ssl/record/ssl3_record.c:465: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - [256, 320]):unsigned64 by call to `ssl3_cbc_copy_mac`.
Showing all 8 steps of the trace


ssl/record/ssl3_record.c:125:1: Parameter `s->rlayer.rrec.length`
123.    */
124.   /* used only by ssl3_read_bytes */
125. > int ssl3_get_record(SSL *s)
126.   {
127.       int al;

ssl/record/ssl3_record.c:356:9: Assignment
354.           /* decrypt in place in 'rr->input' */
355.           rr[num_recs].data = rr[num_recs].input;
356.           rr[num_recs].orig_len = rr[num_recs].length;
               ^
357.   
358.           /* Mark this record as not read by upper layers yet */

ssl/record/ssl3_record.c:465:17: Call
463.                    */
464.                   mac = mac_tmp;
465.                   ssl3_cbc_copy_mac(mac_tmp, &rr[j], mac_size);
                       ^
466.                   rr[j].length -= mac_size;
467.               } else {

ssl/record/ssl3_record.c:1283:1: <LHS trace>
1281.   #define CBC_MAC_ROTATE_IN_PLACE
1282.   
1283. > void ssl3_cbc_copy_mac(unsigned char *out,
1284.                          const SSL3_RECORD *rec, size_t md_size)
1285.   {

ssl/record/ssl3_record.c:1283:1: Parameter `md_size`
  1281.   #define CBC_MAC_ROTATE_IN_PLACE
  1282.   
  1283. > void ssl3_cbc_copy_mac(unsigned char *out,
  1284.                          const SSL3_RECORD *rec, size_t md_size)
  1285.   {

ssl/record/ssl3_record.c:1283:1: <RHS trace>
1281.   #define CBC_MAC_ROTATE_IN_PLACE
1282.   
1283. > void ssl3_cbc_copy_mac(unsigned char *out,
1284.                          const SSL3_RECORD *rec, size_t md_size)
1285.   {

ssl/record/ssl3_record.c:1283:1: Parameter `md_size`
  1281.   #define CBC_MAC_ROTATE_IN_PLACE
  1282.   
  1283. > void ssl3_cbc_copy_mac(unsigned char *out,
  1284.                          const SSL3_RECORD *rec, size_t md_size)
  1285.   {

ssl/record/ssl3_record.c:1316:9: Binary operation: ([0, +oo] - [256, 320]):unsigned64 by call to `ssl3_cbc_copy_mac` 
  1314.       /* This information is public so it's safe to branch based on it. */
  1315.       if (rec->orig_len > md_size + 255 + 1)
  1316.           scan_start = rec->orig_len - (md_size + 255 + 1);
                  ^
  1317.       /*
  1318.        * div_spoiler contains a multiple of md_size that is used to cause the
