ssl/record/ssl3_record.c:1683: error: INTEGER_OVERFLOW_L2
  ([0, 17728] - [256, 320]):unsigned64 by call to `dtls1_process_record`.
Showing all 11 steps of the trace


ssl/record/ssl3_record.c:1571:13: Unknown value from: non-const function
1569.   
1570.           if (s->msg_callback)
1571.               s->msg_callback(0, 0, SSL3_RT_HEADER, p, DTLS1_RT_HEADER_LENGTH,
                    ^
1572.                               s, s->msg_callback_arg);
1573.   

ssl/record/ssl3_record.c:1586:9: Assignment
1584.           p += 6;
1585.   
1586.           n2s(p, rr->length);
                ^
1587.   
1588.           /* Lets check version */

ssl/record/ssl3_record.c:1683:10: Call
1681.       }
1682.   
1683.       if (!dtls1_process_record(s, bitmap)) {
                 ^
1684.           rr->length = 0;
1685.           RECORD_LAYER_reset_packet_length(&s->rlayer); /* dump this record */

ssl/record/ssl3_record.c:1308:1: Parameter `s->rlayer.rrec.length`
  1306.   }
  1307.   
  1308. > int dtls1_process_record(SSL *s, DTLS1_BITMAP *bitmap)
  1309.   {
  1310.       int i, al;

ssl/record/ssl3_record.c:1348:5: Assignment
  1346.       /* decrypt in place in 'rr->input' */
  1347.       rr->data = rr->input;
  1348.       rr->orig_len = rr->length;
              ^
  1349.   
  1350.       if (SSL_USE_ETM(s) && s->read_hash) {

ssl/record/ssl3_record.c:1433:13: Call
  1431.                */
  1432.               mac = mac_tmp;
  1433.               ssl3_cbc_copy_mac(mac_tmp, rr, mac_size);
                      ^
  1434.               rr->length -= mac_size;
  1435.           } else {

ssl/record/ssl3_record.c:1231:1: <LHS trace>
1229.   #define CBC_MAC_ROTATE_IN_PLACE
1230.   
1231. > void ssl3_cbc_copy_mac(unsigned char *out,
1232.                          const SSL3_RECORD *rec, size_t md_size)
1233.   {

ssl/record/ssl3_record.c:1231:1: Parameter `md_size`
    1229.   #define CBC_MAC_ROTATE_IN_PLACE
    1230.   
    1231. > void ssl3_cbc_copy_mac(unsigned char *out,
    1232.                          const SSL3_RECORD *rec, size_t md_size)
    1233.   {

ssl/record/ssl3_record.c:1231:1: <RHS trace>
1229.   #define CBC_MAC_ROTATE_IN_PLACE
1230.   
1231. > void ssl3_cbc_copy_mac(unsigned char *out,
1232.                          const SSL3_RECORD *rec, size_t md_size)
1233.   {

ssl/record/ssl3_record.c:1231:1: Parameter `md_size`
    1229.   #define CBC_MAC_ROTATE_IN_PLACE
    1230.   
    1231. > void ssl3_cbc_copy_mac(unsigned char *out,
    1232.                          const SSL3_RECORD *rec, size_t md_size)
    1233.   {

ssl/record/ssl3_record.c:1264:9: Binary operation: ([0, 17728] - [256, 320]):unsigned64 by call to `dtls1_process_record` 
    1262.       /* This information is public so it's safe to branch based on it. */
    1263.       if (rec->orig_len > md_size + 255 + 1)
    1264.           scan_start = rec->orig_len - (md_size + 255 + 1);
                    ^
    1265.       /*
    1266.        * div_spoiler contains a multiple of md_size that is used to cause the
