ssl/d1_both.c:624: error: INTEGER_OVERFLOW_L2
  ([-oo, 2147483647] + 3):signed32 by call to `BUF_MEM_grow_clean`.
Showing all 8 steps of the trace


ssl/d1_both.c:564:5: Call
562.       /* parse the message fragment header */
563.       
564.       dtls1_get_message_header(p, &msg_hdr);
           ^
565.   
566.       /* 

ssl/d1_both.c:1244:1: Parameter `*data`
  1242.   	}
  1243.   
  1244. > void
  1245.   dtls1_get_message_header(unsigned char *data, struct hm_header_st *msg_hdr)
  1246.       {

ssl/d1_both.c:1249:5: Assignment
  1247.       memset(msg_hdr, 0x00, sizeof(struct hm_header_st));
  1248.       msg_hdr->type = *(data++);
  1249.       n2l3(data, msg_hdr->msg_len);
              ^
  1250.       
  1251.       n2s(data, msg_hdr->seq);

ssl/d1_both.c:573:5: Assignment
571.           return dtls1_process_out_of_seq_message(s, &msg_hdr, ok);
572.   
573.       l = msg_hdr.msg_len;
           ^
574.       frag_off = msg_hdr.frag_off;
575.   	frag_len = msg_hdr.frag_len;

ssl/d1_both.c:624:13: Call
622.   			goto f_err;
623.   			}
624.   		if (l && !BUF_MEM_grow_clean(s->init_buf,(int)l
                   ^
625.   			+ DTLS1_HM_HEADER_LENGTH))
626.   			{

crypto/buffer/buffer.c:128:1: <LHS trace>
126.   	}
127.   
128. > int BUF_MEM_grow_clean(BUF_MEM *str, int len)
129.   	{
130.   	char *ret;

crypto/buffer/buffer.c:128:1: Parameter `len`
  126.   	}
  127.   
  128. > int BUF_MEM_grow_clean(BUF_MEM *str, int len)
  129.   	{
  130.   	char *ret;

crypto/buffer/buffer.c:145:2: Binary operation: ([-oo, 2147483647] + 3):signed32 by call to `BUF_MEM_grow_clean` 
  143.   		return(len);
  144.   		}
  145.   	n=(len+3)/3*4;
          ^
  146.   	if (str->data == NULL)
  147.   		ret=OPENSSL_malloc(n);
