test/bad_dtls_test.c:149: error: INTEGER_OVERFLOW_L2
  ([2, +oo] - 32):unsigned64 by call to `PACKET_copy_bytes`.
Showing all 30 steps of the trace


test/bad_dtls_test.c:124:10: Call
122.   
123.       len = BIO_get_mem_data(wbio, (char **)&data);
124.       if (!PACKET_buf_init(&pkt, data, len))
                ^
125.           return 0;
126.   

ssl/packet_locl.h:72:8: Parameter `pkt->remaining`
  70.    * is being used.
  71.    */
  72.   __owur static ossl_inline int PACKET_buf_init(PACKET *pkt,
               ^
  73.                                                 const unsigned char *buf,
  74.                                                 size_t len)

test/bad_dtls_test.c:128:10: Call
126.   
127.       /* Check record header type */
128.       if (!PACKET_get_1(&pkt, &u) || u != SSL3_RT_HANDSHAKE)
                ^
129.           return 0;
130.       /* Version */

ssl/packet_locl.h:235:8: Parameter `pkt->remaining`
  233.   
  234.   /* Get 1 byte from |pkt| and store the value in |*data| */
  235.   __owur static ossl_inline int PACKET_get_1(PACKET *pkt, unsigned int *data)
                ^
  236.   {
  237.       if (!PACKET_peek_1(pkt, data))

ssl/packet_locl.h:237:10: Call
  235.   __owur static ossl_inline int PACKET_get_1(PACKET *pkt, unsigned int *data)
  236.   {
  237.       if (!PACKET_peek_1(pkt, data))
                  ^
  238.           return 0;
  239.   

ssl/packet_locl.h:223:8: Parameter `pkt->remaining`
    221.   
    222.   /* Peek ahead at 1 byte from |pkt| and store the value in |*data| */
    223.   __owur static ossl_inline int PACKET_peek_1(const PACKET *pkt,
                  ^
    224.                                               unsigned int *data)
    225.   {

test/bad_dtls_test.c:131:10: Call
129.           return 0;
130.       /* Version */
131.       if (!PACKET_get_net_2(&pkt, &u) || u != DTLS1_BAD_VER)
                ^
132.           return 0;
133.       /* Skip the rest of the record header */

ssl/packet_locl.h:153:8: Parameter `pkt->remaining`
  151.   /* Equivalent of n2s */
  152.   /* Get 2 bytes in network order from |pkt| and store the value in |*data| */
  153.   __owur static ossl_inline int PACKET_get_net_2(PACKET *pkt, unsigned int *data)
                ^
  154.   {
  155.       if (!PACKET_peek_net_2(pkt, data))

ssl/packet_locl.h:155:10: Call
  153.   __owur static ossl_inline int PACKET_get_net_2(PACKET *pkt, unsigned int *data)
  154.   {
  155.       if (!PACKET_peek_net_2(pkt, data))
                  ^
  156.           return 0;
  157.   

ssl/packet_locl.h:139:8: Parameter `pkt->remaining`
    137.    * |*data|
    138.    */
    139.   __owur static ossl_inline int PACKET_peek_net_2(const PACKET *pkt,
                  ^
    140.                                                   unsigned int *data)
    141.   {

test/bad_dtls_test.c:134:10: Call
132.           return 0;
133.       /* Skip the rest of the record header */
134.       if (!PACKET_forward(&pkt, DTLS1_RT_HEADER_LENGTH - 3))
                ^
135.           return 0;
136.   

