ssl/statem/statem_srvr.c:2022: error: INTEGER_OVERFLOW_L2
  ([2, max(2147483644, `s->init_buf->max`)] - [1, 2147483644]):unsigned64 by call to `BUF_MEM_grow_clean`.
Showing all 9 steps of the trace


ssl/statem/statem_srvr.c:1980:1: Parameter `s->init_buf->max`
1978.   }
1979.   
1980. > int tls_construct_certificate_request(SSL *s)
1981.   {
1982.       unsigned char *p, *d;

ssl/statem/statem_srvr.c:2022:18: Call
2020.               name = sk_X509_NAME_value(sk, i);
2021.               j = i2d_X509_NAME(name, NULL);
2022.               if (!BUF_MEM_grow_clean(buf, SSL_HM_HEADER_LENGTH(s) + n + j + 2)) {
                         ^
2023.                   SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_BUF_LIB);
2024.                   goto err;

crypto/buffer/buffer.c:109:1: Parameter `len`
  107.   }
  108.   
  109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
  110.   {
  111.       char *ret;

crypto/buffer/buffer.c:134:15: Call
  132.           ret = sec_alloc_realloc(str, n);
  133.       else
  134.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                       ^
  135.       if (ret == NULL) {
  136.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:136:1: <LHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
    134.   }
    135.   
    136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
    137.                              const char *file, int line)
    138.   {

crypto/mem.c:136:1: <RHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
    134.   }
    135.   
    136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
    137.                              const char *file, int line)
    138.   {

crypto/mem.c:151:9: Binary operation: ([2, max(2147483644, s->init_buf->max)] - [1, 2147483644]):unsigned64 by call to `BUF_MEM_grow_clean` 
    149.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
    150.       if (num < old_len) {
    151.           OPENSSL_cleanse((char*)str + num, old_len - num);
                   ^
    152.           return str;
    153.       }

void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
                           const char *file, int line)
{
    void *ret = NULL;
    if (str == NULL)
        return CRYPTO_malloc(num, file, line);
    if (num == 0) {
        CRYPTO_clear_free(str, old_len, file, line);
        return NULL;
    }
    if (num < old_len) {
        OPENSSL_cleanse((char*)str + num, old_len - num);
        return str;
    }
    ret = CRYPTO_malloc(num, file, line);
    if (ret != NULL) {
        memcpy(ret, str, old_len);
        CRYPTO_clear_free(str, old_len, file, line);
    }
    return ret;
}
['int tls_construct_certificate_request(SSL *s)\n{\n    unsigned char *p, *d;\n    int i, j, nl, off, n;\n    STACK_OF(X509_NAME) *sk = NULL;\n    X509_NAME *name;\n    BUF_MEM *buf;\n    buf = s->init_buf;\n    d = p = ssl_handshake_start(s);\n    p++;\n    n = ssl3_get_req_cert_type(s, p);\n    d[0] = n;\n    p += n;\n    n++;\n    if (SSL_USE_SIGALGS(s)) {\n        const unsigned char *psigs;\n        unsigned char *etmp = p;\n        nl = tls12_get_psigalgs(s, &psigs);\n        p += 2;\n        nl = tls12_copy_sigalgs(s, p, psigs, nl);\n        s2n(nl, etmp);\n        p += nl;\n        n += nl + 2;\n    }\n    off = n;\n    p += 2;\n    n += 2;\n    sk = SSL_get_client_CA_list(s);\n    nl = 0;\n    if (sk != NULL) {\n        for (i = 0; i < sk_X509_NAME_num(sk); i++) {\n            name = sk_X509_NAME_value(sk, i);\n            j = i2d_X509_NAME(name, NULL);\n            if (!BUF_MEM_grow_clean(buf, SSL_HM_HEADER_LENGTH(s) + n + j + 2)) {\n                SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_BUF_LIB);\n                goto err;\n            }\n            p = ssl_handshake_start(s) + n;\n            s2n(j, p);\n            i2d_X509_NAME(name, &p);\n            n += 2 + j;\n            nl += 2 + j;\n        }\n    }\n    p = ssl_handshake_start(s) + off;\n    s2n(nl, p);\n    if (!ssl_set_handshake_header(s, SSL3_MT_CERTIFICATE_REQUEST, n)) {\n        SSLerr(SSL_F_TLS_CONSTRUCT_CERTIFICATE_REQUEST, ERR_R_INTERNAL_ERROR);\n        goto err;\n    }\n    s->s3->tmp.cert_request = 1;\n    return 1;\n err:\n    ossl_statem_set_error(s);\n    return 0;\n}', 'size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)\n{\n    char *ret;\n    size_t n;\n    if (str->length >= len) {\n        if (str->data != NULL)\n            memset(&str->data[len], 0, str->length - len);\n        str->length = len;\n        return (len);\n    }\n    if (str->max >= len) {\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n        return (len);\n    }\n    if (len > LIMIT_BEFORE_EXPANSION) {\n        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);\n        return 0;\n    }\n    n = (len + 3) / 3 * 4;\n    if ((str->flags & BUF_MEM_FLAG_SECURE))\n        ret = sec_alloc_realloc(str, n);\n    else\n        ret = OPENSSL_clear_realloc(str->data, str->max, n);\n    if (ret == NULL) {\n        BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);\n        len = 0;\n    } else {\n        str->data = ret;\n        str->max = n;\n        memset(&str->data[str->length], 0, len - str->length);\n        str->length = len;\n    }\n    return (len);\n}', 'void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,\n                           const char *file, int line)\n{\n    void *ret = NULL;\n    if (str == NULL)\n        return CRYPTO_malloc(num, file, line);\n    if (num == 0) {\n        CRYPTO_clear_free(str, old_len, file, line);\n        return NULL;\n    }\n    if (num < old_len) {\n        OPENSSL_cleanse((char*)str + num, old_len - num);\n        return str;\n    }\n    ret = CRYPTO_malloc(num, file, line);\n    if (ret != NULL) {\n        memcpy(ret, str, old_len);\n        CRYPTO_clear_free(str, old_len, file, line);\n    }\n    return ret;\n}']