ssl/d1_both.c:623: error: INTEGER_OVERFLOW_L2
  ([-oo, 2147483647] + 3):signed32 by call to `BUF_MEM_grow_clean`.
Showing all 8 steps of the trace


ssl/d1_both.c:563:2: Call
561.   	/* parse the message fragment header */
562.   
563.   	dtls1_get_message_header(p, &msg_hdr);
        ^
564.   
565.   	/* 

ssl/d1_both.c:1240:1: Parameter `*data`
  1238.   	}
  1239.   
  1240. > void
  1241.   dtls1_get_message_header(unsigned char *data, struct hm_header_st *msg_hdr)
  1242.   	{

ssl/d1_both.c:1245:2: Assignment
  1243.   	memset(msg_hdr, 0x00, sizeof(struct hm_header_st));
  1244.   	msg_hdr->type = *(data++);
  1245.   	n2l3(data, msg_hdr->msg_len);
           ^
  1246.   
  1247.   	n2s(data, msg_hdr->seq);

ssl/d1_both.c:572:2: Assignment
570.   		return dtls1_process_out_of_seq_message(s, &msg_hdr, ok);
571.   
572.   	l = msg_hdr.msg_len;
        ^
573.   	frag_off = msg_hdr.frag_off;
574.   	frag_len = msg_hdr.frag_len;

ssl/d1_both.c:623:13: Call
621.   			goto f_err;
622.   			}
623.   		if (l && !BUF_MEM_grow_clean(s->init_buf,(int)l
                   ^
624.   			+ DTLS1_HM_HEADER_LENGTH))
625.   			{

crypto/buffer/buffer.c:128:1: <LHS trace>
126.   	}
127.   
128. > int BUF_MEM_grow_clean(BUF_MEM *str, int len)
129.   	{
130.   	char *ret;

crypto/buffer/buffer.c:128:1: Parameter `len`
  126.   	}
  127.   
  128. > int BUF_MEM_grow_clean(BUF_MEM *str, int len)
  129.   	{
  130.   	char *ret;

crypto/buffer/buffer.c:145:2: Binary operation: ([-oo, 2147483647] + 3):signed32 by call to `BUF_MEM_grow_clean` 
  143.   		return(len);
  144.   		}
  145.   	n=(len+3)/3*4;
          ^
  146.   	if (str->data == NULL)
  147.   		ret=OPENSSL_malloc(n);

