ssl/record/ssl3_record.c:649: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned64 by call to `ssl3_cbc_remove_padding`.
Showing all 5 steps of the trace


ssl/record/ssl3_record.c:578:1: Parameter `inrecs->length`
576.    *       occurred.
577.    */
578. > int ssl3_enc(SSL *s, SSL3_RECORD *inrecs, size_t n_recs, int send)
579.   {
580.       SSL3_RECORD *rec;

ssl/record/ssl3_record.c:649:20: Call
647.           }
648.           if ((bs != 1) && !send)
649.               return ssl3_cbc_remove_padding(rec, bs, mac_size);
                          ^
650.       }
651.       return (1);

ssl/record/ssl3_record.c:1111:1: <LHS trace>
1109.    *  -1: otherwise.
1110.    */
1111. > int ssl3_cbc_remove_padding(SSL3_RECORD *rec,
1112.                               size_t block_size, size_t mac_size)
1113.   {

ssl/record/ssl3_record.c:1111:1: Parameter `rec->length`
  1109.    *  -1: otherwise.
  1110.    */
  1111. > int ssl3_cbc_remove_padding(SSL3_RECORD *rec,
  1112.                               size_t block_size, size_t mac_size)
  1113.   {

ssl/record/ssl3_record.c:1124:22: Binary operation: ([0, +oo] - 1):unsigned64 by call to `ssl3_cbc_remove_padding` 
  1122.           return 0;
  1123.   
  1124.       padding_length = rec->data[rec->length - 1];
                               ^
  1125.       good = constant_time_ge_s(rec->length, padding_length + overhead);
  1126.       /* SSLv3 requires that the padding is minimal. */
