_STATE wst);\n    int (*get_construct_message_f) (SSL *s, WPACKET *pkt,\n                                    int (**confunc) (SSL *s, WPACKET *pkt),\n                                    int *mt);\n    void (*cb) (const SSL *ssl, int type, int val) = NULL;\n    int (*confunc) (SSL *s, WPACKET *pkt);\n    int mt;\n    WPACKET pkt;\n    cb = get_callback(s);\n    if (s->server) {\n        transition = ossl_statem_server_write_transition;\n        pre_work = ossl_statem_server_pre_work;\n        post_work = ossl_statem_server_post_work;\n        get_construct_message_f = ossl_statem_server_construct_message;\n    } else {\n        transition = ossl_statem_client_write_transition;\n        pre_work = ossl_statem_client_pre_work;\n        post_work = ossl_statem_client_post_work;\n        get_construct_message_f = ossl_statem_client_construct_message;\n    }\n    while (1) {\n        switch (st->write_state) {\n        case WRITE_STATE_TRANSITION:\n            if (cb != NULL) {\n                if (s->server)\n                    cb(s, SSL_CB_ACCEPT_LOOP, 1);\n                else\n                    cb(s, SSL_CB_CONNECT_LOOP, 1);\n            }\n            switch (transition(s)) {\n            case WRITE_TRAN_CONTINUE:\n                st->write_state = WRITE_STATE_PRE_WORK;\n                st->write_state_work = WORK_MORE_A;\n                break;\n            case WRITE_TRAN_FINISHED:\n                return SUB_STATE_FINISHED;\n                break;\n            case WRITE_TRAN_ERROR:\n                return SUB_STATE_ERROR;\n            }\n            break;\n        case WRITE_STATE_PRE_WORK:\n            switch (st->write_state_work = pre_work(s, st->write_state_work)) {\n            case WORK_ERROR:\n            case WORK_MORE_A:\n            case WORK_MORE_B:\n                return SUB_STATE_ERROR;\n            case WORK_FINISHED_CONTINUE:\n                st->write_state = WRITE_STATE_SEND;\n                break;\n            case WORK_FINISHED_STOP:\n                return SUB_STATE_END_HANDSHAKE;\n            }\n            if (!WPACKET_init(&pkt, s->init_buf)\n                    || !get_construct_message_f(s, &pkt, &confunc, &mt)\n                    || !ssl_set_handshake_header(s, &pkt, mt)\n                    || (confunc != NULL && !confunc(s, &pkt))\n                    || !ssl_close_construct_packet(s, &pkt, mt)\n                    || !WPACKET_finish(&pkt)) {\n                WPACKET_cleanup(&pkt);\n                ossl_statem_set_error(s);\n                return SUB_STATE_ERROR;\n            }\n        case WRITE_STATE_SEND:\n            if (SSL_IS_DTLS(s) && st->use_timer) {\n                dtls1_start_timer(s);\n            }\n            ret = statem_do_write(s);\n            if (ret <= 0) {\n                return SUB_STATE_ERROR;\n            }\n            st->write_state = WRITE_STATE_POST_WORK;\n            st->write_state_work = WORK_MORE_A;\n        case WRITE_STATE_POST_WORK:\n            switch (st->write_state_work = post_work(s, st->write_state_work)) {\n            case WORK_ERROR:\n            case WORK_MORE_A:\n            case WORK_MORE_B:\n                return SUB_STATE_ERROR;\n            case WORK_FINISHED_CONTINUE:\n                st->write_state = WRITE_STATE_TRANSITION;\n                break;\n            case WORK_FINISHED_STOP:\n                return SUB_STATE_END_HANDSHAKE;\n            }\n            break;\n        default:\n            return SUB_STATE_ERROR;\n        }\n    }\n}', 'int WPACKET_finish(WPACKET *pkt)\n{\n    int ret;\n    if (pkt->subs == NULL || pkt->subs->parent != NULL)\n        return 0;\n    ret = wpacket_intern_close(pkt);\n    if (ret) {\n        OPENSSL_free(pkt->subs);\n        pkt->subs = NULL;\n    }\n    return ret;\n}', 'static int wpacket_intern_close(WPACKET *pkt)\n{\n    WPACKET_SUB *sub = pkt->subs;\n    size_t packlen = pkt->written - sub->pwritten;\n    if (packlen == 0\n            && (sub->flags & WPACKET_FLAGS_NON_ZERO_LENGTH) != 0)\n        return 0;\n    if (packlen == 0\n            && sub->flags & WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH) {\n        if ((pkt->curr - sub->lenbytes) == sub->packet_len) {\n            pkt->written -= sub->lenbytes;\n            pkt->curr -= sub->lenbytes;\n        }\n        sub->packet_len = 0;\n        sub->lenbytes = 0;\n    }\n    if (sub->lenbytes > 0\n                && !put_value(&GETBUF(pkt)[sub->packet_len], packlen,\n                              sub->lenbytes))\n            return 0;\n    pkt->subs = sub->parent;\n    OPENSSL_free(sub);\n    return 1;\n}']