ssl/record/rec_layer_s3.c:945: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [0, 2]):unsigned64 by call to `WPACKET_close`.
Showing all 10 steps of the trace


ssl/record/rec_layer_s3.c:733:14: Call
731.   #endif
732.           SSL3_BUFFER_set_offset(wb, align);
733.           if (!WPACKET_init_static_len(&pkt[0], SSL3_BUFFER_get_buf(wb),
                    ^
734.                                        SSL3_BUFFER_get_len(wb), 0)
735.                   || !WPACKET_allocate_bytes(&pkt[0], align, NULL)) {

ssl/packet.c:117:1: Parameter `pkt->curr`
  115.   }
  116.   
  117. > int WPACKET_init_static_len(WPACKET *pkt, unsigned char *buf, size_t len,
  118.                               size_t lenbytes)
  119.   {

ssl/record/rec_layer_s3.c:945:21: Call
943.   
944.           if (!WPACKET_get_length(thispkt, &len)
945.                   || !WPACKET_close(thispkt)) {
                           ^
946.               SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);
947.               goto err;

ssl/packet.c:220:1: Parameter `pkt->curr`
  218.   }
  219.   
  220. > int WPACKET_close(WPACKET *pkt)
  221.   {
  222.       /*

ssl/packet.c:229:12: Call
  227.           return 0;
  228.   
  229.       return wpacket_intern_close(pkt);
                    ^
  230.   }
  231.   

ssl/packet.c:186:1: <LHS trace>
184.    * close a sub-packet and write out its length if necessary.
185.    */
186. > static int wpacket_intern_close(WPACKET *pkt)
187.   {
188.       WPACKET_SUB *sub = pkt->subs;

ssl/packet.c:186:1: Parameter `pkt->curr`
    184.    * close a sub-packet and write out its length if necessary.
    185.    */
    186. > static int wpacket_intern_close(WPACKET *pkt)
    187.   {
    188.       WPACKET_SUB *sub = pkt->subs;

ssl/packet.c:186:1: <RHS trace>
184.    * close a sub-packet and write out its length if necessary.
185.    */
186. > static int wpacket_intern_close(WPACKET *pkt)
187.   {
188.       WPACKET_SUB *sub = pkt->subs;

ssl/packet.c:186:1: Parameter `pkt->subs->lenbytes`
    184.    * close a sub-packet and write out its length if necessary.
    185.    */
    186. > static int wpacket_intern_close(WPACKET *pkt)
    187.   {
    188.       WPACKET_SUB *sub = pkt->subs;

ssl/packet.c:198:13: Binary operation: ([0, +oo] - [0, 2]):unsigned64 by call to `WPACKET_close` 
    196.               && sub->flags & WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH) {
    197.           /* Deallocate any bytes allocated for the length of the WPACKET */
    198.           if ((pkt->curr - sub->lenbytes) == sub->packet_len) {
                       ^
    199.               pkt->written -= sub->lenbytes;
    200.               pkt->curr -= sub->lenbytes;

