ssl/statem/statem_clnt.c:2199: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [`pkt->written`, `pkt->written` + 2]):unsigned64 by call to `WPACKET_allocate_bytes`.
Showing all 9 steps of the trace


ssl/statem/statem_clnt.c:2150:1: Parameter `pkt->written`
2148.   }
2149.   
2150. > static int tls_construct_cke_rsa(SSL *s, WPACKET *pkt, int *al)
2151.   {
2152.   #ifndef OPENSSL_NO_RSA

ssl/statem/statem_clnt.c:2199:10: Call
2197.           goto err;
2198.       }
2199.       if (!WPACKET_allocate_bytes(pkt, enclen, &encdata)
                 ^
2200.               || EVP_PKEY_encrypt(pctx, encdata, &enclen, pms, pmslen) <= 0) {
2201.           SSLerr(SSL_F_TLS_CONSTRUCT_CKE_RSA, SSL_R_BAD_RSA_ENCRYPT);

ssl/packet.c:15:1: Parameter `pkt->written`
  13.   #define DEFAULT_BUF_SIZE    256
  14.   
  15. > int WPACKET_allocate_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
  16.   {
  17.       if (!WPACKET_reserve_bytes(pkt, len, allocbytes))

ssl/packet.c:17:10: Call
  15.   int WPACKET_allocate_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
  16.   {
  17.       if (!WPACKET_reserve_bytes(pkt, len, allocbytes))
                 ^
  18.           return 0;
  19.   

ssl/packet.c:36:1: <LHS trace>
34.   }
35.   
36. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
37.   {
38.       /* Internal API, so should not fail */

ssl/packet.c:36:1: Parameter `pkt->buf->length`
    34.   }
    35.   
    36. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
    37.   {
    38.       /* Internal API, so should not fail */

ssl/packet.c:36:1: <RHS trace>
34.   }
35.   
36. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
37.   {
38.       /* Internal API, so should not fail */

ssl/packet.c:36:1: Parameter `len`
    34.   }
    35.   
    36. > int WPACKET_reserve_bytes(WPACKET *pkt, size_t len, unsigned char **allocbytes)
    37.   {
    38.       /* Internal API, so should not fail */

ssl/packet.c:46:9: Binary operation: ([0, +oo] - [pkt->written, pkt->written + 2]):unsigned64 by call to `WPACKET_allocate_bytes` 
    44.           return 0;
    45.   
    46.       if (pkt->buf->length - pkt->written < len) {
                  ^
    47.           size_t newlen;
    48.           size_t reflen;
