ssl/record/rec_layer_s3.c:1032: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [0, 2]):unsigned64 by call to `WPACKET_close`.
Showing all 10 steps of the trace


ssl/record/rec_layer_s3.c:758:14: Call
756.   #endif
757.           SSL3_BUFFER_set_offset(wb, align);
758.           if (!WPACKET_init_static_len(&pkt[0], SSL3_BUFFER_get_buf(wb),
                    ^
759.                                        SSL3_BUFFER_get_len(wb), 0)
760.                   || !WPACKET_allocate_bytes(&pkt[0], align, NULL)) {

ssl/packet.c:116:1: Parameter `pkt->curr`
  114.   }
  115.   
  116. > int WPACKET_init_static_len(WPACKET *pkt, unsigned char *buf, size_t len,
  117.                               size_t lenbytes)
  118.   {

ssl/record/rec_layer_s3.c:1032:21: Call
1030.   
1031.           if (!WPACKET_get_length(thispkt, &len)
1032.                   || !WPACKET_close(thispkt)) {
                            ^
1033.               SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DO_SSL3_WRITE,
1034.                        ERR_R_INTERNAL_ERROR);

ssl/packet.c:238:1: Parameter `pkt->curr`
  236.   }
  237.   
  238. > int WPACKET_close(WPACKET *pkt)
  239.   {
  240.       /*

ssl/packet.c:247:12: Call
  245.           return 0;
  246.   
  247.       return wpacket_intern_close(pkt, pkt->subs, 1);
                    ^
  248.   }
  249.   

ssl/packet.c:184:1: <LHS trace>
182.    * (i.e. it fills in all the lengths), but doesn't actually close anything.
183.    */
184. > static int wpacket_intern_close(WPACKET *pkt, WPACKET_SUB *sub, int doclose)
185.   {
186.       size_t packlen = pkt->written - sub->pwritten;

ssl/packet.c:184:1: Parameter `pkt->curr`
    182.    * (i.e. it fills in all the lengths), but doesn't actually close anything.
    183.    */
    184. > static int wpacket_intern_close(WPACKET *pkt, WPACKET_SUB *sub, int doclose)
    185.   {
    186.       size_t packlen = pkt->written - sub->pwritten;

ssl/packet.c:184:1: <RHS trace>
182.    * (i.e. it fills in all the lengths), but doesn't actually close anything.
183.    */
184. > static int wpacket_intern_close(WPACKET *pkt, WPACKET_SUB *sub, int doclose)
185.   {
186.       size_t packlen = pkt->written - sub->pwritten;

ssl/packet.c:184:1: Parameter `sub->lenbytes`
    182.    * (i.e. it fills in all the lengths), but doesn't actually close anything.
    183.    */
    184. > static int wpacket_intern_close(WPACKET *pkt, WPACKET_SUB *sub, int doclose)
    185.   {
    186.       size_t packlen = pkt->written - sub->pwritten;

ssl/packet.c:199:13: Binary operation: ([0, +oo] - [0, 2]):unsigned64 by call to `WPACKET_close` 
    197.   
    198.           /* Deallocate any bytes allocated for the length of the WPACKET */
    199.           if ((pkt->curr - sub->lenbytes) == sub->packet_len) {
                       ^
    200.               pkt->written -= sub->lenbytes;
    201.               pkt->curr -= sub->lenbytes;