static int wpacket_intern_close(WPACKET *pkt)
{
    WPACKET_SUB *sub = pkt->subs;
    size_t packlen = pkt->written - sub->pwritten;
    if (packlen == 0
            && (sub->flags & WPACKET_FLAGS_NON_ZERO_LENGTH) != 0)
        return 0;
    if (packlen == 0
            && sub->flags & WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH) {
        if ((pkt->curr - sub->lenbytes) == sub->packet_len) {
            pkt->written -= sub->lenbytes;
            pkt->curr -= sub->lenbytes;
        }
        sub->packet_len = 0;
        sub->lenbytes = 0;
    }
    if (sub->lenbytes > 0
                && !put_value(&GETBUF(pkt)[sub->packet_len], packlen,
                              sub->lenbytes))
            return 0;
    pkt->subs = sub->parent;
    OPENSSL_free(sub);
    return 1;
}
['int do_ssl3_write(SSL *s, int type, const unsigned char *buf,\n                  size_t *pipelens, size_t numpipes,\n                  int create_empty_fragment, size_t *written)\n{\n    WPACKET pkt[SSL_MAX_PIPELINES];\n    SSL3_RECORD wr[SSL_MAX_PIPELINES];\n    WPACKET *thispkt;\n    SSL3_RECORD *thiswr;\n    unsigned char *recordstart;\n    int i, mac_size, clear = 0;\n    size_t prefix_len = 0;\n    int eivlen = 0;\n    size_t align = 0;\n    SSL3_BUFFER *wb;\n    SSL_SESSION *sess;\n    size_t totlen = 0, len, wpinited = 0;\n    size_t j;\n    for (j = 0; j < numpipes; j++)\n        totlen += pipelens[j];\n    if (RECORD_LAYER_write_pending(&s->rlayer))\n        return ssl3_write_pending(s, type, buf, totlen, written);\n    if (s->s3->alert_dispatch) {\n        i = s->method->ssl_dispatch_alert(s);\n        if (i <= 0)\n            return (i);\n    }\n    if (s->rlayer.numwpipes < numpipes)\n        if (!ssl3_setup_write_buffer(s, numpipes, 0))\n            return -1;\n    if (totlen == 0 && !create_empty_fragment)\n        return 0;\n    sess = s->session;\n    if ((sess == NULL) ||\n        (s->enc_write_ctx == NULL) || (EVP_MD_CTX_md(s->write_hash) == NULL)) {\n        clear = s->enc_write_ctx ? 0 : 1;\n        mac_size = 0;\n    } else {\n        mac_size = EVP_MD_CTX_size(s->write_hash);\n        if (mac_size < 0)\n            goto err;\n    }\n    if (!clear && !create_empty_fragment && !s->s3->empty_fragment_done) {\n        if (s->s3->need_empty_fragments && type == SSL3_RT_APPLICATION_DATA) {\n            size_t tmppipelen = 0;\n            int ret;\n            ret = do_ssl3_write(s, type, buf, &tmppipelen, 1, 1, &prefix_len);\n            if (ret <= 0)\n                goto err;\n            if (prefix_len >\n                (SSL3_RT_HEADER_LENGTH + SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD)) {\n                SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);\n                goto err;\n            }\n        }\n        s->s3->empty_fragment_done = 1;\n    }\n    if (create_empty_fragment) {\n        wb = &s->rlayer.wbuf[0];\n#if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0\n        align = (size_t)SSL3_BUFFER_get_buf(wb) + 2 * SSL3_RT_HEADER_LENGTH;\n        align = SSL3_ALIGN_PAYLOAD - 1 - ((align - 1) % SSL3_ALIGN_PAYLOAD);\n#endif\n        SSL3_BUFFER_set_offset(wb, align);\n        if (!WPACKET_init_static_len(&pkt[0], SSL3_BUFFER_get_buf(wb),\n                                     SSL3_BUFFER_get_len(wb), 0)\n                || !WPACKET_allocate_bytes(&pkt[0], align, NULL)) {\n            SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n        wpinited = 1;\n    } else if (prefix_len) {\n        wb = &s->rlayer.wbuf[0];\n        if (!WPACKET_init_static_len(&pkt[0],\n                                     SSL3_BUFFER_get_buf(wb),\n                                     SSL3_BUFFER_get_len(wb), 0)\n                || !WPACKET_allocate_bytes(&pkt[0], SSL3_BUFFER_get_offset(wb)\n                                                    + prefix_len, NULL)) {\n            SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n        wpinited = 1;\n    } else {\n        for (j = 0; j < numpipes; j++) {\n            thispkt = &pkt[j];\n            wb = &s->rlayer.wbuf[j];\n#if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD != 0\n            align = (size_t)SSL3_BUFFER_get_buf(wb) + SSL3_RT_HEADER_LENGTH;\n            align = SSL3_ALIGN_PAYLOAD - 1 - ((align - 1) % SSL3_ALIGN_PAYLOAD);\n#endif\n            SSL3_BUFFER_set_offset(wb, align);\n            if (!WPACKET_init_static_len(thispkt, SSL3_BUFFER_get_buf(wb),\n                                         SSL3_BUFFER_get_len(wb), 0)\n                    || !WPACKET_allocate_bytes(thispkt, align, NULL)) {\n                SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);\n                goto err;\n            }\n            wpinited++;\n        }\n    }\n    if (s->enc_write_ctx && SSL_USE_EXPLICIT_IV(s)) {\n        int mode = EVP_CIPHER_CTX_mode(s->enc_write_ctx);\n        if (mode == EVP_CIPH_CBC_MODE) {\n            eivlen = EVP_CIPHER_CTX_iv_length(s->enc_write_ctx);\n            if (eivlen <= 1)\n                eivlen = 0;\n        } else if (mode == EVP_CIPH_GCM_MODE) {\n            eivlen = EVP_GCM_TLS_EXPLICIT_IV_LEN;\n        } else if (mode == EVP_CIPH_CCM_MODE) {\n            eivlen = EVP_CCM_TLS_EXPLICIT_IV_LEN;\n        }\n    }\n    totlen = 0;\n    memset(wr, 0, sizeof wr);\n    for (j = 0; j < numpipes; j++) {\n        unsigned int version = s->version;\n        unsigned char *compressdata = NULL;\n        size_t maxcomplen;\n        unsigned int rectype;\n        thispkt = &pkt[j];\n        thiswr = &wr[j];\n        SSL3_RECORD_set_type(thiswr, type);\n        if (SSL_IS_TLS13(s) && s->enc_write_ctx != NULL)\n            rectype = SSL3_RT_APPLICATION_DATA;\n        else\n            rectype = type;\n        if (SSL_get_state(s) == TLS_ST_CW_CLNT_HELLO\n            && !s->renegotiate && TLS1_get_version(s) > TLS1_VERSION)\n            version = TLS1_VERSION;\n        maxcomplen = pipelens[j];\n        if (s->compress != NULL)\n            pipelens[j] += SSL3_RT_MAX_COMPRESSED_OVERHEAD;\n        if (!WPACKET_put_bytes_u8(thispkt, rectype)\n                || !WPACKET_put_bytes_u16(thispkt, version)\n                || !WPACKET_start_sub_packet_u16(thispkt)\n                || (eivlen > 0\n                    && !WPACKET_allocate_bytes(thispkt, eivlen, NULL))\n                || (maxcomplen > 0\n                    && !WPACKET_reserve_bytes(thispkt, maxcomplen,\n                                              &compressdata))) {\n            SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n        SSL3_RECORD_set_data(thiswr, compressdata);\n        SSL3_RECORD_set_length(thiswr, pipelens[j]);\n        SSL3_RECORD_set_input(thiswr, (unsigned char *)&buf[totlen]);\n        totlen += pipelens[j];\n        if (s->compress != NULL) {\n            if (!ssl3_do_compress(s, thiswr)\n                    || !WPACKET_allocate_bytes(thispkt, thiswr->length, NULL)) {\n                SSLerr(SSL_F_DO_SSL3_WRITE, SSL_R_COMPRESSION_FAILURE);\n                goto err;\n            }\n        } else {\n            if (!WPACKET_memcpy(thispkt, thiswr->input, thiswr->length)) {\n                SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);\n                goto err;\n            }\n            SSL3_RECORD_reset_input(&wr[j]);\n        }\n        if (SSL_IS_TLS13(s) && s->enc_write_ctx != NULL) {\n            if (!WPACKET_put_bytes_u8(thispkt, type)) {\n                SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);\n                goto err;\n            }\n            SSL3_RECORD_add_length(thiswr, 1);\n        }\n        if (!SSL_USE_ETM(s) && mac_size != 0) {\n            unsigned char *mac;\n            if (!WPACKET_allocate_bytes(thispkt, mac_size, &mac)\n                    || !s->method->ssl3_enc->mac(s, thiswr, mac, 1)) {\n                SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);\n                goto err;\n            }\n        }\n        if(!WPACKET_reserve_bytes(thispkt, SSL_RT_MAX_CIPHER_BLOCK_SIZE,\n                                  NULL)\n                || !WPACKET_get_length(thispkt, &len)) {\n            SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n        recordstart = WPACKET_get_curr(thispkt) - len;\n        SSL3_RECORD_set_data(thiswr, recordstart);\n        SSL3_RECORD_reset_input(thiswr);\n        SSL3_RECORD_set_length(thiswr, len);\n    }\n    if (s->method->ssl3_enc->enc(s, wr, numpipes, 1) < 1)\n        goto err;\n    for (j = 0; j < numpipes; j++) {\n        size_t origlen;\n        thispkt = &pkt[j];\n        thiswr = &wr[j];\n        if (!WPACKET_get_length(thispkt, &origlen)\n                || origlen > thiswr->length\n                || (thiswr->length > origlen\n                    && !WPACKET_allocate_bytes(thispkt,\n                                               thiswr->length - origlen, NULL))) {\n            SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n        if (SSL_USE_ETM(s) && mac_size != 0) {\n            unsigned char *mac;\n            if (!WPACKET_allocate_bytes(thispkt, mac_size, &mac)\n                    || !s->method->ssl3_enc->mac(s, thiswr, mac, 1)) {\n                SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);\n                goto err;\n            }\n            SSL3_RECORD_add_length(thiswr, mac_size);\n        }\n        if (!WPACKET_get_length(thispkt, &len)\n                || !WPACKET_close(thispkt)) {\n            SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n        if (s->msg_callback) {\n            recordstart = WPACKET_get_curr(thispkt) - len\n                          - SSL3_RT_HEADER_LENGTH;\n            s->msg_callback(1, 0, SSL3_RT_HEADER, recordstart,\n                            SSL3_RT_HEADER_LENGTH, s,\n                            s->msg_callback_arg);\n        }\n        if (!WPACKET_finish(thispkt)) {\n            SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);\n            goto err;\n        }\n        SSL3_RECORD_set_type(thiswr, type);\n        SSL3_RECORD_add_length(thiswr, SSL3_RT_HEADER_LENGTH);\n        if (create_empty_fragment) {\n            if (j > 0) {\n                SSLerr(SSL_F_DO_SSL3_WRITE, ERR_R_INTERNAL_ERROR);\n                goto err;\n            }\n            *written = SSL3_RECORD_get_length(thiswr);\n            return 1;\n        }\n        SSL3_BUFFER_set_left(&s->rlayer.wbuf[j],\n                             prefix_len + SSL3_RECORD_get_length(thiswr));\n    }\n    s->rlayer.wpend_tot = totlen;\n    s->rlayer.wpend_buf = buf;\n    s->rlayer.wpend_type = type;\n    s->rlayer.wpend_ret = totlen;\n    return ssl3_write_pending(s, type, buf, totlen, written);\n err:\n    for (j = 0; j < wpinited; j++)\n        WPACKET_cleanup(&pkt[j]);\n    return -1;\n}', 'int WPACKET_init_static_len(WPACKET *pkt, unsigned char *buf, size_t len,\n                            size_t lenbytes)\n{\n    size_t max = maxmaxsize(lenbytes);\n    assert(buf != NULL && len > 0);\n    if (buf == NULL || len == 0)\n        return 0;\n    pkt->staticbuf = buf;\n    pkt->buf = NULL;\n    pkt->maxsize = (max < len) ? max : len;\n    return wpacket_intern_init_len(pkt, lenbytes);\n}', 'int WPACKET_close(WPACKET *pkt)\n{\n    if (pkt->subs == NULL || pkt->subs->parent == NULL)\n        return 0;\n    return wpacket_intern_close(pkt);\n}', 'static int wpacket_intern_close(WPACKET *pkt)\n{\n    WPACKET_SUB *sub = pkt->subs;\n    size_t packlen = pkt->written - sub->pwritten;\n    if (packlen == 0\n            && (sub->flags & WPACKET_FLAGS_NON_ZERO_LENGTH) != 0)\n        return 0;\n    if (packlen == 0\n            && sub->flags & WPACKET_FLAGS_ABANDON_ON_ZERO_LENGTH) {\n        if ((pkt->curr - sub->lenbytes) == sub->packet_len) {\n            pkt->written -= sub->lenbytes;\n            pkt->curr -= sub->lenbytes;\n        }\n        sub->packet_len = 0;\n        sub->lenbytes = 0;\n    }\n    if (sub->lenbytes > 0\n                && !put_value(&GETBUF(pkt)[sub->packet_len], packlen,\n                              sub->lenbytes))\n            return 0;\n    pkt->subs = sub->parent;\n    OPENSSL_free(sub);\n    return 1;\n}']