ssl/record/rec_layer_s3.c:302: error: INTEGER_OVERFLOW_L1
  (0 - 5):unsigned64.
Showing all 3 steps of the trace


ssl/record/rec_layer_s3.c:301:5: <RHS trace>
299.       left = rb->left;
300.   #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
301.       align = (size_t)rb->buf + SSL3_RT_HEADER_LENGTH;
           ^
302.       align = (0-align) & (SSL3_ALIGN_PAYLOAD - 1);
303.   #endif

ssl/record/rec_layer_s3.c:301:5: Assignment
299.       left = rb->left;
300.   #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
301.       align = (size_t)rb->buf + SSL3_RT_HEADER_LENGTH;
           ^
302.       align = (0-align) & (SSL3_ALIGN_PAYLOAD - 1);
303.   #endif

ssl/record/rec_layer_s3.c:302:5: Binary operation: (0 - 5):unsigned64
300.   #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
301.       align = (size_t)rb->buf + SSL3_RT_HEADER_LENGTH;
302.       align = (0-align) & (SSL3_ALIGN_PAYLOAD - 1);
           ^
303.   #endif
304.   

int ssl3_read_n(SSL *s, int n, int max, int extend)
{
    int i, len, left;
    size_t align = 0;
    unsigned char *pkt;
    SSL3_BUFFER *rb;
    if (n <= 0)
        return n;
    rb = &s->rlayer.rbuf;
    if (rb->buf == NULL)
        if (!ssl3_setup_read_buffer(s))
            return -1;
    left = rb->left;
#if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
    align = (size_t)rb->buf + SSL3_RT_HEADER_LENGTH;
    align = (0-align) & (SSL3_ALIGN_PAYLOAD - 1);
#endif
    if (!extend) {
        if (left == 0)
            rb->offset = align;
        else if (align != 0 && left >= SSL3_RT_HEADER_LENGTH) {
            pkt = rb->buf + rb->offset;
            if (pkt[0] == SSL3_RT_APPLICATION_DATA
                && (pkt[3] << 8 | pkt[4]) >= 128) {
                memmove(rb->buf + align, pkt, left);
                rb->offset = align;
            }
        }
        s->rlayer.packet = rb->buf + rb->offset;
        s->rlayer.packet_length = 0;
    }
    if (SSL_IS_DTLS(s)) {
        if (left == 0 && extend)
            return 0;
        if (left > 0 && n > left)
            n = left;
    }
    if (left >= n) {
        s->rlayer.packet_length += n;
        rb->left = left - n;
        rb->offset += n;
        return (n);
    }
    len = s->rlayer.packet_length;
    pkt = rb->buf + align;
    if (s->rlayer.packet != pkt) {
        memmove(pkt, s->rlayer.packet, len + left);
        s->rlayer.packet = pkt;
        rb->offset = len + align;
    }
    if (n > (int)(rb->len - rb->offset)) {
        SSLerr(SSL_F_SSL3_READ_N, ERR_R_INTERNAL_ERROR);
        return -1;
    }
    if (!s->rlayer.read_ahead && !SSL_IS_DTLS(s))
        max = n;
    else {
        if (max < n)
            max = n;
        if (max > (int)(rb->len - rb->offset))
            max = rb->len - rb->offset;
    }
    while (left < n) {
        clear_sys_error();
        if (s->rbio != NULL) {
            s->rwstate = SSL_READING;
            i = BIO_read(s->rbio, pkt + len + left, max - left);
        } else {
            SSLerr(SSL_F_SSL3_READ_N, SSL_R_READ_BIO_NOT_SET);
            i = -1;
        }
        if (i <= 0) {
            rb->left = left;
            if (s->mode & SSL_MODE_RELEASE_BUFFERS && !SSL_IS_DTLS(s))
                if (len + left == 0)
                    ssl3_release_read_buffer(s);
            return (i);
        }
        left += i;
        if (SSL_IS_DTLS(s)) {
            if (n > left)
                n = left;
        }
    }
    rb->offset += n;
    rb->left = left - n;
    s->rlayer.packet_length += n;
    s->rwstate = SSL_NOTHING;
    return (n);
}
['int ssl3_read_n(SSL *s, int n, int max, int extend)\n{\n    int i, len, left;\n    size_t align = 0;\n    unsigned char *pkt;\n    SSL3_BUFFER *rb;\n    if (n <= 0)\n        return n;\n    rb = &s->rlayer.rbuf;\n    if (rb->buf == NULL)\n        if (!ssl3_setup_read_buffer(s))\n            return -1;\n    left = rb->left;\n#if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0\n    align = (size_t)rb->buf + SSL3_RT_HEADER_LENGTH;\n    align = (0-align) & (SSL3_ALIGN_PAYLOAD - 1);\n#endif\n    if (!extend) {\n        if (left == 0)\n            rb->offset = align;\n        else if (align != 0 && left >= SSL3_RT_HEADER_LENGTH) {\n            pkt = rb->buf + rb->offset;\n            if (pkt[0] == SSL3_RT_APPLICATION_DATA\n                && (pkt[3] << 8 | pkt[4]) >= 128) {\n                memmove(rb->buf + align, pkt, left);\n                rb->offset = align;\n            }\n        }\n        s->rlayer.packet = rb->buf + rb->offset;\n        s->rlayer.packet_length = 0;\n    }\n    if (SSL_IS_DTLS(s)) {\n        if (left == 0 && extend)\n            return 0;\n        if (left > 0 && n > left)\n            n = left;\n    }\n    if (left >= n) {\n        s->rlayer.packet_length += n;\n        rb->left = left - n;\n        rb->offset += n;\n        return (n);\n    }\n    len = s->rlayer.packet_length;\n    pkt = rb->buf + align;\n    if (s->rlayer.packet != pkt) {\n        memmove(pkt, s->rlayer.packet, len + left);\n        s->rlayer.packet = pkt;\n        rb->offset = len + align;\n    }\n    if (n > (int)(rb->len - rb->offset)) {\n        SSLerr(SSL_F_SSL3_READ_N, ERR_R_INTERNAL_ERROR);\n        return -1;\n    }\n    if (!s->rlayer.read_ahead && !SSL_IS_DTLS(s))\n        max = n;\n    else {\n        if (max < n)\n            max = n;\n        if (max > (int)(rb->len - rb->offset))\n            max = rb->len - rb->offset;\n    }\n    while (left < n) {\n        clear_sys_error();\n        if (s->rbio != NULL) {\n            s->rwstate = SSL_READING;\n            i = BIO_read(s->rbio, pkt + len + left, max - left);\n        } else {\n            SSLerr(SSL_F_SSL3_READ_N, SSL_R_READ_BIO_NOT_SET);\n            i = -1;\n        }\n        if (i <= 0) {\n            rb->left = left;\n            if (s->mode & SSL_MODE_RELEASE_BUFFERS && !SSL_IS_DTLS(s))\n                if (len + left == 0)\n                    ssl3_release_read_buffer(s);\n            return (i);\n        }\n        left += i;\n        if (SSL_IS_DTLS(s)) {\n            if (n > left)\n                n = left;\n        }\n    }\n    rb->offset += n;\n    rb->left = left - n;\n    s->rlayer.packet_length += n;\n    s->rwstate = SSL_NOTHING;\n    return (n);\n}']