int BUF_MEM_grow_clean(BUF_MEM *str, int len)
	{
	char *ret;
	unsigned int n;
	if (str->length >= len)
		{
		memset(&str->data[len],0,str->length-len);
		str->length=len;
		return(len);
		}
	if (str->max >= len)
		{
		memset(&str->data[str->length],0,len-str->length);
		str->length=len;
		return(len);
		}
	n=(len+3)/3*4;
	if (str->data == NULL)
		ret=OPENSSL_malloc(n);
	else
		ret=OPENSSL_realloc_clean(str->data,str->max,n);
	if (ret == NULL)
		{
		BUFerr(BUF_F_BUF_MEM_GROW_CLEAN,ERR_R_MALLOC_FAILURE);
		len=0;
		}
	else
		{
		str->data=ret;
		str->max=n;
		memset(&str->data[str->length],0,len-str->length);
		str->length=len;
		}
	return(len);
	}
['static long\ndtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)\n\t{\n\tunsigned char *p;\n\tunsigned long l, frag_off, frag_len;\n\tint i,al;\n\tstruct hm_header_st msg_hdr;\n\tunsigned long overlap;\n\tif (dtls1_retrieve_buffered_fragment(s, &l))\n\t{\n\t\tdtls1_process_handshake_fragment(s, l);\n\t\ts->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;\n\t\ts->state = stn;\n\t\treturn 1;\n\t}\n\tp = (unsigned char *)s->init_buf->data;\n\ti=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],\n\t\tDTLS1_HM_HEADER_LENGTH, 0);\n\tif (i <= 0)\n\t\t{\n\t\ts->rwstate=SSL_READING;\n\t\t*ok = 0;\n\t\treturn i;\n\t\t}\n\tOPENSSL_assert(i == DTLS1_HM_HEADER_LENGTH);\n\tp += s->init_num;\n\tdtls1_get_message_header(p, &msg_hdr);\n\tif ( msg_hdr.seq != s->d1->handshake_read_seq)\n\t\treturn dtls1_process_out_of_seq_message(s, &msg_hdr, ok);\n\tl = msg_hdr.msg_len;\n\tfrag_off = msg_hdr.frag_off;\n\tfrag_len = msg_hdr.frag_len;\n\tif ( frag_off + frag_len > l)\n\t\t{\n\t\tal=SSL_AD_ILLEGAL_PARAMETER;\n\t\tSSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL_R_EXCESSIVE_MESSAGE_SIZE);\n\t\tgoto f_err;\n\t\t}\n\tif (!s->server && s->d1->r_msg_hdr.frag_off == 0 &&\n\t\tp[0] == SSL3_MT_HELLO_REQUEST)\n\t\t{\n\t\tif (p[1] == 0 && p[2] == 0 &&p[3] == 0)\n\t\t\t{\n\t\t\tif (s->msg_callback)\n\t\t\t\ts->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,\n\t\t\t\t\tp, DTLS1_HM_HEADER_LENGTH, s,\n\t\t\t\t\ts->msg_callback_arg);\n\t\t\ts->init_num = 0;\n\t\t\treturn dtls1_get_message_fragment(s, st1, stn,\n\t\t\t\tmax, ok);\n\t\t\t}\n\t\telse\n\t\t\t{\n\t\t\tal=SSL_AD_UNEXPECTED_MESSAGE;\n\t\t\tSSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL_R_UNEXPECTED_MESSAGE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\t}\n\ts->init_num += i;\n\tif ( s->d1->r_msg_hdr.frag_off == 0)\n\t\t{\n\t\tif (l > (INT_MAX-DTLS1_HM_HEADER_LENGTH))\n\t\t\t{\n\t\t\tal=SSL_AD_ILLEGAL_PARAMETER;\n\t\t\tSSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL_R_EXCESSIVE_MESSAGE_SIZE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\tif (l && !BUF_MEM_grow_clean(s->init_buf,(int)l\n\t\t\t+ DTLS1_HM_HEADER_LENGTH))\n\t\t\t{\n\t\t\tSSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,ERR_R_BUF_LIB);\n\t\t\tgoto err;\n\t\t\t}\n\t\tif ( l > (unsigned long)max)\n\t\t\t{\n\t\t\tal=SSL_AD_ILLEGAL_PARAMETER;\n\t\t\tSSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL_R_EXCESSIVE_MESSAGE_SIZE);\n\t\t\tgoto f_err;\n\t\t\t}\n\t\ts->s3->tmp.message_size=l;\n\t\t}\n\tif ( frag_len > (unsigned long)max)\n\t\t{\n\t\tal=SSL_AD_ILLEGAL_PARAMETER;\n\t\tSSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL_R_EXCESSIVE_MESSAGE_SIZE);\n\t\tgoto