ssl/s3_enc.c:768: error: INTEGER_OVERFLOW_L2
  ([-51, +oo] - 1):unsigned32 by call to `ssl3_cbc_digest_record`.
Showing all 6 steps of the trace


ssl/s3_enc.c:705:1: Parameter `ssl->s3->rrec.type`
703.   	}
704.   
705. > int n_ssl3_mac(SSL *ssl, unsigned char *md, int send)
706.   	{
707.   	SSL3_RECORD *rec;

ssl/s3_enc.c:738:2: Assignment
736.   
737.   	/* kludge: ssl3_cbc_remove_padding passes padding length in rec->type */
738.   	orig_len = rec->length+md_size+((unsigned int)rec->type>>8);
        ^
739.   	rec->type &= 0xff;
740.   

ssl/s3_enc.c:768:3: Call
766.   		header[j++] = rec->length & 0xff;
767.   
768.   		ssl3_cbc_digest_record(
         ^
769.   			hash,
770.   			md, &md_size,

ssl/s3_cbc.c:479:4: <LHS trace>
477.   			md_final_raw = tls1_md5_final_raw;
478.   			md_transform = (void(*)(void *ctx, const unsigned char *block)) MD5_Transform;
479.   			md_size = 16;
          ^
480.   			sslv3_pad_length = 48;
481.   			length_is_big_endian = 0;

ssl/s3_cbc.c:479:4: Assignment
  477.   			md_final_raw = tls1_md5_final_raw;
  478.   			md_transform = (void(*)(void *ctx, const unsigned char *block)) MD5_Transform;
  479.   			md_size = 16;
            ^
  480.   			sslv3_pad_length = 48;
  481.   			length_is_big_endian = 0;

ssl/s3_cbc.c:569:2: Binary operation: ([-51, +oo] - 1):unsigned32 by call to `ssl3_cbc_digest_record` 
  567.   	/* max_mac_bytes contains the maximum bytes of bytes in the MAC, including
  568.   	* |header|, assuming that there's no padding. */
  569.   	max_mac_bytes = len - md_size - 1;
          ^
  570.   	/* num_blocks is the maximum number of hash blocks. */
  571.   	num_blocks = (max_mac_bytes + 1 + md_length_size + md_block_size - 1) / md_block_size;