ssl/packet_locl.h:419:8: Parameter `len`
  417.   
  418.   /* Move the current reading position forward |len| bytes */
  419.   __owur static ossl_inline int PACKET_forward(PACKET *pkt, size_t len)
                ^
  420.   {
  421.       if (PACKET_remaining(pkt) < len)

test/bad_dtls_test.c:138:10: Call
136.   
137.       /* Check it's a ClientHello */
138.       if (!PACKET_get_1(&pkt, &u) || u != SSL3_MT_CLIENT_HELLO)
                ^
139.           return 0;
140.       /* Skip the rest of the handshake message header */

ssl/packet_locl.h:235:8: Parameter `pkt->remaining`
  233.   
  234.   /* Get 1 byte from |pkt| and store the value in |*data| */
  235.   __owur static ossl_inline int PACKET_get_1(PACKET *pkt, unsigned int *data)
                ^
  236.   {
  237.       if (!PACKET_peek_1(pkt, data))

ssl/packet_locl.h:237:10: Call
  235.   __owur static ossl_inline int PACKET_get_1(PACKET *pkt, unsigned int *data)
  236.   {
  237.       if (!PACKET_peek_1(pkt, data))
                  ^
  238.           return 0;
  239.   

ssl/packet_locl.h:223:8: Parameter `pkt->remaining`
    221.   
    222.   /* Peek ahead at 1 byte from |pkt| and store the value in |*data| */
    223.   __owur static ossl_inline int PACKET_peek_1(const PACKET *pkt,
                  ^
    224.                                               unsigned int *data)
    225.   {

test/bad_dtls_test.c:141:10: Call
139.           return 0;
140.       /* Skip the rest of the handshake message header */
141.       if (!PACKET_forward(&pkt, DTLS1_HM_HEADER_LENGTH - 1))
                ^
142.           return 0;
143.   

ssl/packet_locl.h:419:8: Parameter `len`
  417.   
  418.   /* Move the current reading position forward |len| bytes */
  419.   __owur static ossl_inline int PACKET_forward(PACKET *pkt, size_t len)
                ^
  420.   {
  421.       if (PACKET_remaining(pkt) < len)

test/bad_dtls_test.c:145:10: Call
143.   
144.       /* Check client version */
145.       if (!PACKET_get_net_2(&pkt, &u) || u != DTLS1_BAD_VER)
                ^
146.           return 0;
147.   

ssl/packet_locl.h:153:8: Parameter `pkt->remaining`
  151.   /* Equivalent of n2s */
  152.   /* Get 2 bytes in network order from |pkt| and store the value in |*data| */
  153.   __owur static ossl_inline int PACKET_get_net_2(PACKET *pkt, unsigned int *data)
                ^
  154.   {
  155.       if (!PACKET_peek_net_2(pkt, data))

ssl/packet_locl.h:155:10: Call
  153.   __owur static ossl_inline int PACKET_get_net_2(PACKET *pkt, unsigned int *data)
  154.   {
  155.       if (!PACKET_peek_net_2(pkt, data))
                  ^
  156.           return 0;
  157.   

ssl/packet_locl.h:139:8: Parameter `pkt->remaining`
    137.    * |*data|
    138.    */
    139.   __owur static ossl_inline int PACKET_peek_net_2(const PACKET *pkt,
                  ^
    140.                                                   unsigned int *data)
    141.   {

test/bad_dtls_test.c:149:10: Call
147.   
148.       /* Store random */
149.       if (!PACKET_copy_bytes(&pkt, client_random, SSL3_RANDOM_SIZE))
                ^
150.           return 0;
151.   

ssl/packet_locl.h:331:8: Parameter `len`
  329.    * The caller is responsible for ensuring that |data| can hold |len| bytes.
  330.    */
  331.   __owur static ossl_inline int PACKET_copy_bytes(PACKET *pkt,
                ^
  332.                                                   unsigned char *data, size_t len)
  333.   {

ssl/packet_locl.h:337:5: Call
  335.           return 0;
  336.   
  337.       packet_forward(pkt, len);
             ^
  338.   
  339.       return 1;

ssl/packet_locl.h:33:1: <LHS trace>
31.   
32.   /* Internal unchecked shorthand; don't use outside this file. */
33. > static ossl_inline void packet_forward(PACKET *pkt, size_t len)
34.   {
35.       pkt->curr += len;

