ssl/s3_pkt.c:311: error: INTEGER_OVERFLOW_L2
  (18437 - [0, 4+max(34816, `s->s3->rrec.length`)]):unsigned32 by call to `ssl3_read_n`.
Showing all 5 steps of the trace


ssl/s3_pkt.c:231:1: Parameter `s->packet_length`
229.    */
230.   /* used only by ssl3_read_bytes */
231. > static int ssl3_get_record(SSL *s)
232.   	{
233.   	int ssl_major,ssl_minor,al;

ssl/s3_pkt.c:311:5: Call
309.   		/* now s->packet_length == SSL3_RT_HEADER_LENGTH */
310.   		i=rr->length;
311.   		n=ssl3_read_n(s,i,i,1);
           ^
312.   		if (n <= 0) return(n); /* error or non-blocking io */
313.   		/* now n == rr->length,

ssl/s3_pkt.c:129:1: <RHS trace>
127.   
128.   /* used only by ssl3_get_record */
129. > static int ssl3_read_n(SSL *s, int n, int max, int extend)
130.   	{
131.   	/* If extend == 0, obtain new n-byte packet; if extend == 1, increase

ssl/s3_pkt.c:129:1: Parameter `s->packet_length`
  127.   
  128.   /* used only by ssl3_get_record */
  129. > static int ssl3_read_n(SSL *s, int n, int max, int extend)
  130.   	{
  131.   	/* If extend == 0, obtain new n-byte packet; if extend == 1, increase

ssl/s3_pkt.c:165:3: Binary operation: (18437 - [0, 4+max(34816, s->s3->rrec.length)]):unsigned32 by call to `ssl3_read_n` 
  163.   	{
  164.   		/* avoid buffer overflow */
  165.   		int max_max = SSL3_RT_MAX_PACKET_SIZE - s->packet_length;
           ^
  166.   		if (s->options & SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER)
  167.   			max_max += SSL3_RT_MAX_EXTRA;
