ssl/record/rec_layer_d1.c:424: error: INTEGER_OVERFLOW_L2
  ([0, max(1, `s->rlayer.numwpipes`)] - 1):unsigned64 by call to `dtls1_read_failed`.
Showing all 25 steps of the trace


ssl/record/rec_layer_d1.c:340:1: Parameter `s->rlayer.numwpipes`
338.    *             none of our business
339.    */
340. > int dtls1_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
341.                        size_t len, int peek, size_t *readbytes)
342.   {

ssl/record/rec_layer_d1.c:411:9: Call
409.   
410.       /* Check for timeout */
411.       if (dtls1_handle_timeout(s) > 0) {
               ^
412.           goto start;
413.       } else if (ossl_statem_in_error(s)) {

ssl/d1_lib.c:389:1: Parameter `s->rlayer.numwpipes`
  387.   }
  388.   
  389. > int dtls1_handle_timeout(SSL *s)
  390.   {
  391.       /* if no timer is expired, don't do anything */

ssl/record/rec_layer_d1.c:422:16: Call
420.           || (s->rlayer.rstate == SSL_ST_READ_BODY)) {
421.           RECORD_LAYER_set_numrpipes(&s->rlayer, 0);
422.           iret = dtls1_get_record(s);
                      ^
423.           if (iret <= 0) {
424.               iret = dtls1_read_failed(s, iret);

ssl/record/ssl3_record.c:1817:1: Parameter `s->rlayer.numwpipes`
  1815.    */
  1816.   /* used only by dtls1_read_bytes */
  1817. > int dtls1_get_record(SSL *s)
  1818.   {
  1819.       int ssl_major, ssl_minor;

ssl/record/ssl3_record.c:1835:10: Call
  1833.        * This is a non-blocking operation.
  1834.        */
  1835.       if (!dtls1_process_buffered_records(s)) {
                   ^
  1836.           /* SSLfatal() already called */
  1837.           return -1;

ssl/record/rec_layer_d1.c:224:1: Parameter `s->rlayer.numwpipes`
    222.                      &((s)->rlayer.d->unprocessed_rcds))
    223.   
    224. > int dtls1_process_buffered_records(SSL *s)
    225.   {
    226.       pitem *item;

ssl/record/rec_layer_d1.c:424:20: Call
422.           iret = dtls1_get_record(s);
423.           if (iret <= 0) {
424.               iret = dtls1_read_failed(s, iret);
                          ^
425.               /*
426.                * Anything other than a timeout is an error. SSLfatal() already

ssl/statem/statem_dtls.c:968:1: Parameter `s->rlayer.numwpipes`
  966.   #endif
  967.   
  968. > int dtls1_read_failed(SSL *s, int code)
  969.   {
  970.       if (code > 0) {

ssl/statem/statem_dtls.c:990:12: Call
  988.       }
  989.   
  990.       return dtls1_handle_timeout(s);
                    ^
  991.   }
  992.   

ssl/d1_lib.c:389:1: Parameter `s->rlayer.numwpipes`
    387.   }
    388.   
    389. > int dtls1_handle_timeout(SSL *s)
    390.   {
    391.       /* if no timer is expired, don't do anything */

ssl/d1_lib.c:413:12: Call
    411.       dtls1_start_timer(s);
    412.       /* Calls SSLfatal() if required */
    413.       return dtls1_retransmit_buffered_messages(s);
                      ^
    414.   }
    415.   

ssl/statem/statem_dtls.c:1008:1: Parameter `s->rlayer.numwpipes`
      1006.   }
      1007.   
      1008. > int dtls1_retransmit_buffered_messages(SSL *s)
      1009.   {
      1010.       pqueue *sent = s->d1->sent_messages;

ssl/statem/statem_dtls.c:1020:13: Call
      1018.       for (item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter)) {
      1019.           frag = (hm_fragment *)item->data;
      1020.           if (dtls1_retransmit_message(s, (unsigned short)
                          ^
      1021.                                        dtls1_get_queue_priority
      1022.                                        (frag->msg_header.seq,

ssl/statem/statem_dtls.c:1097:1: Parameter `s->rlayer.numwpipes`
        1095.   }
        1096.   
        1097. > int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found)
        1098.   {
        1099.       int ret;

ssl/statem/statem_dtls.c:1155:11: Call
        1153.                                           saved_retransmit_state.epoch);
        1154.   
        1155.       ret = dtls1_do_write(s, frag->msg_header.is_ccs ?
                          ^
        1156.                            SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
        1157.   

ssl/statem/statem_dtls.c:112:1: Parameter `s->rlayer.numwpipes`
          110.    * SSL3_RT_CHANGE_CIPHER_SPEC)
          111.    */
          112. > int dtls1_do_write(SSL *s, int type)
          113.   {
          114.       int ret;

ssl/statem/statem_dtls.c:242:15: Call
          240.           }
          241.   
          242.           ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len,
                               ^
          243.                                   &written);
          244.           if (ret < 0) {

ssl/record/rec_layer_d1.c:752:1: Parameter `s->rlayer.numwpipes`
            750.    * not all data has been sent or non-blocking IO.
            751.    */
            752. > int dtls1_write_bytes(SSL *s, int type, const void *buf, size_t len,
            753.                         size_t *written)
            754.   {

ssl/record/rec_layer_d1.c:763:9: Call
            761.       }
            762.       s->rwstate = SSL_NOTHING;
            763.       i = do_dtls1_write(s, type, buf, len, 0, written);
                           ^
            764.       return i;
            765.   }

ssl/record/rec_layer_d1.c:767:1: Parameter `s->rlayer.numwpipes`
              765.   }
              766.   
              767. > int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
              768.                      size_t len, int create_empty_fragment, size_t *written)
              769.   {

ssl/record/rec_layer_d1.c:976:12: Call
              974.   
              975.       /* we now just need to write the buffer. Calls SSLfatal() as required. */
              976.       return ssl3_write_pending(s, type, buf, len, written);
                                ^
              977.   }
              978.   

ssl/record/rec_layer_s3.c:1113:1: <LHS trace>
1111.    * Return values are as per SSL_write()
1112.    */
1113. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
1114.                          size_t *written)
1115.   {

ssl/record/rec_layer_s3.c:1113:1: Parameter `s->rlayer.numwpipes`
                1111.    * Return values are as per SSL_write()
                1112.    */
                1113. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
                1114.                          size_t *written)
                1115.   {

ssl/record/rec_layer_s3.c:1133:16: Binary operation: ([0, max(1, s->rlayer.numwpipes)] - 1):unsigned64 by call to `dtls1_read_failed` 
                1131.           /* Loop until we find a buffer we haven't written out yet */
                1132.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
                1133.               && currbuf < s->rlayer.numwpipes - 1) {
                                       ^
                1134.               currbuf++;
                1135.               continue;
