ssl/statem/statem_dtls.c:720: error: INTEGER_OVERFLOW_L2
  ([2, max(2147483644, `s->init_buf->max`)] - [1, 2147483644]):unsigned64 by call to `dtls1_retrieve_buffered_fragment`.
Showing all 13 steps of the trace


ssl/statem/statem_dtls.c:708:1: Parameter `s->init_buf->max`
706.   }
707.   
708. > static int dtls_get_reassembled_message(SSL *s, int *errtype, size_t *len)
709.   {
710.       unsigned char wire[DTLS1_HM_HEADER_LENGTH];

ssl/statem/statem_dtls.c:720:9: Call
718.    redo:
719.       /* see if we have the required fragment already */
720.       if (dtls1_retrieve_buffered_fragment(s, &frag_len)) {
               ^
721.           s->init_num = frag_len;
722.           *len = frag_len;

ssl/statem/statem_dtls.c:443:1: Parameter `s->init_buf->max`
  441.   }
  442.   
  443. > static int dtls1_retrieve_buffered_fragment(SSL *s, size_t *len)
  444.   {
  445.       /*-

ssl/statem/statem_dtls.c:480:14: Call
  478.           pqueue_pop(s->d1->buffered_messages);
  479.   
  480.           al = dtls1_preprocess_fragment(s, &frag->msg_header);
                      ^
  481.   
  482.           if (al == 0) {          /* no alert */

ssl/statem/statem_dtls.c:401:1: Parameter `s->init_buf->max`
    399.   }
    400.   
    401. > static int dtls1_preprocess_fragment(SSL *s, struct hm_header_st *msg_hdr)
    402.   {
    403.       size_t frag_off, frag_len, msg_len;

ssl/statem/statem_dtls.c:421:14: Call
    419.            * dtls_max_handshake_message_len(s) above
    420.            */
    421.           if (!BUF_MEM_grow_clean(s->init_buf, msg_len + DTLS1_HM_HEADER_LENGTH)) {
                        ^
    422.               SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT, ERR_R_BUF_LIB);
    423.               return SSL_AD_INTERNAL_ERROR;

crypto/buffer/buffer.c:109:1: Parameter `len`
      107.   }
      108.   
      109. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
      110.   {
      111.       char *ret;

crypto/buffer/buffer.c:134:15: Call
      132.           ret = sec_alloc_realloc(str, n);
      133.       else
      134.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                           ^
      135.       if (ret == NULL) {
      136.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:136:1: <LHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
        134.   }
        135.   
        136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
        137.                              const char *file, int line)
        138.   {

crypto/mem.c:136:1: <RHS trace>
134.   }
135.   
136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
137.                              const char *file, int line)
138.   {

crypto/mem.c:136:1: Parameter `num`
        134.   }
        135.   
        136. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
        137.                              const char *file, int line)
        138.   {

crypto/mem.c:151:9: Binary operation: ([2, max(2147483644, s->init_buf->max)] - [1, 2147483644]):unsigned64 by call to `dtls1_retrieve_buffered_fragment` 
        149.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
        150.       if (num < old_len) {
        151.           OPENSSL_cleanse((char*)str + num, old_len - num);
                       ^
        152.           return str;
        153.       }
