ssl/record/ssl3_record.c:476: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [0, 64]):unsigned64 by call to `ssl3_cbc_copy_mac`.
Showing all 9 steps of the trace


ssl/record/ssl3_record.c:226:29: Call
224.                   if (!PACKET_get_1(&pkt, &type)
225.                           || !PACKET_get_net_2(&pkt, &version)
226.                           || !PACKET_get_net_2_len(&pkt, &thisrr->length)) {
                                   ^
227.                       al = SSL_AD_INTERNAL_ERROR;
228.                       SSLerr(SSL_F_SSL3_GET_RECORD, ERR_R_INTERNAL_ERROR);

ssl/packet_locl.h:164:8: Parameter `*data`
  162.   
  163.   /* Same as PACKET_get_net_2() but for a size_t */
  164.   __owur static ossl_inline int PACKET_get_net_2_len(PACKET *pkt, size_t *data)
                ^
  165.   {
  166.       unsigned int i;

ssl/record/ssl3_record.c:476:17: Call
474.                    */
475.                   mac = mac_tmp;
476.                   ssl3_cbc_copy_mac(mac_tmp, thisrr, mac_size);
                       ^
477.                   thisrr->length -= mac_size;
478.               } else {

ssl/record/ssl3_record.c:1297:1: <LHS trace>
1295.   #define CBC_MAC_ROTATE_IN_PLACE
1296.   
1297. > void ssl3_cbc_copy_mac(unsigned char *out,
1298.                          const SSL3_RECORD *rec, size_t md_size)
1299.   {

ssl/record/ssl3_record.c:1297:1: Parameter `rec->length`
  1295.   #define CBC_MAC_ROTATE_IN_PLACE
  1296.   
  1297. > void ssl3_cbc_copy_mac(unsigned char *out,
  1298.                          const SSL3_RECORD *rec, size_t md_size)
  1299.   {

ssl/record/ssl3_record.c:1310:5: Assignment
  1308.        * mac_end is the index of |rec->data| just after the end of the MAC.
  1309.        */
  1310.       size_t mac_end = rec->length;
              ^
  1311.       size_t mac_start = mac_end - md_size;
  1312.       /*

ssl/record/ssl3_record.c:1297:1: <RHS trace>
1295.   #define CBC_MAC_ROTATE_IN_PLACE
1296.   
1297. > void ssl3_cbc_copy_mac(unsigned char *out,
1298.                          const SSL3_RECORD *rec, size_t md_size)
1299.   {

ssl/record/ssl3_record.c:1297:1: Parameter `md_size`
  1295.   #define CBC_MAC_ROTATE_IN_PLACE
  1296.   
  1297. > void ssl3_cbc_copy_mac(unsigned char *out,
  1298.                          const SSL3_RECORD *rec, size_t md_size)
  1299.   {

ssl/record/ssl3_record.c:1311:5: Binary operation: ([0, +oo] - [0, 64]):unsigned64 by call to `ssl3_cbc_copy_mac` 
  1309.        */
  1310.       size_t mac_end = rec->length;
  1311.       size_t mac_start = mac_end - md_size;
              ^
  1312.       /*
  1313.        * scan_start contains the number of bytes that we can ignore because the
