ssl/statem/statem.c:560: error: INTEGER_OVERFLOW_L2
  ([2, max(2147483644, `s->init_buf->max`)] - [1, 2147483644]):unsigned64 by call to `tls_get_message_header`.
Showing all 11 steps of the trace


ssl/statem/statem.c:519:1: Parameter `s->init_buf->max`
517.    * will resume in the same state where we left off.
518.    */
519. > static SUB_STATE_RETURN read_state_machine(SSL *s) {
520.       OSSL_STATEM *st = &s->statem;
521.       int ret, mt;

ssl/statem/statem.c:560:23: Call
558.                   ret = dtls_get_message(s, &mt, &len);
559.               } else {
560.                   ret = tls_get_message_header(s, &mt);
                             ^
561.               }
562.   

ssl/statem/statem_lib.c:440:1: Parameter `s->init_buf->max`
  438.   }
  439.   
  440. > int tls_get_message_header(SSL *s, int *mt)
  441.   {
  442.       /* s->init_num < SSL3_HM_HEADER_LENGTH */

ssl/statem/statem_lib.c:521:19: Call
  519.               goto f_err;
  520.           }
  521.           if (l && !BUF_MEM_grow_clean(s->init_buf,
                           ^
  522.                                       (int)l + SSL3_HM_HEADER_LENGTH)) {
  523.               SSLerr(SSL_F_TLS_GET_MESSAGE_HEADER, ERR_R_BUF_LIB);

crypto/buffer/buffer.c:158:1: Parameter `len`
    156.   }
    157.   
    158. > size_t BUF_MEM_grow_clean(BUF_MEM *str, size_t len)
    159.   {
    160.       char *ret;

crypto/buffer/buffer.c:182:15: Call
    180.           ret = sec_alloc_realloc(str, n);
    181.       else
    182.           ret = OPENSSL_clear_realloc(str->data, str->max, n);
                         ^
    183.       if (ret == NULL) {
    184.           BUFerr(BUF_F_BUF_MEM_GROW_CLEAN, ERR_R_MALLOC_FAILURE);

crypto/mem.c:193:1: <LHS trace>
191.   }
192.   
193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
194.                              const char *file, int line)
195.   {

crypto/mem.c:193:1: Parameter `num`
      191.   }
      192.   
      193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
      194.                              const char *file, int line)
      195.   {

crypto/mem.c:193:1: <RHS trace>
191.   }
192.   
193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
194.                              const char *file, int line)
195.   {

crypto/mem.c:193:1: Parameter `num`
      191.   }
      192.   
      193. > void *CRYPTO_clear_realloc(void *str, size_t old_len, size_t num,
      194.                              const char *file, int line)
      195.   {

crypto/mem.c:208:9: Binary operation: ([2, max(2147483644, s->init_buf->max)] - [1, 2147483644]):unsigned64 by call to `tls_get_message_header` 
      206.       /* Can't shrink the buffer since memcpy below copies |old_len| bytes. */
      207.       if (num < old_len) {
      208.           memset((char*)str + num, 0, old_len - num);
                     ^
      209.           return str;
      210.       }
