ssl/record/rec_layer_d1.c:411: error: INTEGER_OVERFLOW_L2
  ([0, max(1, `s->rlayer.numwpipes`)] - 1):unsigned64 by call to `dtls1_handle_timeout`.
Showing all 17 steps of the trace


ssl/record/rec_layer_d1.c:340:1: Parameter `s->rlayer.numwpipes`
338.    *             none of our business
339.    */
340. > int dtls1_read_bytes(SSL *s, int type, int *recvd_type, unsigned char *buf,
341.                        size_t len, int peek, size_t *readbytes)
342.   {

ssl/record/rec_layer_d1.c:411:9: Call
409.   
410.       /* Check for timeout */
411.       if (dtls1_handle_timeout(s) > 0) {
               ^
412.           goto start;
413.       } else if (ossl_statem_in_error(s)) {

ssl/d1_lib.c:389:1: Parameter `s->rlayer.numwpipes`
  387.   }
  388.   
  389. > int dtls1_handle_timeout(SSL *s)
  390.   {
  391.       /* if no timer is expired, don't do anything */

ssl/d1_lib.c:413:12: Call
  411.       dtls1_start_timer(s);
  412.       /* Calls SSLfatal() if required */
  413.       return dtls1_retransmit_buffered_messages(s);
                    ^
  414.   }
  415.   

ssl/statem/statem_dtls.c:979:1: Parameter `s->rlayer.numwpipes`
    977.   }
    978.   
    979. > int dtls1_retransmit_buffered_messages(SSL *s)
    980.   {
    981.       pqueue *sent = s->d1->sent_messages;

ssl/statem/statem_dtls.c:991:13: Call
    989.       for (item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter)) {
    990.           frag = (hm_fragment *)item->data;
    991.           if (dtls1_retransmit_message(s, (unsigned short)
                       ^
    992.                                        dtls1_get_queue_priority
    993.                                        (frag->msg_header.seq,

ssl/statem/statem_dtls.c:1068:1: Parameter `s->rlayer.numwpipes`
      1066.   }
      1067.   
      1068. > int dtls1_retransmit_message(SSL *s, unsigned short seq, int *found)
      1069.   {
      1070.       int ret;

ssl/statem/statem_dtls.c:1126:11: Call
      1124.                                           saved_retransmit_state.epoch);
      1125.   
      1126.       ret = dtls1_do_write(s, frag->msg_header.is_ccs ?
                        ^
      1127.                            SSL3_RT_CHANGE_CIPHER_SPEC : SSL3_RT_HANDSHAKE);
      1128.   

ssl/statem/statem_dtls.c:110:1: Parameter `s->rlayer.numwpipes`
        108.    * SSL3_RT_CHANGE_CIPHER_SPEC)
        109.    */
        110. > int dtls1_do_write(SSL *s, int type)
        111.   {
        112.       int ret;

ssl/statem/statem_dtls.c:240:15: Call
        238.           }
        239.   
        240.           ret = dtls1_write_bytes(s, type, &s->init_buf->data[s->init_off], len,
                             ^
        241.                                   &written);
        242.           if (ret < 0) {

ssl/record/rec_layer_d1.c:750:1: Parameter `s->rlayer.numwpipes`
          748.    * not all data has been sent or non-blocking IO.
          749.    */
          750. > int dtls1_write_bytes(SSL *s, int type, const void *buf, size_t len,
          751.                         size_t *written)
          752.   {

ssl/record/rec_layer_d1.c:761:9: Call
          759.       }
          760.       s->rwstate = SSL_NOTHING;
          761.       i = do_dtls1_write(s, type, buf, len, 0, written);
                         ^
          762.       return i;
          763.   }

ssl/record/rec_layer_d1.c:765:1: Parameter `s->rlayer.numwpipes`
            763.   }
            764.   
            765. > int do_dtls1_write(SSL *s, int type, const unsigned char *buf,
            766.                      size_t len, int create_empty_fragment, size_t *written)
            767.   {

ssl/record/rec_layer_d1.c:974:12: Call
            972.   
            973.       /* we now just need to write the buffer. Calls SSLfatal() as required. */
            974.       return ssl3_write_pending(s, type, buf, len, written);
                              ^
            975.   }
            976.   

ssl/record/rec_layer_s3.c:1108:1: <LHS trace>
1106.    * Return values are as per SSL_write()
1107.    */
1108. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
1109.                          size_t *written)
1110.   {

ssl/record/rec_layer_s3.c:1108:1: Parameter `s->rlayer.numwpipes`
              1106.    * Return values are as per SSL_write()
              1107.    */
              1108. > int ssl3_write_pending(SSL *s, int type, const unsigned char *buf, size_t len,
              1109.                          size_t *written)
              1110.   {

ssl/record/rec_layer_s3.c:1128:16: Binary operation: ([0, max(1, s->rlayer.numwpipes)] - 1):unsigned64 by call to `dtls1_handle_timeout` 
              1126.           /* Loop until we find a buffer we haven't written out yet */
              1127.           if (SSL3_BUFFER_get_left(&wb[currbuf]) == 0
              1128.               && currbuf < s->rlayer.numwpipes - 1) {
                                     ^
              1129.               currbuf++;
              1130.               continue;