f_err;\n\t\t}\n\tif ( frag_len + s->init_num > (INT_MAX - DTLS1_HM_HEADER_LENGTH))\n\t\t{\n\t\tal=SSL_AD_ILLEGAL_PARAMETER;\n\t\tSSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL_R_EXCESSIVE_MESSAGE_SIZE);\n\t\tgoto f_err;\n\t\t}\n\tif ( frag_len & !BUF_MEM_grow_clean(s->init_buf, (int)frag_len\n\t\t\t + DTLS1_HM_HEADER_LENGTH + s->init_num))\n\t\t{\n\t\tSSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,ERR_R_BUF_LIB);\n\t\tgoto err;\n\t\t}\n\tif ( s->d1->r_msg_hdr.frag_off == 0)\n\t\t{\n\t\ts->s3->tmp.message_type = msg_hdr.type;\n\t\ts->d1->r_msg_hdr.type = msg_hdr.type;\n\t\ts->d1->r_msg_hdr.msg_len = l;\n\t\t}\n\ts->state=stn;\n\tp = (unsigned char *)s->init_buf->data;\n\tif ( frag_len > 0)\n\t\t{\n\t\ti=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,\n\t\t\t&p[s->init_num],\n\t\t\tfrag_len,0);\n\t\tif (i <= 0)\n\t\t\t{\n\t\t\ts->rwstate=SSL_READING;\n\t\t\t*ok = 0;\n\t\t\treturn i;\n\t\t\t}\n\t\t}\n\telse\n\t\ti = 0;\n\tOPENSSL_assert(i == (int)frag_len);\n#if 0\n\tif ( msg_hdr.seq > s->d1->handshake_read_seq ||\n\t\tfrag_off > s->init_num - DTLS1_HM_HEADER_LENGTH)\n\t{\n\t\tdtls1_buffer_handshake_fragment(s, &msg_hdr);\n\t\treturn DTLS1_HM_FRAGMENT_RETRY;\n\t}\n\tif ( msg_hdr.seq < s->d1->handshake_read_seq ||\n\t\tfrag_off + frag_len < s->init_num - DTLS1_HM_HEADER_LENGTH)\n\t\t{\n\t\ts->init_num -= DTLS1_HM_HEADER_LENGTH;\n\t\treturn DTLS1_HM_FRAGMENT_RETRY;\n\t\t}\n#endif\n\toverlap = (s->init_num - DTLS1_HM_HEADER_LENGTH) - frag_off;\n\tif ( s->init_num > DTLS1_HM_HEADER_LENGTH)\n\t\t{\n\t\tmemmove(&(s->init_buf->data[s->init_num]),\n\t\t\t&(s->init_buf->data[s->init_num + DTLS1_HM_HEADER_LENGTH + overlap]),\n\t\t\tfrag_len - overlap);\n\t\ts->init_num += frag_len - overlap;\n\t\t}\n\telse\n\t\ts->init_num += frag_len;\n\tdtls1_process_handshake_fragment(s, frag_len - overlap);\n\tif (s->msg_callback)\n\t\ts->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->init_buf->data,\n\t\t\t(size_t)s->init_num, s,\n\t\t\ts->msg_callback_arg);\n\t*ok=1;\n\treturn s->init_num;\nf_err:\n\tssl3_send_alert(s,SSL3_AL_FATAL,al);\n\ts->init_num = 0;\nerr:\n\t*ok=0;\n\treturn(-1);\n\t}', 'void\ndtls1_get_message_header(unsigned char *data, struct hm_header_st *msg_hdr)\n\t{\n\tmemset(msg_hdr, 0x00, sizeof(struct hm_header_st));\n\tmsg_hdr->type = *(data++);\n\tn2l3(data, msg_hdr->msg_len);\n\tn2s(data, msg_hdr->seq);\n\tn2l3(data, msg_hdr->frag_off);\n\tn2l3(data, msg_hdr->frag_len);\n\t}', 'int BUF_MEM_grow_clean(BUF_MEM *str, int len)\n\t{\n\tchar *ret;\n\tunsigned int n;\n\tif (str->length >= len)\n\t\t{\n\t\tmemset(&str->data[len],0,str->length-len);\n\t\tstr->length=len;\n\t\treturn(len);\n\t\t}\n\tif (str->max >= len)\n\t\t{\n\t\tmemset(&str->data[str->length],0,len-str->length);\n\t\tstr->length=len;\n\t\treturn(len);\n\t\t}\n\tn=(len+3)/3*4;\n\tif (str->data == NULL)\n\t\tret=OPENSSL_malloc(n);\n\telse\n\t\tret=OPENSSL_realloc_clean(str->data,str->max,n);\n\tif (ret == NULL)\n\t\t{\n\t\tBUFerr(BUF_F_BUF_MEM_GROW_CLEAN,ERR_R_MALLOC_FAILURE);\n\t\tlen=0;\n\t\t}\n\telse\n\t\t{\n\t\tstr->data=ret;\n\t\tstr->max=n;\n\t\tmemset(&str->data[str->length],0,len-str->length);\n\t\tstr->length=len;\n\t\t}\n\treturn(len);\n\t}']