ssl/record/rec_layer_d1.c:400: error: INTEGER_OVERFLOW_L2
  ([0, max(1, `s->rlayer.numwpipes`)] - 1):unsigned64 by call to `dtls1_handle_timeout`.
Showing all 17 steps of the trace


ssl/record/rec_layer_d1.c:331:1: Parameter `s->rlayer.numwpipes`
329.    *             none of our business
330.    */
331. > int dtls1_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
332.                        size_t len, int peek, size_t *readbytes)
333.   {

ssl/record/rec_layer_d1.c:400:9: Call
398.   
399.       /* Check for timeout */
400.       if (dtls1_handle_timeout(s) > 0)
               ^
401.           goto start;
402.   

ssl/d1_lib.c:369:1: Parameter `s->rlayer.numwpipes`
  367.   }
  368.   
  369. > int dtls1_handle_timeout(SSL *s)
  370.   {
  371.       /* if no timer is expired, don't do anything */

ssl/d1_lib.c:387:12: Call
  385.   
  386.       dtls1_start_timer(s);
  387.       return dtls1_retransmit_buffered_messages(s);
                    ^
  388.   }
  389.   

ssl/statem/statem_dtls.c:958:1: Parameter `s->rlayer.numwpipes`
    956.   }
    957.   
    958. > int dtls1_retransmit_buffered_messages(SSL *s)
    959.   {
    960.       pqueue *sent = s->d1->sent_messages;

ssl/statem/statem_dtls.c:970:13: Call
    968.       for (item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter)) {
    969.           frag = (hm_fragment *)item->data;
    970.           if (dtls1_retransmit_message(s, (unsigned short)
                       ^
    971.                                        dtls1_get_queue_priority
    972.                                        (frag->msg_header.seq,

ssl/statem/statem_dtls.c:1047:1: Parameter `s->rlayer.numwpipes`
      1045.   }
      1046.   
      1047. > int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found)
      1048.   {
      1049.       int ret;

ssl/statem/statem_dtls.c:1104:11: Call
      1102.                                           saved_retransmit_state.epoch);
      1103.   
      1104.       ret = dtls1_do_write(s, frag->msg_header.is_ccs ?
                        ^
      1105.                            SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
      1106.   

ssl/statem/statem_dtls.c:109:1: Parameter `s->rlayer.numwpipes`
        107.    * SSL3_RT_CHANGE_CIPHER_SPEC)
        108.    */
        109. > int dtls1_do_write(SSL *s, int type)
        110.   {
        111.       int ret;

ssl/statem/statem_dtls.c:239:15: Call
        237.           }
        238.   
        239.           ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len,
                             ^
        240.                                   &written);
        241.           if (ret < 0) {

ssl/record/rec_layer_d1.c:730:1: Parameter `s->rlayer.numwpipes`
          728.    * not all data has been sent or non-blocking IO.
          729.    */
          730. > int dtls1_write_bytes(SSL *s, int type, const void *buf, size_t len,
          731.                         size_t *written)
          732.   {

ssl/record/rec_layer_d1.c:740:9: Call
          738.       }
          739.       s->rwstate = SSL_NOTHING;
          740.       i = do_dtls1_write(s, type, buf, len, 0, written);
                         ^
          741.       return i;
          742.   }

ssl/record/rec_layer_d1.c:744:1: Parameter `s->rlayer.numwpipes`
            742.   }
            743.   
            744. > int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
            745.                      size_t len, int create_empty_fragment, size_t *written)
            746.   {

ssl/record/rec_layer_d1.c:936:12: Call
            934.   
            935.       /* we now just need to write the buffer */
            936.       return ssl3_write_pending(s, type, buf, len, written);
                              ^
            937.    err:
            938.       return -1;

ssl/record/rec_layer_s3.c:1058:1: <LHS trace>
1056.    * Return values are as per SSL_write()
1057.    */
1058. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
1059.                          size_t *written)
1060.   {

ssl/record/rec_layer_s3.c:1058:1: Parameter `s->rlayer.numwpipes`
              1056.    * Return values are as per SSL_write()
              1057.    */
              1058. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
              1059.                          size_t *written)
              1060.   {

ssl/record/rec_layer_s3.c:1077:16: Binary operation: ([0, max(1, s->rlayer.numwpipes)] - 1):unsigned64 by call to `dtls1_handle_timeout` 
              1075.           /* Loop until we find a buffer we haven't written out yet */
              1076.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
              1077.               && currbuf < s->rlayer.numwpipes - 1) {
                                     ^
              1078.               currbuf++;
              1079.               continue;
