ssl/record/rec_layer_d1.c:423: error: INTEGER_OVERFLOW_L2
  ([0, max(1, `s->rlayer.numwpipes`)] - 1):unsigned64 by call to `dtls1_read_failed`.
Showing all 25 steps of the trace


ssl/record/rec_layer_d1.c:340:1: Parameter `s->rlayer.numwpipes`
338.    *             none of our business
339.    */
340. > int dtls1_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
341.                        size_t len, int peek, size_t *readbytes)
342.   {

ssl/record/rec_layer_d1.c:411:9: Call
409.   
410.       /* Check for timeout */
411.       if (dtls1_handle_timeout(s) > 0) {
               ^
412.           goto start;
413.       } else if (ossl_statem_in_error(s)) {

ssl/d1_lib.c:389:1: Parameter `s->rlayer.numwpipes`
  387.   }
  388.   
  389. > int dtls1_handle_timeout(SSL *s)
  390.   {
  391.       /* if no timer is expired, don't do anything */

ssl/record/rec_layer_d1.c:421:16: Call
419.       if ((SSL3_RECORD_get_length(rr) == 0)
420.           || (s->rlayer.rstate == SSL_ST_READ_BODY)) {
421.           iret = dtls1_get_record(s);
                      ^
422.           if (iret <= 0) {
423.               iret = dtls1_read_failed(s, iret);

ssl/record/ssl3_record.c:1776:1: Parameter `s->rlayer.numwpipes`
  1774.    */
  1775.   /* used only by dtls1_read_bytes */
  1776. > int dtls1_get_record(SSL *s)
  1777.   {
  1778.       int ssl_major, ssl_minor;

ssl/record/ssl3_record.c:1794:10: Call
  1792.        * This is a non-blocking operation.
  1793.        */
  1794.       if (!dtls1_process_buffered_records(s)) {
                   ^
  1795.           /* SSLfatal() already called */
  1796.           return -1;

ssl/record/rec_layer_d1.c:224:1: Parameter `s->rlayer.numwpipes`
    222.                      &((s)->rlayer.d->unprocessed_rcds))
    223.   
    224. > int dtls1_process_buffered_records(SSL *s)
    225.   {
    226.       pitem *item;

ssl/record/rec_layer_d1.c:423:20: Call
421.           iret = dtls1_get_record(s);
422.           if (iret <= 0) {
423.               iret = dtls1_read_failed(s, iret);
                          ^
424.               /*
425.                * Anything other than a timeout is an error. SSLfatal() already

ssl/statem/statem_dtls.c:939:1: Parameter `s->rlayer.numwpipes`
  937.   #endif
  938.   
  939. > int dtls1_read_failed(SSL *s, int code)
  940.   {
  941.       if (code > 0) {

ssl/statem/statem_dtls.c:961:12: Call
  959.       }
  960.   
  961.       return dtls1_handle_timeout(s);
                    ^
  962.   }
  963.   

ssl/d1_lib.c:389:1: Parameter `s->rlayer.numwpipes`
    387.   }
    388.   
    389. > int dtls1_handle_timeout(SSL *s)
    390.   {
    391.       /* if no timer is expired, don't do anything */

ssl/d1_lib.c:413:12: Call
    411.       dtls1_start_timer(s);
    412.       /* Calls SSLfatal() if required */
    413.       return dtls1_retransmit_buffered_messages(s);
                      ^
    414.   }
    415.   

ssl/statem/statem_dtls.c:979:1: Parameter `s->rlayer.numwpipes`
      977.   }
      978.   
      979. > int dtls1_retransmit_buffered_messages(SSL *s)
      980.   {
      981.       pqueue *sent = s->d1->sent_messages;

ssl/statem/statem_dtls.c:991:13: Call
      989.       for (item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter)) {
      990.           frag = (hm_fragment *)item->data;
      991.           if (dtls1_retransmit_message(s, (unsigned short)
                         ^
      992.                                        dtls1_get_queue_priority
      993.                                        (frag->msg_header.seq,

ssl/statem/statem_dtls.c:1068:1: Parameter `s->rlayer.numwpipes`
        1066.   }
        1067.   
        1068. > int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found)
        1069.   {
        1070.       int ret;

ssl/statem/statem_dtls.c:1126:11: Call
        1124.                                           saved_retransmit_state.epoch);
        1125.   
        1126.       ret = dtls1_do_write(s, frag->msg_header.is_ccs ?
                          ^
        1127.                            SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
        1128.   

ssl/statem/statem_dtls.c:110:1: Parameter `s->rlayer.numwpipes`
          108.    * SSL3_RT_CHANGE_CIPHER_SPEC)
          109.    */
          110. > int dtls1_do_write(SSL *s, int type)
          111.   {
          112.       int ret;

ssl/statem/statem_dtls.c:240:15: Call
          238.           }
          239.   
          240.           ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len,
                               ^
          241.                                   &written);
          242.           if (ret < 0) {

ssl/record/rec_layer_d1.c:750:1: Parameter `s->rlayer.numwpipes`
            748.    * not all data has been sent or non-blocking IO.
            749.    */
            750. > int dtls1_write_bytes(SSL *s, int type, const void *buf, size_t len,
            751.                         size_t *written)
            752.   {

ssl/record/rec_layer_d1.c:761:9: Call
            759.       }
            760.       s->rwstate = SSL_NOTHING;
            761.       i = do_dtls1_write(s, type, buf, len, 0, written);
                           ^
            762.       return i;
            763.   }

ssl/record/rec_layer_d1.c:765:1: Parameter `s->rlayer.numwpipes`
              763.   }
              764.   
              765. > int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
              766.                      size_t len, int create_empty_fragment, size_t *written)
              767.   {

ssl/record/rec_layer_d1.c:974:12: Call
              972.   
              973.       /* we now just need to write the buffer. Calls SSLfatal() as required. */
              974.       return ssl3_write_pending(s, type, buf, len, written);
                                ^
              975.   }
              976.   

ssl/record/rec_layer_s3.c:1108:1: <LHS trace>
1106.    * Return values are as per SSL_write()
1107.    */
1108. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
1109.                          size_t *written)
1110.   {

ssl/record/rec_layer_s3.c:1108:1: Parameter `s->rlayer.numwpipes`
                1106.    * Return values are as per SSL_write()
                1107.    */
                1108. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
                1109.                          size_t *written)
                1110.   {

ssl/record/rec_layer_s3.c:1128:16: Binary operation: ([0, max(1, s->rlayer.numwpipes)] - 1):unsigned64 by call to `dtls1_read_failed` 
                1126.           /* Loop until we find a buffer we haven't written out yet */
                1127.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
                1128.               && currbuf < s->rlayer.numwpipes - 1) {
                                       ^
                1129.               currbuf++;
                1130.               continue;
