ssl/record/ssl3_record.c:581: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `ssl3_cbc_remove_padding`.
Showing all 5 steps of the trace


ssl/record/ssl3_record.c:522:1: Parameter `s->rlayer.rrec.length`
520.    *       occurred.
521.    */
522. > int ssl3_enc(SSL *s, int send)
523.   {
524.       SSL3_RECORD *rec;

ssl/record/ssl3_record.c:581:20: Call
579.               mac_size = EVP_MD_CTX_size(s->read_hash);
580.           if ((bs != 1) && !send)
581.               return ssl3_cbc_remove_padding(s, rec, bs, mac_size);
                          ^
582.       }
583.       return (1);

ssl/record/ssl3_record.c:986:1: <LHS trace>
984.    *  -1: otherwise.
985.    */
986. > int ssl3_cbc_remove_padding(const SSL *s,
987.                               SSL3_RECORD *rec,
988.                               unsigned block_size, unsigned mac_size)

ssl/record/ssl3_record.c:986:1: Parameter `rec->length`
  984.    *  -1: otherwise.
  985.    */
  986. > int ssl3_cbc_remove_padding(const SSL *s,
  987.                               SSL3_RECORD *rec,
  988.                               unsigned block_size, unsigned mac_size)

ssl/record/ssl3_record.c:999:22: Binary operation: ([0, +oo] - 1):unsigned32 by call to `ssl3_cbc_remove_padding` 
  997.           return 0;
  998.   
  999.       padding_length = rec->data[rec->length - 1];
                               ^
  1000.       good = constant_time_ge(rec->length, padding_length + overhead);
  1001.       /* SSLv3 requires that the padding is minimal. */
