ssl/record/rec_layer_d1.c:441: error: INTEGER_OVERFLOW_L2
  ([0, max(1, `s->rlayer.numwpipes`)] - 1):unsigned64 by call to `dtls1_read_failed`.
Showing all 25 steps of the trace


ssl/record/rec_layer_d1.c:338:1: Parameter `s->rlayer.numwpipes`
336.    *             none of our business
337.    */
338. > int dtls1_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
339.                        size_t len, int peek, size_t *readbytes)
340.   {

ssl/record/rec_layer_d1.c:433:9: Call
431.   
432.       /* Check for timeout */
433.       if (dtls1_handle_timeout(s) > 0)
               ^
434.           goto start;
435.   

ssl/d1_lib.c:365:1: Parameter `s->rlayer.numwpipes`
  363.   }
  364.   
  365. > int dtls1_handle_timeout(SSL *s)
  366.   {
  367.       /* if no timer is expired, don't do anything */

ssl/record/rec_layer_d1.c:439:16: Call
437.       if ((SSL3_RECORD_get_length(rr) == 0)
438.           || (s->rlayer.rstate == SSL_ST_READ_BODY)) {
439.           iret = dtls1_get_record(s);
                      ^
440.           if (iret <= 0) {
441.               iret = dtls1_read_failed(s, iret);

ssl/record/ssl3_record.c:1523:1: Parameter `s->rlayer.numwpipes`
  1521.    */
  1522.   /* used only by dtls1_read_bytes */
  1523. > int dtls1_get_record(SSL *s)
  1524.   {
  1525.       int ssl_major, ssl_minor;

ssl/record/ssl3_record.c:1541:10: Call
  1539.        * This is a non-blocking operation.
  1540.        */
  1541.       if (!dtls1_process_buffered_records(s))
                   ^
  1542.           return -1;
  1543.   

ssl/record/rec_layer_d1.c:229:1: Parameter `s->rlayer.numwpipes`
    227.                      &((s)->rlayer.d->unprocessed_rcds))
    228.   
    229. > int dtls1_process_buffered_records(SSL *s)
    230.   {
    231.       pitem *item;

ssl/record/rec_layer_d1.c:441:20: Call
439.           iret = dtls1_get_record(s);
440.           if (iret <= 0) {
441.               iret = dtls1_read_failed(s, iret);
                          ^
442.               /* anything other than a timeout is an error */
443.               if (iret <= 0)

ssl/statem/statem_dtls.c:908:1: Parameter `s->rlayer.numwpipes`
  906.   #endif
  907.   
  908. > int dtls1_read_failed(SSL *s, int code)
  909.   {
  910.       if (code > 0) {

ssl/statem/statem_dtls.c:934:12: Call
  932.       }
  933.   
  934.       return dtls1_handle_timeout(s);
                    ^
  935.   }
  936.   

ssl/d1_lib.c:365:1: Parameter `s->rlayer.numwpipes`
    363.   }
    364.   
    365. > int dtls1_handle_timeout(SSL *s)
    366.   {
    367.       /* if no timer is expired, don't do anything */

ssl/d1_lib.c:389:12: Call
    387.   
    388.       dtls1_start_timer(s);
    389.       return dtls1_retransmit_buffered_messages(s);
                      ^
    390.   }
    391.   

ssl/statem/statem_dtls.c:952:1: Parameter `s->rlayer.numwpipes`
      950.   }
      951.   
      952. > int dtls1_retransmit_buffered_messages(SSL *s)
      953.   {
      954.       pqueue *sent = s->d1->sent_messages;

ssl/statem/statem_dtls.c:964:13: Call
      962.       for (item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter)) {
      963.           frag = (hm_fragment *)item->data;
      964.           if (dtls1_retransmit_message(s, (unsigned short)
                         ^
      965.                                        dtls1_get_queue_priority
      966.                                        (frag->msg_header.seq,

ssl/statem/statem_dtls.c:1038:1: Parameter `s->rlayer.numwpipes`
        1036.   }
        1037.   
        1038. > int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found)
        1039.   {
        1040.       int ret;

ssl/statem/statem_dtls.c:1100:11: Call
        1098.                                           saved_retransmit_state.epoch);
        1099.   
        1100.       ret = dtls1_do_write(s, frag->msg_header.is_ccs ?
                          ^
        1101.                            SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
        1102.   

ssl/statem/statem_dtls.c:110:1: Parameter `s->rlayer.numwpipes`
          108.    * SSL3_RT_CHANGE_CIPHER_SPEC)
          109.    */
          110. > int dtls1_do_write(SSL *s, int type)
          111.   {
          112.       int ret;

ssl/statem/statem_dtls.c:235:15: Call
          233.           }
          234.   
          235.           ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len,
                               ^
          236.                                   &written);
          237.           if (ret < 0) {

ssl/record/rec_layer_d1.c:974:1: Parameter `s->rlayer.numwpipes`
            972.    * not all data has been sent or non-blocking IO.
            973.    */
            974. > int dtls1_write_bytes(SSL *s, int type, const void *buf, size_t len,
            975.                         size_t *written)
            976.   {

ssl/record/rec_layer_d1.c:981:9: Call
            979.       OPENSSL_assert(len <= SSL3_RT_MAX_PLAIN_LENGTH);
            980.       s->rwstate = SSL_NOTHING;
            981.       i = do_dtls1_write(s, type, buf, len, 0, written);
                           ^
            982.       return i;
            983.   }

ssl/record/rec_layer_d1.c:985:1: Parameter `s->rlayer.numwpipes`
              983.   }
              984.   
              985. > int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
              986.                      size_t len, int create_empty_fragment, size_t *written)
              987.   {

ssl/record/rec_layer_d1.c:1181:12: Call
              1179.   
              1180.       /* we now just need to write the buffer */
              1181.       return ssl3_write_pending(s, type, buf, len, written);
                                 ^
              1182.    err:
              1183.       return -1;

ssl/record/rec_layer_s3.c:905:1: <LHS trace>
903.    * <0 Failure (may be retryable)
904.    */
905. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
906.                          size_t *written)
907.   {

ssl/record/rec_layer_s3.c:905:1: Parameter `s->rlayer.numwpipes`
                903.    * <0 Failure (may be retryable)
                904.    */
                905. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
                906.                          size_t *written)
                907.   {

ssl/record/rec_layer_s3.c:924:16: Binary operation: ([0, max(1, s->rlayer.numwpipes)] - 1):unsigned64 by call to `dtls1_read_failed` 
                922.           /* Loop until we find a buffer we haven't written out yet */
                923.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
                924.               && currbuf < s->rlayer.numwpipes - 1) {
                                      ^
                925.               currbuf++;
                926.               continue;
