ssl/record/ssl3_record.c:721: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [`*inrecs->data` + 1, `*inrecs->data` + 1]):unsigned32 by call to `ssl3_cbc_remove_padding`.
Showing all 11 steps of the trace


ssl/record/ssl3_record.c:658:1: Parameter `*inrecs->data`
656.    *       occurred.
657.    */
658. > int ssl3_enc(SSL *s, SSL3_RECORD *inrecs, unsigned int n_recs, int send)
659.   {
660.       SSL3_RECORD *rec;

ssl/record/ssl3_record.c:721:20: Call
719.               mac_size = EVP_MD_CTX_size(s->read_hash);
720.           if ((bs != 1) && !send)
721.               return ssl3_cbc_remove_padding(rec, bs, mac_size);
                          ^
722.       }
723.       return (1);

ssl/record/ssl3_record.c:1164:1: Parameter `block_size`
  1162.    *  -1: otherwise.
  1163.    */
  1164. > int ssl3_cbc_remove_padding(SSL3_RECORD *rec,
  1165.                               unsigned block_size, unsigned mac_size)
  1166.   {

ssl/record/ssl3_record.c:1179:13: Call
  1177.       good = constant_time_ge(rec->length, padding_length + overhead);
  1178.       /* SSLv3 requires that the padding is minimal. */
  1179.       good &= constant_time_ge(block_size, padding_length + 1);
                      ^
  1180.       rec->length -= good & (padding_length + 1);
  1181.       return constant_time_select_int(good, 1, -1);

include/internal/constant_time_locl.h:153:1: Parameter `a`
    151.   }
    152.   
    153. > static ossl_inline unsigned int constant_time_ge(unsigned int a,
    154.                                                    unsigned int b)
    155.   {

include/internal/constant_time_locl.h:156:13: Call
    154.                                                    unsigned int b)
    155.   {
    156.       return ~constant_time_lt(a, b);
                       ^
    157.   }
    158.   

include/internal/constant_time_locl.h:141:1: <LHS trace>
139.   }
140.   
141. > static ossl_inline unsigned int constant_time_lt(unsigned int a,
142.                                                    unsigned int b)
143.   {

include/internal/constant_time_locl.h:141:1: Parameter `a`
      139.   }
      140.   
      141. > static ossl_inline unsigned int constant_time_lt(unsigned int a,
      142.                                                    unsigned int b)
      143.   {

include/internal/constant_time_locl.h:141:1: <RHS trace>
139.   }
140.   
141. > static ossl_inline unsigned int constant_time_lt(unsigned int a,
142.                                                    unsigned int b)
143.   {

include/internal/constant_time_locl.h:141:1: Parameter `b`
      139.   }
      140.   
      141. > static ossl_inline unsigned int constant_time_lt(unsigned int a,
      142.                                                    unsigned int b)
      143.   {

include/internal/constant_time_locl.h:144:12: Binary operation: ([0, +oo] - [*inrecs->data + 1, *inrecs->data + 1]):unsigned32 by call to `ssl3_cbc_remove_padding` 
      142.                                                    unsigned int b)
      143.   {
      144.       return constant_time_msb(a ^ ((a ^ b) | ((a - b) ^ b)));
                        ^
      145.   }
      146.   