ssl/packet_locl.h:33:1: Parameter `pkt->remaining`
    31.   
    32.   /* Internal unchecked shorthand; don't use outside this file. */
    33. > static ossl_inline void packet_forward(PACKET *pkt, size_t len)
    34.   {
    35.       pkt->curr += len;

ssl/packet_locl.h:33:1: <RHS trace>
31.   
32.   /* Internal unchecked shorthand; don't use outside this file. */
33. > static ossl_inline void packet_forward(PACKET *pkt, size_t len)
34.   {
35.       pkt->curr += len;

ssl/packet_locl.h:33:1: Parameter `len`
    31.   
    32.   /* Internal unchecked shorthand; don't use outside this file. */
    33. > static ossl_inline void packet_forward(PACKET *pkt, size_t len)
    34.   {
    35.       pkt->curr += len;

ssl/packet_locl.h:36:5: Binary operation: ([2, +oo] - 32):unsigned64 by call to `PACKET_copy_bytes` 
    34.   {
    35.       pkt->curr += len;
    36.       pkt->remaining -= len;
              ^
    37.   }
    38.   

static ossl_inline void packet_forward(PACKET *pkt, size_t len)
{
    pkt->curr += len;
    pkt->remaining -= len;
}
['static int validate_client_hello(BIO *wbio)\n{\n    PACKET pkt, pkt2;\n    long len;\n    unsigned char *data;\n    int cookie_found = 0;\n    unsigned int u;\n    len = BIO_get_mem_data(wbio, (char **)&data);\n    if (!PACKET_buf_init(&pkt, data, len))\n        return 0;\n    if (!PACKET_get_1(&pkt, &u) || u != SSL3_RT_HANDSHAKE)\n        return 0;\n    if (!PACKET_get_net_2(&pkt, &u) || u != DTLS1_BAD_VER)\n        return 0;\n    if (!PACKET_forward(&pkt, DTLS1_RT_HEADER_LENGTH - 3))\n        return 0;\n    if (!PACKET_get_1(&pkt, &u) || u != SSL3_MT_CLIENT_HELLO)\n        return 0;\n    if (!PACKET_forward(&pkt, DTLS1_HM_HEADER_LENGTH - 1))\n        return 0;\n    if (!PACKET_get_net_2(&pkt, &u) || u != DTLS1_BAD_VER)\n        return 0;\n    if (!PACKET_copy_bytes(&pkt, client_random, SSL3_RANDOM_SIZE))\n        return 0;\n    if (!PACKET_get_length_prefixed_1(&pkt, &pkt2) ||\n        !PACKET_equal(&pkt2, session_id, sizeof(session_id)))\n        return 0;\n    if (!PACKET_get_length_prefixed_1(&pkt, &pkt2))\n        return 0;\n    if (PACKET_remaining(&pkt2)) {\n        if (!PACKET_equal(&pkt2, cookie, sizeof(cookie)))\n            return 0;\n        cookie_found = 1;\n    }\n    if (!PACKET_get_net_2(&pkt, &u) || !PACKET_forward(&pkt, u))\n        return 0;\n    if (!PACKET_get_1(&pkt, &u) || !PACKET_forward(&pkt, u))\n        return 0;\n    if (!PACKET_get_net_2(&pkt, &u) || !PACKET_forward(&pkt, u))\n        return 0;\n    if (PACKET_remaining(&pkt))\n        return 0;\n    if (cookie_found && !EVP_DigestUpdate(handshake_md, data + MAC_OFFSET,\n                                          len - MAC_OFFSET))\n            printf("EVP_DigestUpdate() failed\\n");\n    (void)BIO_reset(wbio);\n    return 1 + cookie_found;\n}', 'static ossl_inline void packet_forward(PACKET *pkt, size_t len)\n{\n    pkt->curr += len;\n    pkt->remaining -= len;\n}']