ssl/t1_enc.c:1037: error: INTEGER_OVERFLOW_L2
  ([-51, +oo] - 1):unsigned32 by call to `ssl3_cbc_digest_record`.
Showing all 5 steps of the trace


ssl/t1_enc.c:971:1: Parameter `ssl->s3->read_mac_secret_size`
969.   	}
970.   
971. > int tls1_mac(SSL *ssl, unsigned char *md, int send)
972.   	{
973.   	SSL3_RECORD *rec;

ssl/t1_enc.c:1037:3: Call
1035.   		 * data we are hashing because that gives an attacker a
1036.   		 * timing-oracle. */
1037.   		ssl3_cbc_digest_record(
          ^
1038.   			mac_ctx,
1039.   			md, &md_size,

ssl/s3_cbc.c:476:4: <LHS trace>
474.   			md_final_raw = tls1_md5_final_raw;
475.   			md_transform = (void(*)(void *ctx, const unsigned char *block)) MD5_Transform;
476.   			md_size = 16;
          ^
477.   			sslv3_pad_length = 48;
478.   			length_is_big_endian = 0;

ssl/s3_cbc.c:476:4: Assignment
  474.   			md_final_raw = tls1_md5_final_raw;
  475.   			md_transform = (void(*)(void *ctx, const unsigned char *block)) MD5_Transform;
  476.   			md_size = 16;
            ^
  477.   			sslv3_pad_length = 48;
  478.   			length_is_big_endian = 0;

ssl/s3_cbc.c:566:2: Binary operation: ([-51, +oo] - 1):unsigned32 by call to `ssl3_cbc_digest_record` 
  564.   	/* max_mac_bytes contains the maximum bytes of bytes in the MAC, including
  565.   	* |header|, assuming that there's no padding. */
  566.   	max_mac_bytes = len - md_size - 1;
          ^
  567.   	/* num_blocks is the maximum number of hash blocks. */
  568.   	num_blocks = (max_mac_bytes + 1 + md_length_size + md_block_size - 1) / md_block_size;
