ssl/record/rec_layer_d1.c:433: error: INTEGER_OVERFLOW_L2
  ([0, max(1, `s->rlayer.numwpipes`)] - 1):unsigned64 by call to `dtls1_handle_timeout`.
Showing all 17 steps of the trace


ssl/record/rec_layer_d1.c:338:1: Parameter `s->rlayer.numwpipes`
336.    *             none of our business
337.    */
338. > int dtls1_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
339.                        size_t len, int peek, size_t *readbytes)
340.   {

ssl/record/rec_layer_d1.c:433:9: Call
431.   
432.       /* Check for timeout */
433.       if (dtls1_handle_timeout(s) > 0)
               ^
434.           goto start;
435.   

ssl/d1_lib.c:365:1: Parameter `s->rlayer.numwpipes`
  363.   }
  364.   
  365. > int dtls1_handle_timeout(SSL *s)
  366.   {
  367.       /* if no timer is expired, don't do anything */

ssl/d1_lib.c:389:12: Call
  387.   
  388.       dtls1_start_timer(s);
  389.       return dtls1_retransmit_buffered_messages(s);
                    ^
  390.   }
  391.   

ssl/statem/statem_dtls.c:952:1: Parameter `s->rlayer.numwpipes`
    950.   }
    951.   
    952. > int dtls1_retransmit_buffered_messages(SSL *s)
    953.   {
    954.       pqueue *sent = s->d1->sent_messages;

ssl/statem/statem_dtls.c:964:13: Call
    962.       for (item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter)) {
    963.           frag = (hm_fragment *)item->data;
    964.           if (dtls1_retransmit_message(s, (unsigned short)
                       ^
    965.                                        dtls1_get_queue_priority
    966.                                        (frag->msg_header.seq,

ssl/statem/statem_dtls.c:1038:1: Parameter `s->rlayer.numwpipes`
      1036.   }
      1037.   
      1038. > int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found)
      1039.   {
      1040.       int ret;

ssl/statem/statem_dtls.c:1100:11: Call
      1098.                                           saved_retransmit_state.epoch);
      1099.   
      1100.       ret = dtls1_do_write(s, frag->msg_header.is_ccs ?
                        ^
      1101.                            SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
      1102.   

ssl/statem/statem_dtls.c:110:1: Parameter `s->rlayer.numwpipes`
        108.    * SSL3_RT_CHANGE_CIPHER_SPEC)
        109.    */
        110. > int dtls1_do_write(SSL *s, int type)
        111.   {
        112.       int ret;

ssl/statem/statem_dtls.c:235:15: Call
        233.           }
        234.   
        235.           ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len,
                             ^
        236.                                   &written);
        237.           if (ret < 0) {

ssl/record/rec_layer_d1.c:974:1: Parameter `s->rlayer.numwpipes`
          972.    * not all data has been sent or non-blocking IO.
          973.    */
          974. > int dtls1_write_bytes(SSL *s, int type, const void *buf, size_t len,
          975.                         size_t *written)
          976.   {

ssl/record/rec_layer_d1.c:981:9: Call
          979.       OPENSSL_assert(len <= SSL3_RT_MAX_PLAIN_LENGTH);
          980.       s->rwstate = SSL_NOTHING;
          981.       i = do_dtls1_write(s, type, buf, len, 0, written);
                         ^
          982.       return i;
          983.   }

ssl/record/rec_layer_d1.c:985:1: Parameter `s->rlayer.numwpipes`
            983.   }
            984.   
            985. > int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
            986.                      size_t len, int create_empty_fragment, size_t *written)
            987.   {

ssl/record/rec_layer_d1.c:1181:12: Call
            1179.   
            1180.       /* we now just need to write the buffer */
            1181.       return ssl3_write_pending(s, type, buf, len, written);
                               ^
            1182.    err:
            1183.       return -1;

ssl/record/rec_layer_s3.c:905:1: <LHS trace>
903.    * <0 Failure (may be retryable)
904.    */
905. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
906.                          size_t *written)
907.   {

ssl/record/rec_layer_s3.c:905:1: Parameter `s->rlayer.numwpipes`
              903.    * <0 Failure (may be retryable)
              904.    */
              905. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
              906.                          size_t *written)
              907.   {

ssl/record/rec_layer_s3.c:924:16: Binary operation: ([0, max(1, s->rlayer.numwpipes)] - 1):unsigned64 by call to `dtls1_handle_timeout` 
              922.           /* Loop until we find a buffer we haven't written out yet */
              923.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
              924.               && currbuf < s->rlayer.numwpipes - 1) {
                                    ^
              925.               currbuf++;
              926.               continue;
