ssl/record/rec_layer_d1.c:408: error: INTEGER_OVERFLOW_L2
  ([0, max(1, `s->rlayer.numwpipes`)] - 1):unsigned64 by call to `dtls1_read_failed`.
Showing all 25 steps of the trace


ssl/record/rec_layer_d1.c:331:1: Parameter `s->rlayer.numwpipes`
329.    *             none of our business
330.    */
331. > int dtls1_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
332.                        size_t len, int peek, size_t *readbytes)
333.   {

ssl/record/rec_layer_d1.c:400:9: Call
398.   
399.       /* Check for timeout */
400.       if (dtls1_handle_timeout(s) > 0)
               ^
401.           goto start;
402.   

ssl/d1_lib.c:369:1: Parameter `s->rlayer.numwpipes`
  367.   }
  368.   
  369. > int dtls1_handle_timeout(SSL *s)
  370.   {
  371.       /* if no timer is expired, don't do anything */

ssl/record/rec_layer_d1.c:406:16: Call
404.       if ((SSL3_RECORD_get_length(rr) == 0)
405.           || (s->rlayer.rstate == SSL_ST_READ_BODY)) {
406.           iret = dtls1_get_record(s);
                      ^
407.           if (iret <= 0) {
408.               iret = dtls1_read_failed(s, iret);

ssl/record/ssl3_record.c:1721:1: Parameter `s->rlayer.numwpipes`
  1719.    */
  1720.   /* used only by dtls1_read_bytes */
  1721. > int dtls1_get_record(SSL *s)
  1722.   {
  1723.       int ssl_major, ssl_minor;

ssl/record/ssl3_record.c:1739:10: Call
  1737.        * This is a non-blocking operation.
  1738.        */
  1739.       if (!dtls1_process_buffered_records(s))
                   ^
  1740.           return -1;
  1741.   

ssl/record/rec_layer_d1.c:222:1: Parameter `s->rlayer.numwpipes`
    220.                      &((s)->rlayer.d->unprocessed_rcds))
    221.   
    222. > int dtls1_process_buffered_records(SSL *s)
    223.   {
    224.       pitem *item;

ssl/record/rec_layer_d1.c:408:20: Call
406.           iret = dtls1_get_record(s);
407.           if (iret <= 0) {
408.               iret = dtls1_read_failed(s, iret);
                          ^
409.               /* anything other than a timeout is an error */
410.               if (iret <= 0)

ssl/statem/statem_dtls.c:919:1: Parameter `s->rlayer.numwpipes`
  917.   #endif
  918.   
  919. > int dtls1_read_failed(SSL *s, int code)
  920.   {
  921.       if (code > 0) {

ssl/statem/statem_dtls.c:940:12: Call
  938.       }
  939.   
  940.       return dtls1_handle_timeout(s);
                    ^
  941.   }
  942.   

ssl/d1_lib.c:369:1: Parameter `s->rlayer.numwpipes`
    367.   }
    368.   
    369. > int dtls1_handle_timeout(SSL *s)
    370.   {
    371.       /* if no timer is expired, don't do anything */

ssl/d1_lib.c:387:12: Call
    385.   
    386.       dtls1_start_timer(s);
    387.       return dtls1_retransmit_buffered_messages(s);
                      ^
    388.   }
    389.   

ssl/statem/statem_dtls.c:958:1: Parameter `s->rlayer.numwpipes`
      956.   }
      957.   
      958. > int dtls1_retransmit_buffered_messages(SSL *s)
      959.   {
      960.       pqueue *sent = s->d1->sent_messages;

ssl/statem/statem_dtls.c:970:13: Call
      968.       for (item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter)) {
      969.           frag = (hm_fragment *)item->data;
      970.           if (dtls1_retransmit_message(s, (unsigned short)
                         ^
      971.                                        dtls1_get_queue_priority
      972.                                        (frag->msg_header.seq,

ssl/statem/statem_dtls.c:1047:1: Parameter `s->rlayer.numwpipes`
        1045.   }
        1046.   
        1047. > int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found)
        1048.   {
        1049.       int ret;

ssl/statem/statem_dtls.c:1104:11: Call
        1102.                                           saved_retransmit_state.epoch);
        1103.   
        1104.       ret = dtls1_do_write(s, frag->msg_header.is_ccs ?
                          ^
        1105.                            SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
        1106.   

ssl/statem/statem_dtls.c:109:1: Parameter `s->rlayer.numwpipes`
          107.    * SSL3_RT_CHANGE_CIPHER_SPEC)
          108.    */
          109. > int dtls1_do_write(SSL *s, int type)
          110.   {
          111.       int ret;

ssl/statem/statem_dtls.c:239:15: Call
          237.           }
          238.   
          239.           ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len,
                               ^
          240.                                   &written);
          241.           if (ret < 0) {

ssl/record/rec_layer_d1.c:730:1: Parameter `s->rlayer.numwpipes`
            728.    * not all data has been sent or non-blocking IO.
            729.    */
            730. > int dtls1_write_bytes(SSL *s, int type, const void *buf, size_t len,
            731.                         size_t *written)
            732.   {

ssl/record/rec_layer_d1.c:740:9: Call
            738.       }
            739.       s->rwstate = SSL_NOTHING;
            740.       i = do_dtls1_write(s, type, buf, len, 0, written);
                           ^
            741.       return i;
            742.   }

ssl/record/rec_layer_d1.c:744:1: Parameter `s->rlayer.numwpipes`
              742.   }
              743.   
              744. > int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
              745.                      size_t len, int create_empty_fragment, size_t *written)
              746.   {

ssl/record/rec_layer_d1.c:936:12: Call
              934.   
              935.       /* we now just need to write the buffer */
              936.       return ssl3_write_pending(s, type, buf, len, written);
                                ^
              937.    err:
              938.       return -1;

ssl/record/rec_layer_s3.c:1058:1: <LHS trace>
1056.    * Return values are as per SSL_write()
1057.    */
1058. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
1059.                          size_t *written)
1060.   {

ssl/record/rec_layer_s3.c:1058:1: Parameter `s->rlayer.numwpipes`
                1056.    * Return values are as per SSL_write()
                1057.    */
                1058. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
                1059.                          size_t *written)
                1060.   {

ssl/record/rec_layer_s3.c:1077:16: Binary operation: ([0, max(1, s->rlayer.numwpipes)] - 1):unsigned64 by call to `dtls1_read_failed` 
                1075.           /* Loop until we find a buffer we haven't written out yet */
                1076.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
                1077.               && currbuf < s->rlayer.numwpipes - 1) {
                                       ^
                1078.               currbuf++;
                1079.               continue;
