ssl/s3_enc.c:785: error: INTEGER_OVERFLOW_L2
  ([13, +oo] - [16, 64]):unsigned64 by call to `ssl3_cbc_digest_record`.
Showing all 7 steps of the trace


ssl/s3_enc.c:726:1: Parameter `ssl->s3->rrec.length`
724.   	}
725.   
726. > int n_ssl3_mac(SSL *ssl, unsigned char *md, int send)
727.   	{
728.   	SSL3_RECORD *rec;

ssl/s3_enc.c:785:3: Call
783.   		header[j++] = rec->length & 0xff;
784.   
785.   		ssl3_cbc_digest_record(
         ^
786.   			hash,
787.   			md, &md_size,

ssl/s3_cbc.c:433:1: <LHS trace>
431.    * a padding byte and MAC. (If the padding was invalid, it might contain the
432.    * padding too. ) */
433. > void ssl3_cbc_digest_record(
434.   	const EVP_MD_CTX *ctx,
435.   	unsigned char* md_out,

ssl/s3_cbc.c:433:1: Parameter `data_plus_mac_size`
  431.    * a padding byte and MAC. (If the padding was invalid, it might contain the
  432.    * padding too. ) */
  433. > void ssl3_cbc_digest_record(
  434.   	const EVP_MD_CTX *ctx,
  435.   	unsigned char* md_out,

ssl/s3_cbc.c:476:4: <RHS trace>
474.   			md_final_raw = tls1_md5_final_raw;
475.   			md_transform = (void(*)(void *ctx, const unsigned char *block)) MD5_Transform;
476.   			md_size = 16;
          ^
477.   			sslv3_pad_length = 48;
478.   			length_is_big_endian = 0;

ssl/s3_cbc.c:476:4: Assignment
  474.   			md_final_raw = tls1_md5_final_raw;
  475.   			md_transform = (void(*)(void *ctx, const unsigned char *block)) MD5_Transform;
  476.   			md_size = 16;
            ^
  477.   			sslv3_pad_length = 48;
  478.   			length_is_big_endian = 0;

ssl/s3_cbc.c:581:2: Binary operation: ([13, +oo] - [16, 64]):unsigned64 by call to `ssl3_cbc_digest_record` 
  579.   	/* mac_end_offset is the index just past the end of the data to be
  580.   	 * MACed. */
  581.   	mac_end_offset = data_plus_mac_size + header_length - md_size;
          ^
  582.   	/* c is the index of the 0x80 byte in the final hash block that
  583.   	 * contains application data. */
